CVE-2012-4504 Stack-based buffer overflow in the url::get_pac function in url.cpp in libproxy 0.4.x before 0.4.9 allows remote servers to have an unspecified impact via a large proxy.pac file.
HighCVSS 10.0
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in the url::get_pac function in url.cpp in libproxy 0.4.x before 0.4.9 allows remote servers to have an unspecified impact via a large proxy.pac file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libproxy project libproxy | = 0.4.0 | No fix listed |
| libproxy project libproxy | = 0.4.1 | No fix listed |
| libproxy project libproxy | = 0.4.2 | No fix listed |
| libproxy project libproxy | = 0.4.3 | No fix listed |
| libproxy project libproxy | = 0.4.5 | No fix listed |
| libproxy project libproxy | = 0.4.6 | No fix listed |
| libproxy project libproxy | = 0.4.7 | No fix listed |
| libproxy project libproxy | = 0.4.8 | No fix listed |
References
- code.google.com patch
- openSUSE-SU-2012:1375 vendor-advisory
- 51048 third-party-advisory vendor-advisory
- [oss-security] 20121012 libproxy PAC downloading buffer overflows mailing-list
- [oss-security] 20121012 Re: libproxy PAC downloading buffer overflows mailing-list
- [oss-security] 20121016 Re: libproxy PAC downloading buffer overflows mailing-list
- 55909 vdb-entry
- USN-1629-1 vendor-advisory
- bugzilla.redhat.com
- libproxy-urlgetpac-bo(79249) vdb-entry
- groups.google.com
- Debian Security Tracker CVE-2012-4504 vendor-advisory