CVE-2012-6128 Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow remote VPN gateways to cause a denial of service (application crash) via a long (1) hostname, (2) path, or (3) cookie l...
MediumCVSS 5.0
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow remote VPN gateways to cause a denial of service (application crash) via a long (1) hostname, (2) path, or (3) cookie list in a response.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openconnect(Debian:12) | < 3.20-3 | 3.20-3 |
| debian/openconnect(Debian:13) | < 3.20-3 | 3.20-3 |
| debian/openconnect(Debian:14) | < 3.20-3 | 3.20-3 |
| infradead openconnect | <= 4.07 | No fix listed |
| infradead openconnect | = 1.00 | No fix listed |
| infradead openconnect | = 1.10 | No fix listed |
| infradead openconnect | = 1.20 | No fix listed |
| infradead openconnect | = 1.30 | No fix listed |
| infradead openconnect | = 1.40 | No fix listed |
| infradead openconnect | = 2.00 | No fix listed |
| infradead openconnect | = 2.01 | No fix listed |
| infradead openconnect | = 2.10 | No fix listed |
| infradead openconnect | = 2.11 | No fix listed |
| infradead openconnect | = 2.12 | No fix listed |
| infradead openconnect | = 2.20 | No fix listed |
| infradead openconnect | = 2.21 | No fix listed |
| infradead openconnect | = 2.22 | No fix listed |
| infradead openconnect | = 2.23 | No fix listed |
| infradead openconnect | = 2.24 | No fix listed |
| infradead openconnect | = 2.25 | No fix listed |
| infradead openconnect | = 2.26 | No fix listed |
| infradead openconnect | = 3.00 | No fix listed |
| infradead openconnect | = 3.01 | No fix listed |
| infradead openconnect | = 3.02 | No fix listed |
| infradead openconnect | = 3.11 | No fix listed |
Show 17 more
| Product | Affected versions | Fixed in |
|---|---|---|
| infradead openconnect | = 3.12 | No fix listed |
| infradead openconnect | = 3.13 | No fix listed |
| infradead openconnect | = 3.14 | No fix listed |
| infradead openconnect | = 3.15 | No fix listed |
| infradead openconnect | = 3.16 | No fix listed |
| infradead openconnect | = 3.17 | No fix listed |
| infradead openconnect | = 3.18 | No fix listed |
| infradead openconnect | = 3.19 | No fix listed |
| infradead openconnect | = 3.20 | No fix listed |
| infradead openconnect | = 3.99 | No fix listed |
| infradead openconnect | = 4.00 | No fix listed |
| infradead openconnect | = 4.01 | No fix listed |
| infradead openconnect | = 4.02 | No fix listed |
| infradead openconnect | = 4.03 | No fix listed |
| infradead openconnect | = 4.04 | No fix listed |
| infradead openconnect | = 4.05 | No fix listed |
| infradead openconnect | = 4.06 | No fix listed |
References
- Debian Security Tracker CVE-2012-6128 vendor-advisory
- git.infradead.org vendor-advisory
- openSUSE-SU-2013:0979 vendor-advisory
- DSA-2623 vendor-advisory
- www.infradead.org
- MDVSA-2013:108 vendor-advisory
- [oss-security] 20130212 Re: CVE request: openconnect buffer overflow mailing-list
- 57884 vdb-entry vendor-advisory
- openconnect-vpngateway-bo(82058) vdb-entry
- wiki.mageia.org
- bugs.debian.org issue-tracking