CVE-2022-40468 Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_reque...
HighCVSS 7.5
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/tinyproxy(Debian:12) | < 1.11.1-2 | 1.11.1-2 |
| debian/tinyproxy(Debian:13) | < 1.11.1-2 | 1.11.1-2 |
| debian/tinyproxy(Debian:14) | < 1.11.1-2 | 1.11.1-2 |
| ubuntu/tinyproxy(Ubuntu:22.04) | < 1.11.0-1ubuntu0.1~esm1 | 1.11.0-1ubuntu0.1~esm1 |
| Tinyproxy Project Tinyproxy | <= 1.11.1 | No fix listed |
| alpine/tinyproxy(Alpine:v3.16) | < 1.11.1-r2 | 1.11.1-r2 |
| alpine/tinyproxy(Alpine:v3.17) | < 1.11.1-r2 | 1.11.1-r2 |
| alpine/tinyproxy(Alpine:v3.18) | < 1.11.1-r2 | 1.11.1-r2 |
| alpine/tinyproxy(Alpine:v3.19) | < 1.11.1-r2 | 1.11.1-r2 |
| alpine/tinyproxy(Alpine:v3.20) | < 1.11.1-r2 | 1.11.1-r2 |
| alpine/tinyproxy(Alpine:v3.21) | < 1.11.1-r2 | 1.11.1-r2 |
| alpine/tinyproxy(Alpine:v3.22) | < 1.11.1-r2 | 1.11.1-r2 |
| alpine/tinyproxy(Alpine:v3.23) | < 1.11.1-r2 | 1.11.1-r2 |
| alpine/tinyproxy(Alpine:v3.24) | < 1.11.1-r2 | 1.11.1-r2 |
References
- Debian Security Tracker CVE-2022-40468 vendor-advisory
- github.com third-party-advisory
- github.com exploit third-party-advisory
- github.com exploit third-party-advisory
- GLSA-202305-27 vendor-advisory
- lists.debian.org
- Ubuntu CVE tracker vendor-advisory
- USN-7140-1 vendor-advisory
- USN-7140-2 vendor-advisory
- www.cve.org
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking