Published: 09/09/2020 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

url::recvline in url.cpp in libproxy 0.4.x up to and including 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character. This leads to stack exhaustion.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libproxy project libproxy
debian debian linux 9.0
debian debian linux 10.0
fedoraproject fedora 31
fedoraproject fedora 32
fedoraproject fedora 33
opensuse leap 15.1
opensuse leap 15.2
canonical ubuntu linux 18.04
canonical ubuntu linux 20.04
canonical ubuntu linux 16.04

Debian Bug report logs - #971394 libproxy: CVE-2020-25219 Package: src:libproxy; Maintainer for src:libproxy is Debian GNOME Maintainers <pkg-gnome-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 29 Sep 2020 20:18:01 UTC Severity: important Tags: security, upstre ...

Two vulnerabilities were discovered in libproxy, an automatic proxy configuration management library, which could result in denial of service, or possibly, execution of arbitrary code For the stable distribution (buster), these problems have been fixed in version 0415-5+deb10u1 We recommend that you upgrade your libproxy packages For the detai ...

url::recvline in urlcpp in libproxy 04x through 0415 allows a remote HTTP PAC server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character This leads to stack exhaustion ...

CWE-674 https://github.com/libproxy/libproxy/issues/134 https://lists.debian.org/debian-lts-announce/2020/09/msg00012.html https://usn.ubuntu.com/4514-1/http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00030.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00033.html https://www.debian.org/security/2020/dsa-4800 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNID6EZVOVH7EZB7KFU2EON54CFDIVUR/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JF5JSONJNO64ARWRVOS6K6HSIPHEF3H2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SSVZAAVHBJR3Z4MZNR55QW3OQFAS2STH/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=971394 https://nvd.nist.gov https://www.debian.org/security/2020/dsa-4800

CVE-2020-25219

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect