CVE-2023-49606
A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2023-49606 tinyproxy Corrigé dans: 1.11.2-r0
- Debian DEBIAN-CVE-2023-49606 tinyproxy Corrigé dans: 1.10.0-5+deb11u1
- Ubuntu UBUNTU-CVE-2023-49606 tinyproxy Corrigé dans: 1.8.3-3ubuntu14.04.1~esm3
Références
- advisory github.com
- advisory nvd.nist.gov
- web openwall.com
- web lists.debian.org
- web talosintelligence.com
- web talosintelligence.com