PT-2020-6589 · Libproxy+5 · Libproxy+5
Li Fei
·
Published
2020-07-16
·
Updated
2025-02-27
·
CVE-2020-26154
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
libproxy versions prior to 0.4.16
Description
The issue is related to a buffer overflow in the url.cpp file of libproxy when PAC is enabled. This can be triggered by a large PAC file delivered without a Content-length header, potentially allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.
Recommendations
For versions prior to 0.4.16, update to version 0.4.16 or later to resolve the issue.
As a temporary workaround, consider disabling PAC when using libproxy until a patch is available.
Restrict access to the url.cpp component to minimize the risk of exploitation.
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Suse
Ubuntu
Libproxy