[arch-security] [ASA-201501-11] tinyproxy: denial of service
anthraxx at archlinux.org
Mon Jan 19 14:59:26 UTC 2015
Arch Linux Security Advisory ASA-201501-11
Date : 2015-01-19
CVE-ID : CVE-2012-3505
Package : tinyproxy
Type : denial of service
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package tinyproxy before version 1.8.4-1 is vulnerable to denial of
Upgrade to 1.8.4-1.
# pacman -Syu "tinyproxy>=1.8.4-1"
The problem has been fixed upstream in version 1.8.4.
It was discovered that a remote attacker is able to cause a denial of
service (CPU and memory consumption) via (1) a large number of headers
or (2) a large number of forged headers that predictably trigger hash
A remote attacker is able to use specially crafted headers to
predictably cause CPU and memory consumption leading to denial of service.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security