security advisorydebiantinyproxy
Two issues have been found in tinyproxy, a lightweight, non-caching, optionally anonymizing HTTP proxy. They are related to an use after free in header parsing of GTTP . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3892-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Thorsten Alteholz September 18, 2024 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : tinyproxy Version : 1.10.0-5+deb11u1 CVE ID : CVE-2022-40468 CVE-2023-49606 Two issues have been found in tinyproxy, a lightweight, non-caching, optionally anonymizing HTTP proxy. They are related to an use after free in header parsing of GTTP connections and a potential leak of left-over heap data. For Debian 11 bullseye, these problems have been fixed in version 1.10.0-5+deb11u1. We recommend that you upgrade your tinyproxy packages. For the detailed security status of tinyproxy please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/tinyproxy Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . The Debian LTS Advisory DLA-3893-1 resolves multiple vulnerabilities in package nginx concerning request validation and denial of service.. Debian LTS,tinyproxy,security advisory,heap data,HTTP proxy. . Severity: Critical. LinuxSecurity.com Team
Sep 18, 2024
•Critical
Debian LTS