url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered without a Content-length header.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6205 advisory.

    The libproxy packages provide a library that handles all the details of proxy configuration. The libproxy     library provides a stable external API, dynamic adjustment to changing network topology, and small core     footprint. It does not use external dependencies within the libproxy core, however libproxy plug-ins may     have dependencies.

    Security Fix(es):

    * libproxy: sending more than 102400 bytes in PAC without a Content-Length present could result in buffer     overflow (CVE-2020-26154)

    * libproxy: uncontrolled recursion via an infinite stream response leading to stack exhaustion     (CVE-2020-25219)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the libproxy package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - url.cpp in libproxy through 0.4.15 is prone to a buffer     overflow when PAC is enabled, as demonstrated by a     large PAC file that is delivered without a     Content-length header.(CVE-2020-26154)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libproxy package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - url::recvline in url.cpp in libproxy 0.4.x through     0.4.15 allows a remote HTTP server to trigger     uncontrolled recursion via a response composed of an     infinite stream that lacks a newline character. This     leads to stack exhaustion.(CVE-2020-25219)

  - url.cpp in libproxy through 0.4.15 is prone to a buffer     overflow when PAC is enabled, as demonstrated by a     large PAC file that is delivered without a     Content-length header.(CVE-2020-26154)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libproxy packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - url::recvline in url.cpp in libproxy 0.4.x through     0.4.15 allows a remote HTTP server to trigger     uncontrolled recursion via a response composed of an     infinite stream that lacks a newline character. This     leads to stack exhaustion.(CVE-2020-25219)

  - url.cpp in libproxy through 0.4.15 is prone to a buffer     overflow when PAC is enabled, as demonstrated by a     large PAC file that is delivered without a     Content-length header.(CVE-2020-26154)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libproxy packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - url.cpp in libproxy through 0.4.15 is prone to a buffer     overflow when PAC is enabled, as demonstrated by a     large PAC file that is delivered without a     Content-length header.(CVE-2020-26154)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libproxy packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - url.cpp in libproxy through 0.4.15 is prone to a buffer     overflow when PAC is enabled, as demonstrated by a     large PAC file that is delivered without a     Content-length header.(CVE-2020-26154)

  - url::recvline in url.cpp in libproxy 0.4.x through     0.4.15 allows a remote HTTP server to trigger     uncontrolled recursion via a response composed of an     infinite stream that lacks a newline character. This     leads to stack exhaustion.(CVE-2020-25219)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4673-1 advisory.

    Li Fei discovered that libproxy incorrectly handled certain PAC files. An attacker could possibly use this     issue to cause a crash or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libproxy fixes the following issues :

CVE-2020-25219: Rewrote url::recvline to be nonrecursive (bsc#1176410).

CVE-2020-26154: Fixed a buffer overflow when PAC is enabled (bsc#1177143).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities were discovered in libproxy, an automatic proxy configuration management library, which could result in denial of service, or possibly, execution of arbitrary code.

Li Fei found that libproxy, a library for automatic proxy configuration management, was vulnerable to a buffer overflow vulnerability when receiving a large PAC file from a server without a Content-Length header in the response.

For Debian 9 stretch, this problem has been fixed in version 0.4.14-2+deb9u2.

We recommend that you upgrade your libproxy packages.

For the detailed security status of libproxy please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libproxy

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - url.cpp in libproxy through 0.4.15 is prone to a buffer     overflow when PAC is enabled, as demonstrated by a     large PAC file that is delivered without a     Content-length header.(CVE-2020-26154)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libproxy packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libproxy offers the following features:* extremely     small core footprint (< 35K)* no external dependencies     within libproxy core(libproxy plugins may have     dependencies)* only 3 functions in the stable external     API* dynamic adjustment to changing network topology* a     standard way of dealing with proxy settings across all     scenarios* a sublime sense of joy and     accomplishmentSecurity Fix(es):url.cpp in libproxy     through 0.4.15 is prone to a buffer overflow when PAC     is enabled, as demonstrated by a large PAC file that is     delivered without a Content-length     header.(CVE-2020-26154)url::recvline in url.cpp in     libproxy 0.4.x through 0.4.15 allows a remote HTTP     server to trigger uncontrolled recursion via a response     composed of an infinite stream that lacks a newline     character. This leads to stack     exhaustion.(CVE-2020-25219)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libproxy fixes the following issues :

  - CVE-2020-25219: Rewrote url::recvline to be nonrecursive     (bsc#1176410).

  - CVE-2020-26154: Fixed a buffer overflow when PAC is     enabled (bsc#1177143).

This update was imported from the SUSE:SLE-15:Update update project.

Add fix for PAC buffer overflow

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix PAC buffer overflow

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
206486	RHEL 8 : libproxy (RHSA-2024:6205)	Nessus	Red Hat Local Security Checks	critical
147540	EulerOS Virtualization for ARM 64 3.0.2.0 : libproxy (EulerOS-SA-2021-1404)	Nessus	Huawei Local Security Checks	critical
147089	EulerOS Virtualization for ARM 64 3.0.6.0 : libproxy (EulerOS-SA-2021-1530)	Nessus	Huawei Local Security Checks	critical
147081	EulerOS Virtualization 3.0.6.6 : libproxy (EulerOS-SA-2021-1490)	Nessus	Huawei Local Security Checks	critical
146161	EulerOS 2.0 SP5 : libproxy (EulerOS-SA-2021-1204)	Nessus	Huawei Local Security Checks	critical
145127	EulerOS 2.0 SP3 : libproxy (EulerOS-SA-2021-1087)	Nessus	Huawei Local Security Checks	critical
144704	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : libproxy vulnerability (USN-4673-1)	Nessus	Ubuntu Local Security Checks	critical
143650	SUSE SLES12 Security Update : libproxy (SUSE-SU-2020:2900-1)	Nessus	SuSE Local Security Checks	critical
143612	SUSE SLED15 / SLES15 Security Update : libproxy (SUSE-SU-2020:2901-1)	Nessus	SuSE Local Security Checks	critical
143313	Debian DSA-4800-1 : libproxy - security update	Nessus	Debian Local Security Checks	critical
142931	Debian DLA-2450-1 : libproxy security update	Nessus	Debian Local Security Checks	critical
142332	EulerOS 2.0 SP9 : libproxy (EulerOS-SA-2020-2412)	Nessus	Huawei Local Security Checks	critical
142301	EulerOS 2.0 SP9 : libproxy (EulerOS-SA-2020-2430)	Nessus	Huawei Local Security Checks	critical
142262	EulerOS 2.0 SP2 : libproxy (EulerOS-SA-2020-2360)	Nessus	Huawei Local Security Checks	critical
142180	EulerOS 2.0 SP8 : libproxy (EulerOS-SA-2020-2304)	Nessus	Huawei Local Security Checks	critical
141525	openSUSE Security Update : libproxy (openSUSE-2020-1680)	Nessus	SuSE Local Security Checks	critical
141513	openSUSE Security Update : libproxy (openSUSE-2020-1676)	Nessus	SuSE Local Security Checks	critical
141269	Fedora 33 : libproxy (2020-15b775b07e)	Nessus	Fedora Local Security Checks	critical
141190	Fedora 32 : libproxy (2020-941b563a80)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2020-26154

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical