CVE-2012-5580

Publication date 27 October 2014

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Format string vulnerability in the print_proxies function in bin/proxy.c in libproxy 0.3.1 might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in a proxy name, as demonstrated using the http_proxy environment variable or a PAC file.

Read the notes from the security team

Status

Package Ubuntu Release Status
libproxy 13.04 raring
Not affected
12.10 quantal
Not affected
12.04 LTS precise
Not affected
11.10 oneiric Ignored end of life
10.04 LTS lucid Ignored end of life
8.04 LTS hardy Not in release

Notes

mdeslaur

only used in "proxy" tool in libproxy-tools package, and caught by FORTIFY_SOURCE. Reproducer from SUSE bug: http_proxy=http://foo%n.suse.de/ proxy http://foo.bar.de

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
libproxy