Upstream information
Description
A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having critical severity.
CNA (Talos) | |
---|---|
Base Score | 9.8 |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Attack Vector | Network |
Attack Complexity | Low |
Privileges Required | None |
User Interaction | None |
Scope | Unchanged |
Confidentiality Impact | High |
Integrity Impact | High |
Availability Impact | High |
CVSSv3 Version | 3.1 |
SUSE Security Advisories:
- openSUSE-SU-2024:0119-1, published Fri May 10 18:52:13 2024
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
SUSE Package Hub 15 SP5 |
| Patchnames: openSUSE-2024-119 |
openSUSE Leap 15.5 |
| Patchnames: openSUSE-2024-119 |
openSUSE Tumbleweed |
| Patchnames: openSUSE-Tumbleweed-2024-13943 |
SUSE Timeline for this CVE
CVE page created: Wed May 1 20:01:09 2024CVE page last modified: Fri Aug 22 22:13:52 2025