A vulnerability has been discovered in Tinyproxy which could be used to achieve memory disclosure.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/tinyproxy | * | < 1.11.1_p20220908 | >= 1.11.1_p20220908 |
Tinyproxy is a light-weight HTTP/HTTPS proxy daemon for POSIX operating systems.
Tinyproxy's request processing does not sufficiently null-initialize variables used in error pages.
Contents of the Tinyproxy server's memory could be disclosed via generated error pages.
There is no known workaround at this time.
All Tinyproxy users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/tinyproxy-1.11.1_p20220908"
A vulnerability has been found in Tinyproxy, allows remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-proxy/tinyproxy | * | < 1.8.3-r3 | >= 1.8.3-r3 |
Tinyproxy is a light-weight HTTP/HTTPS proxy daemon for POSIX operating systems.
A vulnerability has been discovered in the way how Tinyproxy works with headers.
A remote attacker could send a specially crafted request with too many headers, possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All Tinyproxy users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/tinyproxy-1.8.3-r3"