CVE-2012-2942 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Haproxy

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer7 documents6 sources
Severity
5.1MEDIUMNVD
EPSS
0.2%
top 58.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
HaproxyDebian Haproxy
Timeline
PublishedMay 27
Latest updateMay 17

Description

Buffer overflow in the trash buffer in the header capture functionality in HAProxy before 1.4.21, when global.tune.bufsize is set to a value greater than the default and header rewriting is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors.

CVSS vector

AV:N/AC:H/C:P/I:P/A:PExploitability: 4.9 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/haproxy< haproxy 1.4.23-1 (bookworm)
▶Debianhaproxy/haproxy< 1.4.23-1+3
▶NVDhaproxy/haproxy1.4.20

🔴Vulnerability Details

2
GHSA
GHSA-m6hh-qxwf-f2wj: Buffer overflow in the trash buffer in the header capture functionality in HAProxy before 1↗2022-05-17
▶
OSV
CVE-2012-2942: Buffer overflow in the trash buffer in the header capture functionality in HAProxy before 1↗2012-05-27
▶

📋Vendor Advisories

2
Ubuntu
HAProxy vulnerabilities↗2013-04-15
▶
Debian
CVE-2012-2942: haproxy - Buffer overflow in the trash buffer in the header capture functionality in HAPro...↗2012
▶

💬Community

2
Bugzilla
CVE-2012-2942 haproxy: trash buffer overflow flaw can lead to arbitrary code execution [epel-all]↗2012-05-23
▶
Bugzilla
CVE-2012-2942 haproxy: trash buffer overflow flaw can lead to arbitrary code execution [fedora-all]↗2012-05-23
▶