CVE-2012-6128Improper Restriction of Operations within the Bounds of a Memory Buffer in Openconnect

Severity
5.0MEDIUMNVD
EPSS
1.0%
top 23.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 24
Latest updateMay 17

Description

Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow remote VPN gateways to cause a denial of service (application crash) via a long (1) hostname, (2) path, or (3) cookie list in a response.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

Debianinfradead/openconnect< 3.20-3+3

🔴Vulnerability Details

3
GHSA
GHSA-qf4p-jmcc-vw8h: Multiple stack-based buffer overflows in http2022-05-17
OSV
CVE-2012-6128: Multiple stack-based buffer overflows in http2013-02-24
CVEList
CVE-2012-6128: Multiple stack-based buffer overflows in http2013-02-24

📋Vendor Advisories

1
Debian
CVE-2012-6128: openconnect - Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow...2012

💬Community

3
Bugzilla
CVE-2012-6128 openconnect: Stack-based buffer overflow when processing certain host names, paths, or cookie lists [epel-all]2013-02-12
Bugzilla
CVE-2012-6128 openconnect: Stack-based buffer overflow when processing certain host names, paths, or cookie lists [fedora-all]2013-02-12
Bugzilla
CVE-2012-6128 openconnect: Stack-based buffer overflow when processing certain host names, paths, or cookie lists2013-02-12
CVE-2012-6128 — Infradead Openconnect vulnerability | cvebase