CVE-2020-26154: Buffer Overflow
libproxy is vulnerable to a buffer overflow, caused by improper bounds checking. By persuading a victim to open a specially crafted PAC file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
Other sources
url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered without a Content-length header.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-26154?
CVE-2020-26154 has a medium severity rating due to the buffer overflow vulnerability that could allow remote code execution.
How do I fix CVE-2020-26154?
To fix CVE-2020-26154, update libproxy to version 0.4.15-5+deb10u1 or any later version provided by your Linux distribution.
Which systems are affected by CVE-2020-26154?
CVE-2020-26154 affects systems using libproxy versions prior to 0.4.15, including Debian, Fedora, and openSUSE.
Can CVE-2020-26154 lead to remote code execution?
Yes, CVE-2020-26154 can lead to remote code execution if a victim opens a specially crafted PAC file.
What is the context of the vulnerability CVE-2020-26154?
CVE-2020-26154 results from improper bounds checking in the url.cpp file of libproxy, allowing exploitation through manipulated input.