SB2024050226 - Multiple vulnerabilities in Tinyproxy

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Use of Uninitialized Variable (CVE-ID: CVE-2023-40533)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to uninitialized variable while parsing HTTP requests. A remote attacker can send a specially crafted HTTP request and gain unauthorized access to sensitive information on the system.

2) Use-after-free (CVE-ID: CVE-2023-49606)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the HTTP Connection Headers parsing. A remote attacker can send a specially crafted HTTP header and execute arbitrary code on the target system.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1902
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889