Buffer overflow in HAProxy - CVE-2016-5360
Published: June 30, 2016 / Updated: July 28, 2020
Vulnerability identifier: #VU32279
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-5360
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have unspecified other impact via unknown vectors.
Affected software
HAProxy
haproxy (Alpine package)
haproxy
Fedora
haproxy (Alpine package)
haproxy
Fedora
How to mitigate CVE-2016-5360
Install update from vendor's website.
HAProxy - update to 1.6.6
haproxy (Alpine package) - update to 1.6.6-r0
haproxy - update to 1.6.5-3.fc24
haproxy (Alpine package) - update to 1.6.6-r0
haproxy - update to 1.6.5-3.fc24