CVE-2009-3305

描述

Polipo 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a Cache-Control header that lacks a value for the max-age field, which triggers a segmentation fault in the httpParseHeaders function in http_parse.c, and possibly other unspecified vectors.

如何修補 CVE-2009-3305

要修補 CVE-2009-3305,請將受影響套件升級到下列已修補版本。

• Debian/polipo—升級至 1.0.4-1.1 或更新版本
• Debian/polipo—升級至 1.0.4-1+lenny1 或更新版本

CVE-2009-3305 正在被利用嗎?

中等 — EPSS 為 10.1%,可持續追蹤但非最高優先。

受影響套件(2)

• from 0, < 1.0.4-1.1
• from 0, < 1.0.4-1+lenny1

參考連結(6)

• ADVISORYsecunia.com/advisories/37607
• ADVISORYsecunia.com/advisories/38647
• ADVISORYwww.debian.org/security/2010/dsa-2002
• WEBbugs.debian.org/cgi-bin/bugreport.cgi?bug=547047
• WEB