Vulnerability Details CVE-2012-5580
Format string vulnerability in the print_proxies function in bin/proxy.c in libproxy 0.3.1 might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in a proxy name, as demonstrated using the http_proxy environment variable or a PAC file.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.008
EPSS Ranking 72.9%
CVSS Severity
CVSS v2 Score 7.5
References
- http://www.securityfocus.com/bid/56712
- https://bugzilla.novell.com/show_bug.cgi?id=791086
- https://bugzilla.redhat.com/show_bug.cgi?id=883100
- https://code.google.com/p/libproxy/source/detail?r=475
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80340
- http://www.securityfocus.com/bid/56712
- https://bugzilla.novell.com/show_bug.cgi?id=791086
- https://bugzilla.redhat.com/show_bug.cgi?id=883100
- https://code.google.com/p/libproxy/source/detail?r=475
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80340
Products affected by CVE-2012-5580
-
cpe:2.3:a:libproxy_project:libproxy:0.3.1