CVE-2009-4413

2009-12-2416:30:00

CWE-189

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

AI Score

6.5

Confidence

High

EPSS

0.034

Percentile

91.5%

JSON

The httpClientDiscardBody function in client.c in Polipo 0.9.8, 0.9.12, 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a large Content-Length value, which triggers an integer overflow, a signed-to-unsigned conversion error with a negative value, and a segmentation fault.

Affected configurations

Nvd

Node

pps.jussieupolipoMatch0.9.8

pps.jussieupolipoMatch0.9.12

pps.jussieupolipoMatch1.0.4

VendorProductVersionCPE
pps.jussieupolipo0.9.8cpe:2.3:a:pps.jussieu:polipo:0.9.8:*:*:*:*:*:*:*
pps.jussieupolipo0.9.12cpe:2.3:a:pps.jussieu:polipo:0.9.12:*:*:*:*:*:*:*
pps.jussieupolipo1.0.4cpe:2.3:a:pps.jussieu:polipo:1.0.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pps.jussieu	polipo	0.9.8	cpe:2.3:a:pps.jussieu:polipo:0.9.8:::::::*
pps.jussieu	polipo	0.9.12	cpe:2.3:a:pps.jussieu:polipo:0.9.12:::::::*
pps.jussieu	polipo	1.0.4	cpe:2.3:a:pps.jussieu:polipo:1.0.4:::::::*