CVE-2009-3305

EUVD-2009-3287
Polipo 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a Cache-Control header that lacks a value for the max-age field, which triggers a segmentation fault in the httpParseHeaders function in http_parse.c, and possibly other unspecified vectors.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
Affected Products (NVD)
VendorProductVersion
pps.jussieupolipo
1.0.4
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
polipo
dapper
ignored
hardy
Fixed 1.0.4-1+lenny1build0.8.04.1
released
intrepid
Fixed 1.0.4-1+lenny1build0.8.10.1
released
jaunty
Fixed 1.0.4-1+lenny1build0.9.04.1
released
karmic
not-affected
Common Weakness Enumeration
References
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=547047
http://groups.google.com/group/linux.debian.bugs.dist/browse_thread/thread/dca6877a8117f0df
http://secunia.com/advisories/37607
http://secunia.com/advisories/38647
http://www.debian.org/security/2010/dsa-2002
http://www.securityfocus.com/bid/37463
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=547047
http://groups.google.com/group/linux.debian.bugs.dist/browse_thread/thread/dca6877a8117f0df
http://secunia.com/advisories/37607
http://secunia.com/advisories/38647
http://www.debian.org/security/2010/dsa-2002
http://www.securityfocus.com/bid/37463