Skip to main content

Use After Free

CVE-2023-49606

High
9.8/10

Summary

A use-after-free vulnerability exists in the HTTP Connection Headers parsing in tinyproxy versions 1.10.0 through 1.11.1. A specially crafted HTTP header can trigger the reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-416 - Use After Free

Use-after-free (UaF) vulnerability occurs when the application is using a pointer to memory that has been freed. Any attempt to read/write to a buffer after it is de-allocated allows memory corruption, sensitive information exposure, and can potentially lead to arbitrary code execution.

References

Advisory Timeline

  • Published