5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.004 Low
EPSS
Percentile
73.5%
Severity: Low
Date : 2020-12-05
CVE-ID : CVE-2020-25219
Package : libproxy-webkit
Type : denial of service
Remote : Yes
Link : https://security.archlinux.org/AVG-1226
The package libproxy-webkit before version 0.4.16-1 is vulnerable to
denial of service.
Upgrade to 0.4.16-1.
The problem has been fixed upstream in version 0.4.16.
None.
url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a
remote HTTP PAC server to trigger uncontrolled recursion via a response
composed of an infinite stream that lacks a newline character. This
leads to stack exhaustion.
A remote HTTP PAC server might be able to crash an application via a
crafted response.
https://github.com/libproxy/libproxy/issues/134
https://github.com/libproxy/libproxy/pull/136
https://github.com/libproxy/libproxy/commit/a83dae404feac517695c23ff43ce1e116e2bfbe0
https://security.archlinux.org/CVE-2020-25219
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | libproxy-webkit | < 0.4.16-1 | UNKNOWN |
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.004 Low
EPSS
Percentile
73.5%