Advisory ROSA-SA-2021-1885

Software: libproxy 0.4.11
OS: Cobalt 7.9

CVE-ID: CVE-2020-25219
CVE-Crit: HIGH
CVE-DESC: url :: recvline in url.cpp in libproxy 0.4.x to 0.4.15 allows a remote HTTP server to run uncontrolled recursion through a response consisting of an infinite stream with no newline character. This results in stack exhaustion.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2020-26154
CVE-Crit: CRITICAL
CVE-DESC: url.cpp in libproxy before version 0.4.15 is prone to buffer overflow when PAC is enabled, as demonstrated by a large PAC file being delivered without a Content-length header.
CVE-STATUS: default
CVE-REV: default