CVE-2015-3281
Published: 6 July 2015
The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.
Notes
| Author | Note |
|---|---|
| mdeslaur | 1.5.x+ only |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
haproxy Launchpad, Ubuntu, Debian |
precise |
Not vulnerable
(1.4.18-0ubuntu1.2)
|
| trusty |
Does not exist
(trusty was not-affected [1.4.24-2])
|
|
| upstream |
Released
(1.5.14-1)
|
|
| utopic |
Released
(1.5.4-1ubuntu2.1)
|
|
| vivid |
Released
(1.5.10-1ubuntu0.1)
|
|
|
Patches: upstream: http://git.haproxy.org/?p=haproxy-1.5.git;a=commit;h=7ec765568883b2d4e5a2796adbeb492a22ec9bd4 |
||