Debian Security Advisory

DSA-145-1 tinyproxy -- doubly freed memory

Date Reported:
07 Aug 2002
Affected Packages:
Security database references:
In the Bugtraq database (at SecurityFocus): BugTraq ID 4731.
In Mitre's CVE dictionary: CVE-2002-0847.
More information:

The authors of tinyproxy, a lightweight HTTP proxy, discovered a bug in the handling of some invalid proxy requests. Under some circumstances, an invalid request may result in allocated memory being freed twice. This can potentially result in the execution of arbitrary code.

This problem has been fixed in version 1.4.3-2woody2 for the current stable distribution (woody) and in version 1.4.3-3 for the unstable distribution (sid). The old stable distribution (potato) is not affected by this problem.

We recommend that you upgrade your tinyproxy package immediately.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Intel IA-32:
Intel IA-64:
HP Precision:
Motorola 680x0:
Big endian MIPS:
Little endian MIPS:
IBM S/390:
Sun Sparc:

MD5 checksums of the listed files are available in the original advisory.