CVE-2016-5360: Buffer Overflow
Published Jun 30, 2016
·Updated
HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have unspecified other impact via unknown vectors.
Affected Software
7 affected components
Ubuntu=16.04
HAProxy HAProxy=1.6.0
HAProxy HAProxy=1.6.1
HAProxy HAProxy=1.6.2
HAProxy HAProxy=1.6.3
HAProxy HAProxy=1.6.4
HAProxy HAProxy=1.6.5
Event History
Jun 30, 2016
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-5360?
CVE-2016-5360 is classified as a denial of service vulnerability due to uninitialized memory access leading to application crashes.
2
How do I fix CVE-2016-5360?
To fix CVE-2016-5360, upgrade HAProxy to version 1.6.6 or later.
3
What versions of HAProxy are affected by CVE-2016-5360?
HAProxy versions 1.6.0 through 1.6.5 are affected by CVE-2016-5360.
4
Can CVE-2016-5360 be exploited remotely?
Yes, CVE-2016-5360 allows remote attackers to exploit the vulnerability, resulting in denial of service.
5
What conditions lead to the vulnerability in CVE-2016-5360?
The vulnerability occurs when a deny comes from a reqdeny rule in vulnerable versions of HAProxy.