libproxy is vulnerable to a buffer overflow, caused by improper bounds checking. By persuading a victim to open a specially crafted PAC file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

A format string flaw was reported [1] in libproxy's proxy commandline tool (bin/proxy). This was corrected upstream [2] and is included in the 0.4.0 release.

FORTIFYSOURCE turns this into a harmless crash:

% httpproxy=http://foo%n.example.com/ proxy http://example.com %n in writable segment detected http://foozsh: abort (core dumped) httpproxy=http://foo%n.example.com/ proxy http://example.com

NOTE: this flaw exists solely in the proxy tool, not the library.

[1] https://bugzilla.novell.com/showbug.cgi?id=791086 [2] https://code.google.com/p/libproxy/source/detail?r=475