Last updated 25 August 2025

libproxy is vulnerable to a buffer overflow, caused by improper bounds checking. By persuading a victim to open a specially crafted PAC file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

A format string flaw was reported [1] in libproxy's proxy commandline tool (bin/proxy). This was corrected upstream [2] and is included in the 0.4.0 release.

FORTIFYSOURCE turns this into a harmless crash:

% httpproxy=http://foo%n.example.com/ proxy http://example.com %n in writable segment detected http://foozsh: abort (core dumped) httpproxy=http://foo%n.example.com/ proxy http://example.com

NOTE: this flaw exists solely in the proxy tool, not the library.

[1] https://bugzilla.novell.com/showbug.cgi?id=791086 [2] https://code.google.com/p/libproxy/source/detail?r=475

An insufficient input validation flaw, leading to a heap-based buffer overflow was found in libproxy 0.3.x in the pxpacreload() function. libproxy allocates a memory to store downloaded proxy.pac proxy auto-configuration file content using the Content-Length size from the remote server's HTTP response header. Allocation size is content length + 1. A malicious host hosting proxy.pac, or a man in the middle attacker, could use this flaw to make libproxy allocate insufficient amount of memory and subsequently overflow a heap-based buffer.

http://code.google.com/p/libproxy/source/browse/tags/libproxy-0.3.1/src/lib/pac.c#165

165 self->cache = pxmalloc0(contentlength+1); 166 for (int recvd=0 ; recvd != contentlength ; ) 167 recvd += recv(sock, self->cache + recvd, contentlength - recvd, 0);

This issue was confirmed with libproxy 0.3.x. Earlier 0.2.x versions seems to be affected too. It does not affect 0.4.x versions, where fixed size buffer is used.

A buffer overflow flaw was discovered in the libproxy's url::getpac() used to download proxy.pac proxy auto-configuration file. A malicious host hosting proxy.pac, or a man in the middle attacker, could use this flaw to trigger a stack-based buffer overflow in an application using libproxy, if proxy configuration instructed it to download proxy.pac file from a remote HTTP server.

url::getpac() uses a fixed size buffer buffer[] to store content of the proxy.pac file downloaded from a remote server. When filling the buffer, it uses server-supplied content length value, rather than size buffer, as a limit for the size of the input copied into the buffer. Overflow occurs when server provides sufficiently large file and does not use chunked content encoding. The buffer size is checked when using chunked encoding.

http://code.google.com/p/libproxy/source/browse/trunk/libproxy/url.cpp?r=846#462

This issue was introduced upstream with the addition of the chunked encoding support, which first appears in version 0.4.

http://code.google.com/p/libproxy/source/detail?r=489 http://code.google.com/p/libproxy/issues/detail?id=77