What is CVE-2015-1380?

CVE-2015-1380 is a medium-severity software vulnerability (Improper input validation) with a CVSS score of 5. jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body.

Is CVE-2015-1380 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 3%.

What products does CVE-2015-1380 affect?

Tracked products affected include Solaris. Check the version you run to see whether it is affected.

How do I fix CVE-2015-1380?

Apply the vendor fix in your normal patch cycle. Upgrade affected products to a fixed version.

← All products

CVE-2015-1380

MEDIUM severity · CVSS 5 · Improper input validation

5CVSS MEDIUM

Summary

jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges required—

User interaction—

Confidentiality impactNone

Integrity impactNone

Availability impact—

Exploit probability (EPSS)3%

AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products we track (1)

Solaris

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.197&view=markupAdvisory
http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/currentjcc.c/?r1=1.433&r2=1.434
http://lists.opensuse.org/opensuse-updates/2015-02/msg00031.htmlAdvisory
http://secunia.com/advisories/62899Advisory
http://www.openwall.com/lists/oss-security/2015/01/26/4Advisory
http://www.openwall.com/lists/oss-security/2015/01/27/20Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlAdvisory
http://www.securityfocus.com/bid/72355