{"id":1774,"date":"2025-04-26T12:33:33","date_gmt":"2025-04-26T12:33:33","guid":{"rendered":"http:\/\/localhost\/?p=1774"},"modified":"2025-04-26T12:33:33","modified_gmt":"2025-04-26T12:33:33","slug":"updated-haproxy-packages-fix-security-vulnerability","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=1774","title":{"rendered":"Updated haproxy packages fix security vulnerability"},"content":{"rendered":"
\n

Vulnerability Details<\/h2>\n
\n

Basic Information<\/h3>\n\n\n\n\n\n\n
Title<\/th>\nUpdated haproxy packages fix security vulnerability\n<\/td>\n<\/tr>\n
Type<\/th>\nmageia<\/td>\n<\/tr>\n
Published<\/th>\n2025-04-25T20:34:34<\/td>\n<\/tr>\n
Last Seen<\/th>\n2025-04-25T18:00:56<\/td>\n<\/tr>\n
CVSS Score<\/th>\n6.8 (MEDIUM)<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

CVSS v3 Details<\/h3>\n\n\n\n\n\n\n\n\n\n
Attack Vector<\/th>\nNETWORK<\/td>\n<\/tr>\n
Attack Complexity<\/th>\nHIGH<\/td>\n<\/tr>\n
Privileges Required<\/th>\nNONE<\/td>\n<\/tr>\n
User Interaction<\/th>\nNONE<\/td>\n<\/tr>\n
Scope<\/th>\nCHANGED<\/td>\n<\/tr>\n
Confidentiality Impact<\/th>\nNONE<\/td>\n<\/tr>\n
Integrity Impact<\/th>\nNONE<\/td>\n<\/tr>\n
Availability Impact<\/th>\nHIGH<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

CVE Information<\/h3>\n\n\n\n\n
CVE IDs<\/th>\nCVE-2025-32464<\/td>\n<\/tr>\n
CWE<\/th>\n<\/td>\n<\/tr>\n
Bulletin Family<\/th>\nunix<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

Description<\/h3>\n
\n BUG\/MEDIUM: sample: fix risk of overflow when replacing multiple regex back-refsAleandro Prudenzano of Doyensec and Edoardo Geraci of Codean Labs reported a bug in sample_conv_regsub(), which can cause replacements of multiple back-references to overflow the temporary trash buffer. The problem happens when doing “regsub(match,replacement,g)”: we’re replacing every occurrence of “match” with “replacement” in the input sample, which requires a length check. For this, a max is applied, so that a replacement may not use more than the remaining length in the buffer. However, the length check is made on the replaced pattern and not on the temporary buffer used to carry the new string. This results in the remaining size to be usable for each input match, which can go beyond the temporary buffer size if more than one occurrence has to be replaced with something that’s larger than the remaining room. <\/p><\/div>\n<\/p><\/div>\n
\n

Impact Assessment<\/h3>\n\n\n\n
Base Score<\/th>\n6.8<\/td>\n<\/tr>\n
Severity<\/th>\nMEDIUM<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

View full CVE details<\/a><\/p>\n<\/p><\/div>\n<\/div>\n