CVE-2014-6269 Integer overflow in n/a

Medium 5.0 Published 30 Sep 2014 Updated 6 Aug 2024

Remote attackers can cause a denial of service in HAProxy via integer overflows leading to buffer overflows when processing large data streams.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-6269?

CVE-2014-6269 is a medium-severity vulnerability in n/a, published on 30 Sep 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attackers to cause a denial of service (crash) via a large stream of data, which triggers a buffer overflow and an out-of-bounds read.

Weakness: CWE-189

Which versions are affected by CVE-2014-6269?

It affects 1 product.

Linux distribution packages (4)

`haproxy` Red Hat:enterprise_linux:7::server	All versions	`0:1.5.2-3.el7_0`
`haproxy-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:1.5.2-3.el7_0`
`haproxy` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.5.2-3.el7_0`
`haproxy-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.5.2-3.el7_0`

Products include Haproxy Haproxy.

How do I fix CVE-2014-6269?

Upgrade to a fixed version.

Is CVE-2014-6269 being exploited?

There is no known exploitation of CVE-2014-6269 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2014-6269, GHSA-932v-h827-3qvr, RHSA-2014:1292, SUSE-SU-2015:0660-1.