CVE-2013-7039

NameCVE-2013-7039
DescriptionStack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd before 0.9.32, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long URI in an authentication header.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs731933

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libmicrohttpd (PTS)stretch0.9.51-1fixed
buster0.9.62-1fixed
bullseye0.9.72-2fixed
bookworm, sid0.9.73-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libmicrohttpdsourcewheezy0.9.20-1+deb7u1
libmicrohttpdsource(unstable)0.9.32-1low731933

Notes

[squeeze] - libmicrohttpd <no-dsa> (Minor issue, only expoitable in corner cases)
https://bugzilla.redhat.com/show_bug.cgi?id=1039390

Search for package or bug name: Reporting problems