CVE-2013-7039

NameCVE-2013-7039
DescriptionStack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd before 0.9.32, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long URI in an authentication header.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs731933

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libmicrohttpd (PTS)bullseye0.9.72-2+deb11u1fixed
bookworm0.9.75-6fixed
sid, trixie1.0.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libmicrohttpdsourcewheezy0.9.20-1+deb7u1
libmicrohttpdsource(unstable)0.9.32-1low731933

Notes

[squeeze] - libmicrohttpd <no-dsa> (Minor issue, only expoitable in corner cases)
https://bugzilla.redhat.com/show_bug.cgi?id=1039390

Search for package or bug name: Reporting problems