Description
Buffer overflow in the add_port function in APSIS Pound 1.8.2 and earlier allows remote attackers to execute arbitrary code via a long Host HTTP header.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pound | 1.8.2-1.1 | — |
| Debian 13 | pound | 1.8.2-1.1 | — |
| Debian 3.1 | pound | 1.8.2-1sarge1 | DSA-934-1 |
Advisories 1
- DSA-934-1 pound - remote Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-934 vendor-advisory
- 1013824 vdb-entry
- [pound_list] 20050426 remote buffer overflow in pound 1.8.2 + question abotu Host header mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=307852
- 15963 vdb-entry
- 15202 third-party-advisory
- GLSA-200504-29 vendor-advisory
- ADV-2005-0437 vdb-entry
- 15679 third-party-advisory
- pound-addport-bo(20316) vdb-entry
- 13436 vdb-entry
- 18381 third-party-advisory
- 15142 third-party-advisory