CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
CVE details

CVE-2025-34451

rofl0r/proxychains-ng versions up to and including 4.17 and prior to commit cc005b7 contain a stack-based buffer overflow vulnerability in the function proxy_from_string() located in src/libproxychains.c. When parsing crafted proxy configuration entries containing overly long username or password fields, the application may write beyond the bounds of fixed-size stack buffers, leading to memory corruption or crashes. This vulnerability may allow denial of service and, under certain conditions, could be leveraged for further exploitation depending on the execution environment and applied mitigations.

Score
6.9 medium
Published
2025-12-18
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
net/proxychains-ngproxychains-ng4.17unaddressedehaupt@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>proxychains-ng</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>rofl0r/proxychains-ng versions up to and including 4.17 and prior to
	commit cc005b7 contain a stack-based buffer overflow vulnerability in
	the function proxy_from_string() located in src/libproxychains.c. When
	parsing crafted proxy configuration entries containing overly long
	username or password fields, the application may write beyond the
	bounds of fixed-size stack buffers, leading to memory corruption or
	crashes. This vulnerability may allow denial of service and, under
	certain conditions, could be leveraged for further exploitation
	depending on the execution environment and applied mitigations.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-34451</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-34451</url>
    </references>
    <dates>
      <discovery>2025-12-18</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>