CVE-2013-2175: canonical ubuntu_linux Improper Input Validation
Vulnerability summary
CVE-2013-2175 is a medium (CVSS 5.0) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 3.59% chance of exploitation in the next 30 days, higher than 89.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 19-08-2013PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" functions with a negative occurrence count, allows remote attackers to cause a denial of service (negative array index usage and crash) via an HTTP header with a certain number of values, related to the MAX_HDR_HISTORY variable.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
3.59%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
+0.07 pp
From 3.52% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Affected systems
Redhat3 products
- enterprise_linux_load_balancer6.0 | 6.4
- haproxy< 0:1.4.22-5.el6_4 | < 0:1.4.22-6.el6op
- haproxy-debuginfo< 0:1.4.22-5.el6_4 | < 0:1.4.22-6.el6op
Debian2 products
- haproxy< 1.4.24-1
- debian_linuxEOL6.0
Canonical1 product
- ubuntu_linuxEOL12.04 | 12.10 | 13.04
Haproxy1 product
- haproxyEOL1.4 | 1.4.0 | 1.4.1 | 1.4.2 | 1.4.3 | 1.4.4 | 1.4.5 | 1.4.6 | 1.4.7 | 1.4.8 | 1.4.9 | 1.4.10 | 1.4.11 | 1.4.12 | 1.4.13 | 1.4.14 | 1.4.15 | 1.4.16 | 1.4.17 | 1.4.18 | 1.4.19 | 1.4.20 | 1.4.21 | 1.4.22 | 1.4.23 | 1.5:dev | 1.5:dev0 | 1.5:dev1 | 1.5:dev10 | 1.5:dev11 | 1.5:dev12 | 1.5:dev13 | 1.5:dev14 | 1.5:dev15 | 1.5:dev16 | 1.5:dev17 | 1.5:dev18 | 1.5:dev2 | 1.5:dev3 | 1.5:dev4 | 1.5:dev5 | 1.5:dev6 | 1.5:dev7 | 1.5:dev8 | 1.5:dev9
4 vendors · 7 products
