CVE-2019-25078: Buffer Overflow in pacparser
Summary
CVE-2019-25078: A vulnerability classified as problematic was found in pacparser up to 1.3.x. Affects pacparser across 2 version ranges.
< 1.4.0
< 853e8f45607cb07b877ffd270c63dbcdd5201ad9
Fixed in 853e8f45607cb07b877ffd270c63dbcdd5201ad9. How to fix ↓
Also tracked for
- pacparser · Debian:11
The same CVE-2019-25078 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pacparser is a Python package available on PyPI that provides a library for parsing proxy auto-config (PAC) files. It is commonly used in applications to determine proxy settings based on URL patterns. The vulnerability identified as CVE-2019-25078 affects pacparser versions up to 1.3.x. This vulnerability specifically impacts the pacparser_find_proxy function in the src/pacparser.c file. Exploiting this vulnerability requires local access to the system. Upgrading to version 1.4.0 of pacparser resolves this issue. The associated patch for this vulnerability is 853e8f45607cb07b877ffd270c63dbcdd5201ad9.
Vulnerability Detail
The vulnerability in pacparser arises from a buffer overflow that can be triggered by manipulating the 'url' argument in the pacparser_find_proxy function. This can lead to arbitrary code execution or a denial of service condition. As the vulnerability requires local access, an attacker with limited privileges on the system can exploit this issue. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 7.8, indicating a high severity level.
How To Fix
Latest published version: 1.5.3 as of 23 Oct 2026
pip install --upgrade "pacparser==1.5.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
853e8f45607cb07b877ffd270c63dbcdd5201ad9
This is the first release that contains the fix.
pip install --upgrade "pacparser==853e8f45607cb07b877ffd270c63dbcdd5201ad9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in pacparser up to version 1.3.x allows for a buffer overflow, which can be exploited by an attacker with local access to the system. Upgrading to version 1.4.0 resolves this issue. It is recommended to update pacparser to the latest version to mitigate the risk of arbitrary code execution or denial of service attacks. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for pacparser →
FAQ
pacparser is a Python library used for parsing proxy auto-config (PAC) files. It allows applications to determine proxy settings based on URL patterns.
A buffer overflow is a vulnerability that occurs when a program writes data beyond the boundaries of a buffer allocated in memory. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or crash the program.
An attacker with local access to the system can manipulate the 'url' argument in the pacparser_find_proxy function to trigger a buffer overflow. This can lead to arbitrary code execution or a denial of service condition.
The CVSS score for this vulnerability is 7.8, indicating a high severity level.
You can upgrade pacparser to version 1.4.0 by running the command 'pip install --upgrade pacparser==1.4.0'. This will install the latest version of pacparser with the necessary fixes.
References
Related vulnerabilities
Recent vulnerabilities recorded for pacparser.
