Stack-based buffer overflows in Proxyd


Multiple stack-based buffer overflow vulnerabilities [CWE-121] in FortiWeb's proxy daemon may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests.

Affected Products

FortiWeb versions 5.x all versions,
FortiWeb versions 6.0.7 and below,
FortiWeb versions 6.1.2 and below,
FortiWeb versions 6.2.6 and below,
FortiWeb versions 6.3.16 and below,
FortiWeb versions 6.4 all versions.


Upgrade to FortiWeb 7.0.0 or above,
Upgrade to FortiWeb 6.3.17 or above,
Upgrade to FortiWeb 6.2.7 or above.
Upgrade to FortiWeb 6.1.3 or above.
Upgrade to FortiWeb 6.0.8 or above.


Internally discovered and reported by Giuseppe Cocomazzi of Fortinet Product Security team.