CVE-2011-1499

Name	CVE-2011-1499
Description	acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-2222-1
Debian Bugs	621493

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
tinyproxy (PTS)	jessie, jessie (lts)	1.8.3-3+deb8u1	fixed
	stretch	1.8.4-3~deb9u2	fixed
	buster	1.10.0-2+deb10u1	fixed
	bullseye	1.10.0-5	fixed
	bullseye (security)	1.10.0-5+deb11u1	fixed
	bookworm (security), bookworm	1.11.1-2.1+deb12u1	fixed
	sid, trixie	1.11.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
tinyproxy	source	lenny	(not affected)
tinyproxy	source	squeeze	1.8.2-1squeeze1	DSA-2222-1
tinyproxy	source	(unstable)	1.8.2-2		621493

[lenny] - tinyproxy <not-affected> (Vulnerable code not present)