A double free vulnerability [CWE-415] in Fortinet FortiOS version 7.4.0, version 7.2.0 through 7.2.5 and before 7.0.12, FortiProxy version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 and FortiPAM version 1.1.0 through 1.1.2 and before 1.0.3 allows a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests.
The product calls free() twice on the same memory address.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Fortios | Fortinet | 6.4.0 (including) | 7.0.13 (excluding) |
| Fortios | Fortinet | 7.2.0 (including) | 7.2.6 (excluding) |
| Fortios | Fortinet | 7.4.0 (including) | 7.4.0 (including) |