Blue Coat Systems WinProxy 6.1a and 6.0 r1c and possibly earlier allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long HTTP CONNECT request which triggers heap corruption.