OPENSUSE-SU-2021:0006-1
Vulnerability from csaf_opensuse - Published: 2021-01-01 17:21 - Updated: 2021-01-01 17:21Summary
Security update for privoxy
Notes
Title of the patch
Security update for privoxy
Description of the patch
This update for privoxy fixes the following issues:
privoxy was updated to 3.0.29:
* Fixed memory leaks when a response is buffered and the buffer
limit is reached or Privoxy is running out of memory.
OVE-20201118-0001
* Fixed a memory leak in the show-status CGI handler when
no action files are configured
OVE-20201118-0002
* Fixed a memory leak in the show-status CGI handler when
no filter files are configured
OVE-20201118-0003
* Fixes a memory leak when client tags are active
OVE-20201118-0004
* Fixed a memory leak if multiple filters are executed
and the last one is skipped due to a pcre error
OVE-20201118-0005
* Prevent an unlikely dereference of a NULL-pointer that
could result in a crash if accept-intercepted-requests
was enabled, Privoxy failed to get the request destination
from the Host header and a memory allocation failed.
OVE-20201118-0006
* Fixed memory leaks in the client-tags CGI handler when
client tags are configured and memory allocations fail.
OVE-20201118-0007
* Fixed memory leaks in the show-status CGI handler when memory
allocations fail
OVE-20201118-0008
* Add experimental https inspection support
* Use JIT compilation for static filtering for speedup
* Add support for Brotli decompression, add
'no-brotli-accepted' filter which prevents the use of
Brotli compression
* Add feature to gather exended statistics
* Use IP_FREEBIND socket option to help with failover
* Allow to use extended host patterns and vanilla host patterns
at the same time by prefixing extended host patterns with
'PCRE-HOST-PATTERN:'
* Added 'Cross-origin resource sharing' (CORS) support
* Add SOCKS5 username/password support
* Bump the maximum number of action and filter files
to 100 each
* Fixed handling of filters with 'split-large-forms 1'
when using the CGI editor.
* Better detect a mismatch of connection details when
figuring out whether or not a connection can be reused
* Don't send a 'Connection failure' message instead of the
'DNS failure' message
* Let LOG_LEVEL_REQUEST log all requests
* Improvements to default Action file
License changed to GPLv3.
- remove packaging vulnerability boo#1157449
Patchnames
openSUSE-2021-6
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for privoxy",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for privoxy fixes the following issues:\n\nprivoxy was updated to 3.0.29:\n\n* Fixed memory leaks when a response is buffered and the buffer\n limit is reached or Privoxy is running out of memory.\n OVE-20201118-0001\n* Fixed a memory leak in the show-status CGI handler when\n no action files are configured\n OVE-20201118-0002\n* Fixed a memory leak in the show-status CGI handler when\n no filter files are configured\n OVE-20201118-0003\n* Fixes a memory leak when client tags are active\n OVE-20201118-0004\n* Fixed a memory leak if multiple filters are executed\n and the last one is skipped due to a pcre error\n OVE-20201118-0005\n* Prevent an unlikely dereference of a NULL-pointer that\n could result in a crash if accept-intercepted-requests\n was enabled, Privoxy failed to get the request destination\n from the Host header and a memory allocation failed.\n OVE-20201118-0006\n* Fixed memory leaks in the client-tags CGI handler when\n client tags are configured and memory allocations fail.\n OVE-20201118-0007\n* Fixed memory leaks in the show-status CGI handler when memory\n allocations fail\n OVE-20201118-0008\n* Add experimental https inspection support\n* Use JIT compilation for static filtering for speedup\n* Add support for Brotli decompression, add\n \u0027no-brotli-accepted\u0027 filter which prevents the use of \n Brotli compression\n* Add feature to gather exended statistics\n* Use IP_FREEBIND socket option to help with failover\n* Allow to use extended host patterns and vanilla host patterns\n at the same time by prefixing extended host patterns with\n \u0027PCRE-HOST-PATTERN:\u0027\n* Added \u0027Cross-origin resource sharing\u0027 (CORS) support\n* Add SOCKS5 username/password support\n* Bump the maximum number of action and filter files\n to 100 each\n* Fixed handling of filters with \u0027split-large-forms 1\u0027\n when using the CGI editor.\n* Better detect a mismatch of connection details when\n figuring out whether or not a connection can be reused\n* Don\u0027t send a \u0027Connection failure\u0027 message instead of the\n \u0027DNS failure\u0027 message\n* Let LOG_LEVEL_REQUEST log all requests\n* Improvements to default Action file\n\nLicense changed to GPLv3.\n\n- remove packaging vulnerability boo#1157449\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2021-6",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0006-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2021:0006-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JFSIXZ2RYSIQJKMIUICOI4Y4Q5L52U6T/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2021:0006-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JFSIXZ2RYSIQJKMIUICOI4Y4Q5L52U6T/"
},
{
"category": "self",
"summary": "SUSE Bug 1157449",
"url": "https://bugzilla.suse.com/1157449"
}
],
"title": "Security update for privoxy",
"tracking": {
"current_release_date": "2021-01-01T17:21:33Z",
"generator": {
"date": "2021-01-01T17:21:33Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2021:0006-1",
"initial_release_date": "2021-01-01T17:21:33Z",
"revision_history": [
{
"date": "2021-01-01T17:21:33Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "privoxy-doc-3.0.29-lp152.3.3.1.noarch",
"product": {
"name": "privoxy-doc-3.0.29-lp152.3.3.1.noarch",
"product_id": "privoxy-doc-3.0.29-lp152.3.3.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "privoxy-3.0.29-lp152.3.3.1.x86_64",
"product": {
"name": "privoxy-3.0.29-lp152.3.3.1.x86_64",
"product_id": "privoxy-3.0.29-lp152.3.3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.1",
"product": {
"name": "openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.1"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.2",
"product": {
"name": "openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "privoxy-3.0.29-lp152.3.3.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:privoxy-3.0.29-lp152.3.3.1.x86_64"
},
"product_reference": "privoxy-3.0.29-lp152.3.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "privoxy-doc-3.0.29-lp152.3.3.1.noarch as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:privoxy-doc-3.0.29-lp152.3.3.1.noarch"
},
"product_reference": "privoxy-doc-3.0.29-lp152.3.3.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "privoxy-3.0.29-lp152.3.3.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:privoxy-3.0.29-lp152.3.3.1.x86_64"
},
"product_reference": "privoxy-3.0.29-lp152.3.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "privoxy-doc-3.0.29-lp152.3.3.1.noarch as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:privoxy-doc-3.0.29-lp152.3.3.1.noarch"
},
"product_reference": "privoxy-doc-3.0.29-lp152.3.3.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.2"
}
]
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…