Publishing details

• Published on 2021-03-22
• Copied from ubuntu xenial in PPA for Ubuntu Security Proposed by Eduardo Barretto

Changelog

privoxy (3.0.24-1ubuntu0.1) xenial-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow
    - debian/patches/38_CVE-2021-20217.patch: Prevent an assertion by a
      crafted CGI request.
    - CVE-2021-20217
  * SECURITY UPDATE: Memory leak
    - debian/patches/40_CVE-2021-20216.patch: Fix a memory leak.
    - debian/patches/41_CVE-2020-35502.patch: Fixed memory leaks when a
      response is buffered and the buffer limit is reached or Privoxy is
      running out of memory.
    - debian/patches/42_CVE-2021-20209.patch: Fixed a memory leak in the
      show-status CGI handler when no action files are configured.
    - debian/patches/43_CVE-2021-20210.patch: Fixed a memory leak in the show-status
      CGI handler when no filter files are configured.
    - debian/patches/45_CVE-2021-20212.patch: Fixed a memory leak if multiple
      filters are executed and the last one is skipped due to a pcre error.
    - debian/patches/48_CVE-2021-20215.patch: Fixed memory leaks in the show-status
      CGI handler when memory allocations fail.
    - CVE-2021-20216
    - CVE-2020-35502
    - CVE-2021-20209
    - CVE-2021-20210
    - CVE-2021-20212
    - CVE-2021-20215
  * SECURITY UPDATE: Denial of Service
    - debian/patches/46_CVE-2021-20213.patch: Prevent an unlikely dereference of a
      NULL-pointer that could result in a crash if accept-intercepted-requests
      was enabled.
    - debian/patches/49_CVE-2021-20272.patch: Remove an assertion that could be
      triggered with a crafted CGI request.
    - debian/patches/50_CVE-2021-20273.patch: Overrule invalid image types.
      Prevents a crash with a crafted CGI request if Privoxy is toggled off.
    - debian/patches/51_CVE-2021-20275.patch: Prevent invalid read of size two.
    - debian/patches/52_CVE-2021-20276.patch: Obsolete pcre: Prevent invalid memory
      accesses.
    - CVE-2021-20213
    - CVE-2021-20272
    - CVE-2021-20273
    - CVE-2021-20275
    - CVE-2021-20276
  * Fix detection of insufficient data: debian/patches/39_decompress_iob.patch

 -- Eduardo Barretto <email address hidden>  Wed, 17 Mar 2021 17:28:00 +0100

Builds

• amd64
• arm64
• armhf
• i386
• powerpc
• ppc64el
• s390x

Built packages

• privoxy Privacy enhancing HTTP Proxy

• privoxy-dbgsym debug symbols for package privoxy

Package files

• privoxy-dbgsym_3.0.24-1ubuntu0.1_amd64.ddeb (202.2 KiB)
• privoxy-dbgsym_3.0.24-1ubuntu0.1_arm64.ddeb (201.2 KiB)
• privoxy-dbgsym_3.0.24-1ubuntu0.1_armhf.ddeb (190.6 KiB)
• privoxy-dbgsym_3.0.24-1ubuntu0.1_i386.ddeb (169.6 KiB)
• privoxy-dbgsym_3.0.24-1ubuntu0.1_powerpc.ddeb (189.2 KiB)
• privoxy-dbgsym_3.0.24-1ubuntu0.1_ppc64el.ddeb (220.2 KiB)
• privoxy-dbgsym_3.0.24-1ubuntu0.1_s390x.ddeb (184.5 KiB)
• privoxy_3.0.24-1ubuntu0.1.debian.tar.xz (25.2 KiB)
• privoxy_3.0.24-1ubuntu0.1.dsc (1.9 KiB)
• privoxy_3.0.24-1ubuntu0.1_amd64.deb (447.3 KiB)
• privoxy_3.0.24-1ubuntu0.1_arm64.deb (429.6 KiB)
• privoxy_3.0.24-1ubuntu0.1_armhf.deb (438.2 KiB)
• privoxy_3.0.24-1ubuntu0.1_i386.deb (458.4 KiB)
• privoxy_3.0.24-1ubuntu0.1_powerpc.deb (433.4 KiB)
• privoxy_3.0.24-1ubuntu0.1_ppc64el.deb (441.6 KiB)
• privoxy_3.0.24-1ubuntu0.1_s390x.deb (439.3 KiB)
• privoxy_3.0.24.orig.tar.gz (1.6 MiB)