[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: Re: [oss-security] CVE request for Privoxy
From: cve-assign () mitre ! org
Date: 2015-01-27 18:27:41
Message-ID: Pine.LNX.4.64.1501271326040.11165 () beijing ! mitre ! org
[Download RAW message or body]
> Privoxy 3.0.23 contains fixes for the following security issues:
>
> - Fixed a DoS issue in case of client requests with incorrect
> chunk-encoded body. When compiled with assertions enabled
> (the default) they could previously cause Privoxy to abort().
> Reported by Matthew Daley.
> http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/jcc.c?r1=1.433&r2=1.434
Use CVE-2015-1380.
> - Fixed multiple segmentation faults and memory leaks in the
> pcrs code. This fix also increases the chances that an invalid
> pcrs command is rejected as such. Previously some invalid commands
> would be loaded without error. Note that Privoxy's pcrs sources
> (action and filter files) are considered trustworthy input and
> should not be writable by untrusted third-parties.
> http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/pcrs.c?r1=1.46&r2=1.47
Use CVE-2015-1381.
> - Fixed an 'invalid read' bug which could at least theoretically
> cause Privoxy to crash.
> http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/parsers.c?r1=1.297&r2=1.298
Use CVE-2015-1382.
> Please assign CVEs for them.
>
> The second issue could potentially affect other programs that use pcrs.c,
> but I'm not aware of any that do. Privoxy imported the file from the upstream
> project pcrs (not to be confused with pcre) which is no longer maintained.
>
> The last two issues were partially discovered with afl-fuzz.
>
> Fabian
---
CVE assignment team, MITRE CVE Numbering Authority M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic