Summary
It was discovered that Privoxy incorrectly handled CGI requests. An attacker
could possibly use this issue to cause a denial of service or obtain sensitive
information. (CVE-2020-35502, CVE-2021-20209, CVE-2021-20210,
CVE-2021-20213, CVE-2021-20215, CVE-2021-20216, CVE-2021-20217,
CVE-2021-20272, CVE-2021-20273, CVE-2021-20275)
It was discovered that Privoxy incorrectly handled certain regular
expressions. An attacker could possibly use this issue to cause a denial of
service or obtain sensitive information. (CVE-2021-20212, CVE-2021-20276)
It was discovered that Privoxy incorrectly handled client tags. An attacker
could possibly use this issue to cause Privoxy to consume resources, resulting
in a denial of service. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2021-20211)
It was discovered that Privoxy incorrectly handled client tags. An attacker
could possibly use this issue to cause Privoxy to consume resources, resulting
in a denial of service. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 20.10. (CVE-2021-20214)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | privoxy | 3.0.24-1ubuntu0.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | privoxy | 3.0.26-5ubuntu0.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | privoxy | 3.0.28-2ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | privoxy | 3.0.21-7+deb8u1ubuntu0.1~esm1 |
Vulnerabilities 14
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leaks when a response is buffered and the buffer limit is…
-
Unscored —
A memory leak vulnerability was found in Privoxy before 3.0.29 in the show-status CGI handler when no action files are …
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leak in the show-status CGI handler when no filter files …
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leak when client tags are active can cause a system crash.
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leak if multiple filters are executed and the last one is…
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Dereference of a NULL-pointer that could result in a crash if ac…
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the client-tags CGI handler when client tags are…
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the show-status CGI handler when memory allocati…
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.31. A memory leak that occurs when decompression fails unexpectedly …
-
Unscored —
A flaw was found in Privoxy in versions before 3.0.31. An assertion failure triggered by a crafted CGI request may lead…
-
Unscored —
A flaw was found in privoxy before 3.0.32. An assertion failure could be triggered with a crafted CGI request leading t…
-
Unscored —
A flaw was found in privoxy before 3.0.32. A crash can occur via a crafted CGI request if Privoxy is toggled off.
-
Unscored —
A flaw was found in privoxy before 3.0.32. A invalid read of size two may occur in chunked_body_is_complete() leading t…
-
Unscored —
A flaw was found in privoxy before 3.0.32. Invalid memory access with an invalid pattern passed to pcre_compile() may l…
References
-
report
https://ubuntu.com/security/CVE-2020-35502
-
report
https://ubuntu.com/security/CVE-2021-20209
-
report
https://ubuntu.com/security/CVE-2021-20210
-
report
https://ubuntu.com/security/CVE-2021-20211
-
report
https://ubuntu.com/security/CVE-2021-20212
-
report
https://ubuntu.com/security/CVE-2021-20213
-
report
https://ubuntu.com/security/CVE-2021-20214
-
report
https://ubuntu.com/security/CVE-2021-20215
-
report
https://ubuntu.com/security/CVE-2021-20216
-
report
https://ubuntu.com/security/CVE-2021-20217
-
report
https://ubuntu.com/security/CVE-2021-20272
-
report
https://ubuntu.com/security/CVE-2021-20273
-
report
https://ubuntu.com/security/CVE-2021-20275
-
report
https://ubuntu.com/security/CVE-2021-20276