CVE-2016-1983

CVE-2016-1983 affects Privoxy; the vulnerability lies in the client_host function in parsers.c, where receiving an empty HTTP Host header can trigger a denial-of-service via an invalid read and crash. Affected versions are Privoxy prior to 3.0.24. Public advisories and updates (e.g., Debian DSA-3...

CVE-2016-1983

The clienthost function in parsers.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service invalid read and crash via an empty HTTP Host header...

FreeBSD : privoxy -- multiple vulnerabilities (89d4ed09-c3d7-11e5-b5fe-002590263bf5)

Privoxy Developers reports : Fixed a memory leak when rejecting client connections due to the socket limit being reached CID 66382. This affected Privoxy 3.0.21 when compiled with IPv6 support on most platforms this is the default. Fixed an immediate-use-after-free bug CID 66394 and two additiona...

FreeBSD : privoxy -- multiple vulnerabilities (a763a0e7-c3d9-11e5-b5fe-002590263bf5)

Privoxy Developers reports : Prevent invalid reads in case of corrupt chunk-encoded content. CVE-2016-1982. Bug discovered with afl-fuzz and AddressSanitizer. Remove empty Host headers in client requests. Previously they would result in invalid reads. CVE-2016-1983. Bug discovered with afl-fuzz a...

FreeBSD : privoxy -- multiple vulnerabilities (d9e1b569-c3d8-11e5-b5fe-002590263bf5)

Privoxy Developers reports : Fixed a DoS issue in case of client requests with incorrect chunk-encoded body. When compiled with assertions enabled the default they could previously cause Privoxy to abort. Reported by Matthew Daley. CVE-2015-1380. Fixed multiple segmentation faults and memory leak...

FreeBSD : privoxy -- malicious server spoofing as proxy vulnerability (ad82b0e9-c3d6-11e5-b5fe-002590263bf5)

Privoxy Developers reports : Proxy authentication headers are removed unless the new directive enable-proxy-authentication-forwarding is used. Forwarding the headers potentially allows malicious sites to trick the user into providing them with login information. Reported by Chris John Riley...

privoxy: denial of service

CVE-2016-1982 denial of service A vulnerability was discovered in a way the privoxy deals with corrupted chunk-encoded content. A maliciously crafted input can result in a remote denial of service. - CVE-2016-1983 denial of service A vulnerability was found in a way the privoxy processes specific...

Debian DLA-398-1 : privoxy security update

CVE-2016-1982 Prevent invalid reads in case of corrupt chunk-encoded content CVE-2016-1983 Remove empty Host headers in client requests; resulting in invalid reads. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has...

[SECURITY] [DLA 398-1] privoxy security update

Package : privoxy Version : 3.0.16-1+deb6u1 CVE ID : CVE-2016-1982 CVE-2016-1983 CVE-2016-1982 Prevent invalid reads in case of corrupt chunk-encoded content CVE-2016-1983 Remove empty Host headers in client requests; resulting in invalid reads...

DLA-398-1 privoxy - security update

Bulletin has no description...

privoxy -- multiple vulnerabilities

Privoxy Developers reports: Prevent invalid reads in case of corrupt chunk-encoded content. CVE-2016-1982. Bug discovered with afl-fuzz and AddressSanitizer. Remove empty Host headers in client requests. Previously they would result in invalid reads. CVE-2016-1983. Bug discovered with afl-fuzz an...

[SECURITY] Fedora 22 Update: tor-0.2.5.12-1.fc22

Tor is a connection-based low-latency anonymous communication system. Applications connect to the local Tor proxy using the SOCKS protocol. The local proxy chooses a path through a set of relays, in which each relay knows its predecessor and successor, but no others. Traffic flowing down the...

[SECURITY] Fedora 20 Update: tor-0.2.5.12-1.fc20

Tor is a connection-based low-latency anonymous communication system. Applications connect to the local Tor proxy using the SOCKS protocol. The local proxy chooses a path through a set of relays, in which each relay knows its predecessor and successor, but no others. Traffic flowing down the...

[SECURITY] Fedora 20 Update: tor-0.2.5.11-1.fc20

Tor is a connection-based low-latency anonymous communication system. Applications connect to the local Tor proxy using the SOCKS protocol. The local proxy chooses a path through a set of relays, in which each relay knows its predecessor and successor, but no others. Traffic flowing down the...

[SECURITY] Fedora 21 Update: tor-0.2.5.11-1.fc21

Tor is a connection-based low-latency anonymous communication system. Applications connect to the local Tor proxy using the SOCKS protocol. The local proxy chooses a path through a set of relays, in which each relay knows its predecessor and successor, but no others. Traffic flowing down the...

Debian DLA-142-1 : privoxy security update

Several vulnerabilities have been fixed in privoxy, a privacy enhancing HTTP proxy : CVE-2015-1031, CID66394 : unmap: Prevent use-after-free if the map only consists of one item. CVE-2015-1031, CID66376 and CID66391 : pcrsexecute: Consistently set result to NULL in case of errors. Should make...

Privoxy < 3.0.23 Multiple DoS Vulnerabilities

According to its self-reported version number, the version of Privoxy running on the remote host is prior to 3.0.23. It is, therefore, potentially affected by multiple denial of service vulnerabilities : - A flaw exists in the chunkedbodyiscomplete function in 'jcc.c' due to improper processing o...

CVE-2015-1031

Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to 1 the unmap function in list.c or 2 "two additional unconfirmed use-after-free complaints made by Coverity scan." NOTE: some of these details are obtained from...

DEBIAN-CVE-2015-1031

Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to 1 the unmap function in list.c or 2 "two additional unconfirmed use-after-free complaints made by Coverity scan." NOTE: some of these details are obtained from...

CVE-2015-1031

Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to 1 the unmap function in list.c or 2 "two additional unconfirmed use-after-free complaints made by Coverity scan." NOTE: some of these details are obtained from...