Bugzilla – Bug 1193584
VUL-0: CVE-2021-44540: Multiple issues fixed in Privoxy 3.0.33 stable
Last modified: 2022-11-02 17:54:35 UTC
CVE-2021-44540 via oss-sec mailing list https://seclists.org/oss-sec/2021/q4/148 Multiple issues fixed in Privoxy 3.0.33 stable - CVE-2021-44540: get_url_spec_param(): Free memory of compiled pattern spec before bailing. - CVE-2021-44541: process_encrypted_request_headers(): Free header memory when failing to get the request destination. - CVE-2021-44542: send_http_request(): Prevent memory leaks when handling errors - CVE-2021-44543: cgi_error_no_template(): Encode the template name to prevent XSS (cross-site scripting)
https://build.opensuse.org/request/show/939452 https://build.opensuse.org/request/show/939459
you used the wrong bugnr andreas (s/8/9/), i adjusted it in the patchinfo, so no need to resubmit
openSUSE-SU-2021:1646-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1193584 CVE References: CVE-2021-44540,CVE-2021-44541,CVE-2021-44542,CVE-2021-44543 JIRA References: Sources used: openSUSE Leap 15.2 (src): privoxy-3.0.33-lp152.3.12.1 openSUSE Backports SLE-15-SP3 (src): privoxy-3.0.33-bp153.2.3.1
Just updated to openSUSE Leap 15.4 and here is privoxy still on 3.0.32. openSUSE Leap 15.4 is missing the backport package, like in openSUSE Leap 15.3: openSUSE Backports SLE-15-SP3.
submitted
This is an autogenerated message for OBS integration: This bug (1193584) was mentioned in https://build.opensuse.org/request/show/1032292 Backports:SLE-15-SP4 / privoxy
Thank you very much.
openSUSE-SU-2022:10186-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1193584 CVE References: CVE-2021-44540,CVE-2021-44541,CVE-2021-44542,CVE-2021-44543 JIRA References: Sources used: openSUSE Backports SLE-15-SP4 (src): privoxy-3.0.33-bp154.3.3.1
Done