Bugzilla – Bug 963152
VUL-1: CVE-2016-1983: privoxy: invalid read via empty host header in client request
Last modified: 2016-02-02 09:11:47 UTC
A couple of invalid reads were fixed in Privoxy 3.0.24 whose release is scheduled for this weekend. "remote DoS when built with ASAN" - Remove empty Host headers in client requests. Previously they would result in invalid reads. http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/parsers.c?r1=1.302&r2=1.303 Affects: server:proxy/privoxy openSUSE:13.2:Update/privoxy openSUSE:Leap:42.1:Update/privoxy References: https://bugzilla.redhat.com/show_bug.cgi?id=1300972 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1983 http://seclists.org/oss-sec/2016/q1/179
bugbot adjusting priority
This is an autogenerated message for OBS integration: This bug (963152) was mentioned in https://build.opensuse.org/request/show/355512 13.2+42.1 / privoxy https://build.opensuse.org/request/show/355513 13.1 / privoxy
release
openSUSE-SU-2016:0305-1: An update that fixes two vulnerabilities is now available. Category: security (low) Bug References: 963151,963152 CVE References: CVE-2016-1982,CVE-2016-1983 Sources used: openSUSE Leap 42.1 (src): privoxy-3.0.24-6.1 openSUSE 13.2 (src): privoxy-3.0.24-8.11.1
openSUSE-SU-2016:0311-1: An update that fixes two vulnerabilities is now available. Category: security (low) Bug References: 963151,963152 CVE References: CVE-2016-1982,CVE-2016-1983 Sources used: openSUSE 13.1 (src): privoxy-3.0.24-2.23.1