A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled pattern spec before bailing.

The version of privoxy installed on the remote host is prior to 3.0.23-2.17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1739 advisory.

  - A flaw was found in privoxy before 3.0.32. A invalid read of size two may occur in     chunked_body_is_complete() leading to denial of service. (CVE-2021-20275)

  - A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled     pattern spec before bailing. (CVE-2021-44540)

  - A memory leak vulnerability was found in Privoxy when handling errors. (CVE-2021-44542)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5826-1 advisory.

  - A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled     pattern spec before bailing. (CVE-2021-44540)

  - An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the     template name when Privoxy is configured to servce the user-manual itself. (CVE-2021-44543)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10186-1 advisory.

  - A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled     pattern spec before bailing. (CVE-2021-44540)

  - A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing     header memory when failing to get the request destination. (CVE-2021-44541)

  - A memory leak vulnerability was found in Privoxy when handling errors. (CVE-2021-44542)

  - An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the     template name when Privoxy is configured to servce the user-manual itself. (CVE-2021-44543)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1646-1 advisory.

  - A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled     pattern spec before bailing. (CVE-2021-44540)

  - A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing     header memory when failing to get the request destination. (CVE-2021-44541)

  - A memory leak vulnerability was found in Privoxy when handling errors. (CVE-2021-44542)

  - An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the     template name when Privoxy is configured to servce the user-manual itself. (CVE-2021-44543)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 897e1962-5d5a-11ec-a3ed-040e3c3cf7e7 advisory.

  - An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the     template name when Privoxy is configured to servce the user-manual itself. (CVE-2021-44543)

  - A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled     pattern spec before bailing. (CVE-2021-44540)

  - A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing     header memory when failing to get the request destination. (CVE-2021-44541)

  - A memory leak vulnerability was found in Privoxy when handling errors. (CVE-2021-44542)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-2844 advisory.

  - An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the     template name when Privoxy is configured to servce the user-manual itself. (CVE-2021-44543)

  - A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled     pattern spec before bailing. (CVE-2021-44540)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
175092	Amazon Linux AMI : privoxy (ALAS-2023-1739)	Nessus	Amazon Linux Local Security Checks	high
170650	Ubuntu 18.04 LTS / 20.04 LTS : Privoxy vulnerabilities (USN-5826-1)	Nessus	Ubuntu Local Security Checks	medium
166900	openSUSE 15 Security Update : privoxy (openSUSE-SU-2022:10186-1)	Nessus	SuSE Local Security Checks	medium
156433	openSUSE 15 Security Update : privoxy (openSUSE-SU-2021:1646-1)	Nessus	SuSE Local Security Checks	medium
156079	FreeBSD : Privoxy -- Multiple vulnerabilities (memory leak, XSS) (897e1962-5d5a-11ec-a3ed-040e3c3cf7e7)	Nessus	FreeBSD Local Security Checks	medium
156039	Debian DLA-2844-1 : privoxy - LTS security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2021-44540

high

Tenable Plugins

high

medium

medium

medium

medium

medium