A memory leak vulnerability was found in Privoxy when handling errors.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled
    pattern spec before bailing. (CVE-2021-44540)

  - A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing
    header memory when failing to get the request destination. (CVE-2021-44541)

  - A memory leak vulnerability was found in Privoxy when handling errors. (CVE-2021-44542)

  - An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the
    template name when Privoxy is configured to servce the user-manual itself. (CVE-2021-44543)

The version of privoxy installed on the remote host is prior to 3.0.23-2.17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1739 advisory.

    A flaw was found in privoxy before 3.0.32. A invalid read of size two may occur in     chunked_body_is_complete() leading to denial of service. (CVE-2021-20275)

    A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled     pattern spec before bailing. (CVE-2021-44540)

    A memory leak vulnerability was found in Privoxy when handling errors. (CVE-2021-44542)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10186-1 advisory.

  - A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled     pattern spec before bailing. (CVE-2021-44540)

  - A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing     header memory when failing to get the request destination. (CVE-2021-44541)

  - A memory leak vulnerability was found in Privoxy when handling errors. (CVE-2021-44542)

  - An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the     template name when Privoxy is configured to servce the user-manual itself. (CVE-2021-44543)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1646-1 advisory.

  - A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled     pattern spec before bailing. (CVE-2021-44540)

  - A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing     header memory when failing to get the request destination. (CVE-2021-44541)

  - A memory leak vulnerability was found in Privoxy when handling errors. (CVE-2021-44542)

  - An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the     template name when Privoxy is configured to servce the user-manual itself. (CVE-2021-44543)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 897e1962-5d5a-11ec-a3ed-040e3c3cf7e7 advisory.

  - An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the     template name when Privoxy is configured to servce the user-manual itself. (CVE-2021-44543)

  - A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled     pattern spec before bailing. (CVE-2021-44540)

  - A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing     header memory when failing to get the request destination. (CVE-2021-44541)

  - A memory leak vulnerability was found in Privoxy when handling errors. (CVE-2021-44542)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
424368	Alpine: multiple privoxy packages: security update to 3.0.33-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
424368	Alpine: multiple privoxy packages: security update to 3.0.33-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
175092	Amazon Linux AMI : privoxy (ALAS-2023-1739)	Nessus	Amazon Linux Local Security Checks	high
166900	openSUSE 15 Security Update : privoxy (openSUSE-SU-2022:10186-1)	Nessus	SuSE Local Security Checks	medium
156433	openSUSE 15 Security Update : privoxy (openSUSE-SU-2021:1646-1)	Nessus	SuSE Local Security Checks	medium
156079	FreeBSD : Privoxy -- Multiple vulnerabilities (memory leak, XSS) (897e1962-5d5a-11ec-a3ed-040e3c3cf7e7)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2021-44542

high

Tenable Plugins

medium

medium

high

medium

medium

medium