FreeBSD : privoxy -- multiple vulnerabilities (d9e1b569-c3d8-11e5-b5fe-002590263bf5)

This script is Copyright (C) 2016 Tenable Network Security, Inc.


Synopsis :

The remote FreeBSD host is missing a security-related update.

Description :

Privoxy Developers reports :

Fixed a DoS issue in case of client requests with incorrect
chunk-encoded body. When compiled with assertions enabled (the
default) they could previously cause Privoxy to abort(). Reported by
Matthew Daley. CVE-2015-1380.

Fixed multiple segmentation faults and memory leaks in the pcrs code.
This fix also increases the chances that an invalid pcrs command is
rejected as such. Previously some invalid commands would be loaded
without error. Note that Privoxy's pcrs sources (action and filter
files) are considered trustworthy input and should not be writable by
untrusted third-parties. CVE-2015-1381.

Fixed an 'invalid read' bug which could at least theoretically cause
Privoxy to crash. So far, no crashes have been observed.
CVE-2015-1382.

See also :

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=197089
http://www.privoxy.org/3.0.23/user-manual/whatsnew.html
http://www.openwall.com/lists/oss-security/2015/01/26/4
http://www.nessus.org/u?3e4040d0

Solution :

Update the affected package.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)

Family: FreeBSD Local Security Checks

Nessus Plugin ID: 88153 ()

Bugtraq ID:

CVE ID: CVE-2015-1380
CVE-2015-1381
CVE-2015-1382

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now