Detections
Analytics
Privoxy < 3.0.22 Multiple Vulnerabilities
high Nessus Plugin ID 81086
Language:
Synopsis
The remote web proxy is affected by multiple vulnerabilities.Description
According to its self-identified version number, the Privoxy installed on the remote host is a version prior to 3.0.22. It is, therefore, affected by multiple vulnerabilities:- A denial of service vulnerability exists due to a memory leak when client connections are rejected when the socket limit has been reached. Note that this issue only affects version 3.0.21 with IPv6 support, which is enabled by default. (CVE-2015-1030)
- Multiple unspecified use-after-free vulnerabilities exist that could lead to arbitrary code execution.
(CVE-2015-1031)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to version 3.0.22 or later.See Also
Plugin Details
Severity: High
ID: 81086
File Name: privoxy_3_0_22.nasl
Version: 1.7
Type: remote
Family: Firewalls
Published: 1/29/2015
Updated: 11/25/2019
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2015-1031
Vulnerability Information
CPE: cpe:/a:privoxy:privoxy
Required KB Items: www/Privoxy, Settings/ParanoidReport
Exploit Ease: No known exploits are available
Patch Publication Date: 11/28/2014
Vulnerability Publication Date: 11/28/2014
Reference Information
CVE: CVE-2015-1030, CVE-2015-1031