Detections
Analytics
FreeBSD : privoxy -- multiple vulnerabilities (d9e1b569-c3d8-11e5-b5fe-002590263bf5)
medium Nessus Plugin ID 88153
Language:
Synopsis
The remote FreeBSD host is missing a security-related update.Description
Privoxy Developers reports :Fixed a DoS issue in case of client requests with incorrect chunk-encoded body. When compiled with assertions enabled (the default) they could previously cause Privoxy to abort(). Reported by Matthew Daley. CVE-2015-1380.
Fixed multiple segmentation faults and memory leaks in the pcrs code.
This fix also increases the chances that an invalid pcrs command is rejected as such. Previously some invalid commands would be loaded without error. Note that Privoxy's pcrs sources (action and filter files) are considered trustworthy input and should not be writable by untrusted third-parties. CVE-2015-1381.
Fixed an 'invalid read' bug which could at least theoretically cause Privoxy to crash. So far, no crashes have been observed.
CVE-2015-1382.
Solution
Update the affected package.See Also
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=197089
http://www.privoxy.org/3.0.23/user-manual/whatsnew.html
Plugin Details
Severity: Medium
ID: 88153
File Name: freebsd_pkg_d9e1b569c3d811e5b5fe002590263bf5.nasl
Version: 2.4
Type: local
Family: FreeBSD Local Security Checks
Published: 1/26/2016
Updated: 1/4/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:privoxy, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Patch Publication Date: 1/26/2016
Vulnerability Publication Date: 1/26/2015