mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-01 21:23:51 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/privoxy: security bump version to 4.2.0

Browse Source 
Fixes the following security issues:

- Parse the chunk-size with a dedicated function and reject "unreasonably"
  large values to prevent silent truncation by sscanf(), integer overflows
  and misinterpretation of the content later on. Heap buffer overflows on
  platforms with 32-bit pointers were alleged as well.
  Commit 5b3bb22b77. OVE-20260515-0002. Reported by @TristanInSec.

- ssl_send_certificate_error(): Store the generated message on the heap
  instead of the stack to prevent an alleged segmentation fault if there
  are enough certificates in the chain to exceed the stack size.
  While at it, replace another variable-length array that was probably
  unproblematic with a heap-based buffer as well.
  Commit 4963aa4f08. OVE-20260515-0001. Reported by @TristanInSec.

https://www.privoxy.org/gitweb/?p=privoxy.git;a=blob;f=ChangeLog;h=d62aa6bf0b2cb26100e4ba8e528638259502711d;hb=0c5225b6844dd1a838b80d09d715a6c4ccbda2c6

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Peter: add vulnerability info]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Bernd Kuhls
2026-06-02 23:49:08 +02:00
committed by Peter Korsgaard
parent 7f0749ce73
commit 283a7a15b2
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
package/privoxy/privoxy.hash
View File

@@ -1,5 +1,5 @@
# From https://sourceforge.net/projects/ijbswa/files/Sources/4.1.0%20%28stable%29/
sha1 6afc12dc38781a37670c7e4bb69700900123084f privoxy-4.1.0-stable-src.tar.gz
# From https://sourceforge.net/projects/ijbswa/files/Sources/4.2.0%20%28stable%29/
sha1 deb927b172a3b473bcf246ea848ba6ed931274bf privoxy-4.2.0-stable-src.tar.gz
# Locally computed
sha256 23e4686e5848c74cb680c09c2811f0357739ecfe641f9c4072ee42399092c97b privoxy-4.1.0-stable-src.tar.gz
sha256 6f91267f81f626c416994db89ab62f4d09246eebf4754b81186e13a18ee9028f privoxy-4.2.0-stable-src.tar.gz
sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 LICENSE

2
package/privoxy/privoxy.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
PRIVOXY_VERSION = 4.1.0
PRIVOXY_VERSION = 4.2.0
PRIVOXY_SITE = https://downloads.sourceforge.net/project/ijbswa/Sources/$(PRIVOXY_VERSION)%20%28stable%29
PRIVOXY_SOURCE = privoxy-$(PRIVOXY_VERSION)-stable-src.tar.gz
# configure not shipped