mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-08 00:20:38 -09:00
283a7a15b2
Fixes the following security issues: - Parse the chunk-size with a dedicated function and reject "unreasonably" large values to prevent silent truncation by sscanf(), integer overflows and misinterpretation of the content later on. Heap buffer overflows on platforms with 32-bit pointers were alleged as well. Commit 5b3bb22b77. OVE-20260515-0002. Reported by @TristanInSec. - ssl_send_certificate_error(): Store the generated message on the heap instead of the stack to prevent an alleged segmentation fault if there are enough certificates in the chain to exceed the stack size. While at it, replace another variable-length array that was probably unproblematic with a heap-based buffer as well. Commit 4963aa4f08. OVE-20260515-0001. Reported by @TristanInSec. https://www.privoxy.org/gitweb/?p=privoxy.git;a=blob;f=ChangeLog;h=d62aa6bf0b2cb26100e4ba8e528638259502711d;hb=0c5225b6844dd1a838b80d09d715a6c4ccbda2c6 Signed-off-by: Bernd Kuhls <bernd@kuhls.net> [Peter: add vulnerability info] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
6 lines
370 B
Plaintext
6 lines
370 B
Plaintext
# From https://sourceforge.net/projects/ijbswa/files/Sources/4.2.0%20%28stable%29/
|
|
sha1 deb927b172a3b473bcf246ea848ba6ed931274bf privoxy-4.2.0-stable-src.tar.gz
|
|
# Locally computed
|
|
sha256 6f91267f81f626c416994db89ab62f4d09246eebf4754b81186e13a18ee9028f privoxy-4.2.0-stable-src.tar.gz
|
|
sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 LICENSE
|