From: |
| opensuse-security@opensuse.org |
To: |
| opensuse-updates@opensuse.org |
Subject: |
| openSUSE-SU-2013:0564-1: moderate: privoxy: update to 3.0.21 to fix security issues and bugs |
Date: |
| Sun, 31 Mar 2013 03:04:21 +0200 (CEST) |
Message-ID: |
| <20130331010422.199DF3218B@maintenance.suse.de> |
Archive-link: |
| Article, Thread
|
openSUSE Security Update: privoxy: update to 3.0.21 to fix security issues and bugs
______________________________________________________________________________
Announcement ID: openSUSE-SU-2013:0564-1
Rating: moderate
References: #809123
Cross-References: CVE-2013-2503
Affected Products:
openSUSE 11.4
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
privoxy was updated to 3.0.21 stable fo fix CVE-2013-2503
(bnc#809123)
- changes in 3.0.21
* On POSIX-like platforms, network sockets with file
descriptor values above FD_SETSIZE are properly
rejected. Previously they could cause memory corruption
in configurations that allowed the limit to be reached.
* Proxy authentication headers are removed unless the new
directive enable-proxy-authentication-forwarding is
used. Forwarding the headers potentionally allows
malicious sites to trick the user into providing them
with login information. Reported by Chris John Riley.
* Compiles on OS/2 again now that unistd.h is only
included on platforms that have it.
* The show-status page shows the
FEATURE_STRPTIME_SANITY_CHECKS status.
* A couple of assert()s that could theoretically
dereference NULL pointers in debug builds have been
relocated.
* Added an LSB info block to the generic start script.
Based on a patch from Natxo Asenjo.
* The max-client-connections default has been changed to
128 which should be more than enough for most setups.
* Block rover.ebay./ar.*\&adtype= instead of
"/.*\&adtype=" which caused too man false positives.
Reported by u302320 in #360284, additional feedback from
Adam Piggott.
* Unblock '.advrider.com/' and '/.*ADVrider'. Anonymously
reported in #3603636.
* Stop blocking '/js/slider\.js'. Reported by Adam Piggott
in #3606635 and _lvm in #2791160.
* Added an iframes filter.
* The whole GPLv2 text is included in the user manual now,
so Privoxy can serve it itself and the user can read it
without having to wade through GPLv3 ads first.
* Properly numbered and underlined a couple of section
titles in the config that where previously overlooked
due to a flaw in the conversion script. Reported by Ralf
Jungblut.
* Improved the support instruction to hopefully make it
harder to unintentionally provide insufficient
information when requesting support. Previously it
wasn't obvious that the information we need in bug
reports is usually also required in support requests.
* Removed documentation about packages that haven't been
provided in years.
* Only log the test number when not running in verbose
mode The position of the test is rarely relevant and it
previously
- for full list of changes see ChangeLog file shipped
together with this package
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 11.4:
zypper in -t patch 2013-51
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 11.4 (i586 x86_64):
privoxy-3.0.21-7.1
privoxy-debuginfo-3.0.21-7.1
privoxy-debugsource-3.0.21-7.1
privoxy-doc-3.0.21-7.1
References:
http://support.novell.com/security/cve/CVE-2013-2503.html
https://bugzilla.novell.com/809123
(
Log in to post comments)