Bug 1203246 (CVE-2015-1381)

Summary:	CVE-2015-1381 privoxy: denial of service (segmentation faults, memory leaks) issues in pcrs.c
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	gwync, jrusnack, karsten
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Privoxy 3.0.23	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-03-19 10:15:29 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1169216

Description Vasyl Kaigorodov 2015-03-18 13:05:33 UTC

Privoxy 3.0.23 fixes following security issue:

- Fixed multiple segmentation faults and memory leaks in the
  pcrs code. This fix also increases the chances that an invalid
  pcrs command is rejected as such. Previously some invalid commands
  would be loaded without error. Note that Privoxy's pcrs sources
  (action and filter files) are considered trustworthy input and
  should not be writable by untrusted third-parties.
  http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/pcrs.c?r1=1.46&r2=1.47

Original report: http://seclists.org/oss-sec/2015/q1/259