44a97dcb93
Fixes the following security issues:
- cgi_error_no_template(): Encode the template name to prevent
XSS (cross-site scripting) when Privoxy is configured to servce
the user-manual itself.
Commit 0e668e9409c. OVE-20211102-0001. CVE-2021-44543.
Reported by: Artem Ivanov
- get_url_spec_param(): Free memory of compiled pattern spec
before bailing.
Reported by Joshua Rogers (Opera) who also provided the fix.
Commit 652b4b7cb0. OVE-20211201-0003. CVE-2021-44540.
- process_encrypted_request_headers(): Free header memory when
failing to get the request destination.
Reported by Joshua Rogers (Opera) who also provided the fix.
Commit 0509c58045. OVE-20211201-0002. CVE-2021-44541.
- send_http_request(): Prevent memory leaks when handling errors
Reported by Joshua Rogers (Opera) who also provided the fix.
Commit c48d1d6d08. OVE-20211201-0001. CVE-2021-44542.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
19 lines
606 B
Makefile
19 lines
606 B
Makefile
################################################################################
|
|
#
|
|
# privoxy
|
|
#
|
|
################################################################################
|
|
|
|
PRIVOXY_VERSION = 3.0.33
|
|
PRIVOXY_SITE = http://downloads.sourceforge.net/project/ijbswa/Sources/$(PRIVOXY_VERSION)%20%28stable%29
|
|
PRIVOXY_SOURCE = privoxy-$(PRIVOXY_VERSION)-stable-src.tar.gz
|
|
# configure not shipped
|
|
PRIVOXY_AUTORECONF = YES
|
|
PRIVOXY_DEPENDENCIES = pcre zlib
|
|
PRIVOXY_LICENSE = GPL-2.0+
|
|
PRIVOXY_LICENSE_FILES = LICENSE
|
|
PRIVOXY_CPE_ID_VENDOR = privoxy
|
|
PRIVOXY_SELINUX_MODULES = privoxy
|
|
|
|
$(eval $(autotools-package))
|