Mageia alert MGASA-2016-0055 (privoxy)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2016-0055: Updated privoxy packages fix security vulnerabilities 
Date:
    	     
 
Tue, 9 Feb 2016 14:05:51 +0100
Message-ID:
    	     
 
<20160209130551.B28D69F6FB@duvel.mageia.org>
MGASA-2016-0055 - Updated privoxy packages fix security vulnerabilities

Publication date: 09 Feb 2016
URL: http://advisories.mageia.org/MGASA-2016-0055.html
Type: security
Affected Mageia releases: 5
CVE: CVE-2016-1982,
     CVE-2016-1983

Description:
This update fixes two denial-of-service vulnerabilities that have been 
discovered in privoxy 3.0.23:

The remove_chunked_transfer_coding function in filters.c in Privoxy before 
3.0.24 allows remote attackers to cause a denial of service (invalid read and 
crash) via crafted chunk-encoded content. (CVE-2016-1982)

The client_host function in parsers.c in Privoxy before 3.0.24 allows remote 
attackers to cause a denial of service (invalid read and crash) via an empty 
HTTP Host header. (CVE-2016-1983)

References:
- https://bugs.mageia.org/show_bug.cgi?id=17566
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1982
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1983

SRPMS:
- 5/core/privoxy-3.0.23-1.1.mga5