SB2015012001 - Memory leak in www.privoxy privoxy

Description

This security bulletin contains information about 1 vulnerability.

1) Memory leak (CVE-ID: CVE-2015-1030)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the rfc2553_connect_to function in jbsocket.c in Privoxy before 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests that are rejected because the socket limit is reached. A remote attacker can perform a denial of service attack.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• http://secunia.com/advisories/62123
• http://www.openwall.com/lists/oss-security/2015/01/11/1
• http://www.privoxy.org/announce.txt