Out-of-bounds read in privoxy - CVE-2021-20275
Published: February 28, 2021 / Updated: March 6, 2021
Vulnerability identifier: #VU50976
CSH Severity: Medium
CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-20275
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the chunked_body_is_complete() function. A remote attacker can send specially crafted data to the application, trigger an out-of-bounds read error and read contents of memory on the system.
Affected software
privoxy
Gentoo Linux
Amazon Linux AMI
Ubuntu
privoxy
privoxy (Ubuntu package)
Gentoo Linux
Amazon Linux AMI
Ubuntu
privoxy
privoxy (Ubuntu package)
How to mitigate CVE-2021-20275
Install updates from vendor's website.
privoxy - update to 3.0.32
privoxy - update to 3.0.23-2.17
privoxy (Ubuntu package) - addressed in versions 3.0.24-1ubuntu0.1, 3.0.26-5ubuntu0.1, 3.0.28-2ubuntu0.1, 3.0.28-3ubuntu0.1
privoxy - update to 3.0.23-2.17
privoxy (Ubuntu package) - addressed in versions 3.0.24-1ubuntu0.1, 3.0.26-5ubuntu0.1, 3.0.28-2ubuntu0.1, 3.0.28-3ubuntu0.1