1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
2 "http://www.w3.org/TR/html4/loose.dtd">
6 <title>What's New in this Release</title>
7 <meta name="GENERATOR" content=
8 "Modular DocBook HTML Stylesheet Version 1.79">
9 <link rel="HOME" title="Privoxy 3.0.24 User Manual" href="index.html">
10 <link rel="PREVIOUS" title="Installation" href="installation.html">
11 <link rel="NEXT" title="Quickstart to Using Privoxy" href=
13 <link rel="STYLESHEET" type="text/css" href="../p_doc.css">
14 <meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
15 <link rel="STYLESHEET" type="text/css" href="p_doc.css">
18 <body class="SECT1" bgcolor="#EEEEEE" text="#000000" link="#0000FF" vlink=
19 "#840084" alink="#0000FF">
20 <div class="NAVHEADER">
21 <table summary="Header navigation table" width="100%" border="0"
22 cellpadding="0" cellspacing="0">
24 <th colspan="3" align="center">Privoxy 3.0.24 User Manual</th>
28 <td width="10%" align="left" valign="bottom"><a href=
29 "installation.html" accesskey="P">Prev</a></td>
31 <td width="80%" align="center" valign="bottom"></td>
33 <td width="10%" align="right" valign="bottom"><a href=
34 "quickstart.html" accesskey="N">Next</a></td>
37 <hr align="left" width="100%">
41 <h1 class="SECT1"><a name="WHATSNEW" id="WHATSNEW">3. What's New in this
44 <p><span class="APPLICATION">Privoxy 3.0.24</span> stable contains a
45 couple of new features but is mainly a bug-fix release. Two of the fixed
46 bugs are security issues (CVE requests pending) and may be used to
47 remotely trigger crashes on platforms that carefully check memory
48 accesses (most don't).</p>
52 <p>Security fixes (denial of service):</p>
56 <p>Prevent invalid reads in case of corrupt chunk-encoded
57 content. Bug discovered with afl-fuzz and AddressSanitizer.</p>
61 <p>Remove empty Host headers in client requests. Previously they
62 would result in invalid reads. Bug discovered with afl-fuzz and
73 <p>When using socks5t, send the request body optimistically as
74 well. Previously the request body wasn't guaranteed to be sent at
75 all and the error message incorrectly blamed the server. Fixes
76 #1686 reported by Peter Müller and G4JC.</p>
80 <p>Fixed buffer scaling in execute_external_filter() that could
81 lead to crashes. Submitted by Yang Xia in #892.</p>
85 <p>Fixed crashes when executing external filters on platforms
86 like Mac OS X. Reported by Jonathan McKenzie on ijbswa-users@.</p>
90 <p>Properly parse ACL directives with ports when compiled with
91 HAVE_RFC2553. Previously the port wasn't removed from the host
92 and in case of 'permit-access 127.0.0.1 example.org:80' Privoxy
93 would try (and fail) to resolve "example.org:80" instead of
94 example.org. Reported by Pak Chan on ijbswa-users@.</p>
98 <p>Check requests more carefully before serving them forcefully
99 when blocks aren't enforced. Privoxy always adds the force token
100 at the beginning of the path, but would previously accept it
101 anywhere in the request line. This could result in requests being
102 served that should be blocked. For example in case of pages that
103 were loaded with force and contained JavaScript to create
104 additionally requests that embed the origin URL (thus inheriting
105 the force prefix). The bug is not considered a security issue and
106 the fix does not make it harder for remote sites to intentionally
107 circumvent blocks if Privoxy isn't configured to enforce them.
108 Fixes #1695 reported by Korda.</p>
112 <p>Normalize the request line in intercepted requests to make
113 rewriting the destination more convenient. Previously rewrites
114 for intercepted requests were expected to fail unless $hostport
115 was being used, but they failed "the wrong way" and would result
116 in an out-of-memory message (vanilla host patterns) or a crash
117 (extended host patterns). Reported by "Guybrush Threepwood" in
122 <p>Enable socket lingering for the correct socket. Previously it
123 was repeatedly enabled for the listen socket instead of for the
124 accepted socket. The bug was found by code inspection and did not
125 cause any (reported) issues.</p>
129 <p>Detect and reject parameters for parameter-less actions.
130 Previously they were silently ignored.</p>
134 <p>Fixed invalid reads in internal and outdated pcre code. Found
135 with afl-fuzz and AddressSanitizer.</p>
139 <p>Prevent invalid read when loading invalid action files. Found
140 with afl-fuzz and AddressSanitizer.</p>
144 <p>Windows build: Use the correct function to close the event
145 handle. It's unclear if this bug had a negative impact on
146 Privoxy's behaviour. Reported by Jarry Xu in #891.</p>
150 <p>In case of invalid forward-socks5(t) directives, use the
151 correct directive name in the error messages. Previously they
152 referred to forward-socks4t failures. Reported by Joel Verhagen
159 <p>General improvements:</p>
163 <p>Set NO_DELAY flag for the accepting socket. This significantly
164 reduces the latency if the operating system is not configured to
165 set the flag by default. Reported by Johan Sintorn in #894.</p>
169 <p>Allow to build with mingw x86_64. Submitted by Rustam
170 Abdullaev in #135.</p>
174 <p>Introduce the new forwarding type 'forward-webserver'.
175 Currently it is only supported by the forward-override{} action
176 and there's no config directive with the same name. The
177 forwarding type is similar to 'forward', but the request line
178 only contains the path instead of the complete URL.</p>
182 <p>The CGI editor no longer treats 'standard.action' special.
183 Nowadays the official "standards" are part of default.action and
184 there's no obvious reason to disallow editing them through the
185 cgi editor anyway (if the user decided that the lack of
186 authentication isn't an issue in her environment).</p>
190 <p>Improved error messages when rejecting intercepted requests
191 with unknown destination.</p>
195 <p>A couple of log messages now include the number of active
200 <p>Removed non-standard Proxy-Agent headers in HTTP snipplets to
201 make testing more convenient.</p>
205 <p>Include the error code for pcre errors Privoxy does not
210 <p>Config directives with numerical arguments are checked more
215 <p>Privoxy's malloc() wrapper has been changed to prevent
216 zero-size allocations which should only occur as the result of
221 <p>Various cosmetic changes.</p>
227 <p>Action file improvements:</p>
231 <p>Unblock ".deutschlandradiokultur.de/". Reported by u302320 in
236 <p>Add two fast-redirect exceptions for "yandex.ru".</p>
240 <p>Disable filter{banners-by-size} for ".plasmaservice.de/".</p>
244 <p>Unblock "klikki.fi/adv/".</p>
248 <p>Block requests for "resources.infolinks.com/". Reported by
249 "Black Rider" on ijbswa-users@.</p>
253 <p>Block a bunch of criteo domains. Reported by Black Rider.</p>
257 <p>Block "abs.proxistore.com/abe/". Reported by Black Rider.</p>
261 <p>Disable filter{banners-by-size} for
262 ".black-mosquito.org/".</p>
266 <p>Disable fast-redirects for "disqus.com/".</p>
272 <p>Documentation improvements:</p>
276 <p>FAQ: Explicitly point fingers at ASUS as an example of a
277 company that has been reported to force malware based on Privoxy
278 upon its customers.</p>
282 <p>Correctly document the action type for a bunch of
283 "multi-value" actions that were incorrectly documented to be
284 "parameterized". Reported by Gregory Seidman on
289 <p>Fixed the documented type of the forward-override{} action
290 which is obviously 'parameterized'.</p>
296 <p>Website improvements:</p>
300 <p>Users who don't trust binaries served by SourceForge can get
301 them from a mirror. Migrating away from SourceForge is planned
302 for 2016 (TODO list item #53).</p>
306 <p>The website is now available as onion service
307 (http://jvauzb4sb3bwlsnc.onion/).</p>
314 <h2 class="SECT2"><a name="UPGRADERSNOTE" id="UPGRADERSNOTE">3.1. Note
315 to Upgraders</a></h2>
317 <p>A quick list of things to be aware of before upgrading from earlier
318 versions of <span class="APPLICATION">Privoxy</span>:</p>
322 <p>The recommended way to upgrade <span class=
323 "APPLICATION">Privoxy</span> is to backup your old configuration
324 files, install the new ones, verify that <span class=
325 "APPLICATION">Privoxy</span> is working correctly and finally merge
326 back your changes using <span class="APPLICATION">diff</span> and
327 maybe <span class="APPLICATION">patch</span>.</p>
329 <p>There are a number of new features in each <span class=
330 "APPLICATION">Privoxy</span> release and most of them have to be
331 explicitly enabled in the configuration files. Old configuration
332 files obviously don't do that and due to syntax changes using old
333 configuration files with a new <span class=
334 "APPLICATION">Privoxy</span> isn't always possible anyway.</p>
338 <p>Note that some installers remove earlier versions completely,
339 including configuration files, therefore you should really save any
340 important configuration files!</p>
344 <p>On the other hand, other installers don't overwrite existing
345 configuration files, thinking you will want to do that
350 <p>In the default configuration only fatal errors are logged now.
351 You can change that in the <a href="config.html#DEBUG">debug
352 section</a> of the configuration file. You may also want to enable
353 more verbose logging until you verified that the new <span class=
354 "APPLICATION">Privoxy</span> version is working as expected.</p>
358 <p>Three other config file settings are now off by default:
359 <a href="config.html#ENABLE-REMOTE-TOGGLE">enable-remote-toggle</a>,
361 "config.html#ENABLE-REMOTE-HTTP-TOGGLE">enable-remote-http-toggle</a>,
363 "config.html#ENABLE-EDIT-ACTIONS">enable-edit-actions</a>. If you
364 use or want these, you will need to explicitly enable them, and be
365 aware of the security issues involved.</p>
371 <div class="NAVFOOTER">
372 <hr align="left" width="100%">
374 <table summary="Footer navigation table" width="100%" border="0"
375 cellpadding="0" cellspacing="0">
377 <td width="33%" align="left" valign="top"><a href="installation.html"
378 accesskey="P">Prev</a></td>
380 <td width="34%" align="center" valign="top"><a href="index.html"
381 accesskey="H">Home</a></td>
383 <td width="33%" align="right" valign="top"><a href="quickstart.html"
384 accesskey="N">Next</a></td>
388 <td width="33%" align="left" valign="top">Installation</td>
390 <td width="34%" align="center" valign="top"> </td>
392 <td width="33%" align="right" valign="top">Quickstart to Using