Add #197: Investigate if parts of Privoxy should get optional replacements written...

[privoxy.git] / ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 9e112e1..c9c3a91 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,20 @@
 --------------------------------------------------------------------
 ChangeLog for Privoxy
 --------------------------------------------------------------------
 --------------------------------------------------------------------
 ChangeLog for Privoxy
 --------------------------------------------------------------------

+*** Version 3.0.31 stable ***
+
+- Security/Reliability:
+  - Prevent an assertion from getting triggered by a crafted CGI request.
+    Commit 5bba5b89193fa. OVE-20210130-0001. CVE-2021-20217.
+    Reported by: Joshua Rogers (Opera)
+  - Fixed a memory leak when decompression fails "unexpectedly".
+    Commit f431d61740cc0. OVE-20210128-0001. CVE-2021-20216.
+
+- Bug fixes:
+  - Fixed detection of insufficient data for decompression.
+    Previously Privoxy could try to decompress a partly
+    uninitialized buffer.
+

 *** Version 3.0.30 stable ***
 
 - Bug fixes:
 *** Version 3.0.30 stable ***
 
 - Bug fixes:


@@ -27,6 +41,8 @@ ChangeLog for Privoxy
     the TLS backend resources are free'd later on and only if no active
     connections are left. Prevents crashes when exiting "gracefully" at the
     wrong time.
     the TLS backend resources are free'd later on and only if no active
     connections are left. Prevents crashes when exiting "gracefully" at the
     wrong time.

+  - Let the uninstall target remove the config file even if DESTDIR
+    is set and properly announce the deletion of the configuration files.

 
 - General improvements:
   - Allow to rewrite the request destination for https-inspected
 
 - General improvements:
   - Allow to rewrite the request destination for https-inspected


@@ -288,6 +304,8 @@ ChangeLog for Privoxy
   - Add a link to Privoxy-Regression-Test to regression-tests.action
     in case it isn't packaged.
   - Add regression tests for pcre host patterns.
   - Add a link to Privoxy-Regression-Test to regression-tests.action
     in case it isn't packaged.
   - Add regression tests for pcre host patterns.

+  - Fixed a regression test that is executed when
+    FEATURE_GRACEFUL_TERMINATION is enabled.

 
 - Privoxy infrastructure:
   - Import a Privoxy logo for the website.
 
 - Privoxy infrastructure:
   - Import a Privoxy logo for the website.


@@ -303,32 +321,33 @@ ChangeLog for Privoxy
   - Fixed memory leaks when a response is buffered and the buffer
     limit is reached or Privoxy is running out of memory.
     Commits bbd53f1010b and 4490d451f9b. OVE-20201118-0001.
   - Fixed memory leaks when a response is buffered and the buffer
     limit is reached or Privoxy is running out of memory.
     Commits bbd53f1010b and 4490d451f9b. OVE-20201118-0001.

+    CVE-2020-35502.

     Sponsored by: Robert Klemme
   - Fixed a memory leak in the show-status CGI handler when
     no action files are configured. Commit c62254a686.
     Sponsored by: Robert Klemme
   - Fixed a memory leak in the show-status CGI handler when
     no action files are configured. Commit c62254a686.

-    OVE-20201118-0002.
+    OVE-20201118-0002. CVE-2021-20209.

     Sponsored by: Robert Klemme
   - Fixed a memory leak in the show-status CGI handler when
     no filter files are configured. Commit 1b1370f7a8a.
     Sponsored by: Robert Klemme
   - Fixed a memory leak in the show-status CGI handler when
     no filter files are configured. Commit 1b1370f7a8a.

-    OVE-20201118-0003.
+    OVE-20201118-0003. CVE-2021-20210.

     Sponsored by: Robert Klemme
   - Fixes a memory leak when client tags are active.
     Sponsored by: Robert Klemme
   - Fixes a memory leak when client tags are active.

-    Commit 245e1cf32. OVE-20201118-0004.
+    Commit 245e1cf32. OVE-20201118-0004. CVE-2021-20211.

     Sponsored by: Robert Klemme
   - Fixed a memory leak if multiple filters are executed
     and the last one is skipped due to a pcre error.
     Sponsored by: Robert Klemme
   - Fixed a memory leak if multiple filters are executed
     and the last one is skipped due to a pcre error.

-    Commit 5cfb7bc8fe. OVE-20201118-0005.
+    Commit 5cfb7bc8fe. OVE-20201118-0005. CVE-2021-20212.

   - Prevent an unlikely dereference of a NULL-pointer that
     could result in a crash if accept-intercepted-requests
     was enabled, Privoxy failed to get the request destination
     from the Host header and a memory allocation failed.
   - Prevent an unlikely dereference of a NULL-pointer that
     could result in a crash if accept-intercepted-requests
     was enabled, Privoxy failed to get the request destination
     from the Host header and a memory allocation failed.

-    Commit 7530132349. CID 267165. OVE-20201118-0006.
+    Commit 7530132349. CID 267165. OVE-20201118-0006. CVE-2021-20213.

   - Fixed memory leaks in the client-tags CGI handler when
     client tags are configured and memory allocations fail.
   - Fixed memory leaks in the client-tags CGI handler when
     client tags are configured and memory allocations fail.

-    Commit cf5640eb2a. CID 267168. OVE-20201118-0007.
+    Commit cf5640eb2a. CID 267168. OVE-20201118-0007. CVE-2021-20214.

   - Fixed memory leaks in the show-status CGI handler when memory
     allocations fail. Commit 064eac5fd0 and commit fdee85c0bf3.
   - Fixed memory leaks in the show-status CGI handler when memory
     allocations fail. Commit 064eac5fd0 and commit fdee85c0bf3.

-    CID 305233. OVE-20201118-0008.
+    CID 305233. OVE-20201118-0008. CVE-2021-20215.

 
 - General improvements:
   - Added experimental https inspection support which allows to filter
 
 - General improvements:
   - Added experimental https inspection support which allows to filter