privoxy (3.0.26-5ubuntu0.3) bionic-security; urgency=medium

  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2021-44540.patch: fixed the  get_url_spec_param() 
      by freeing memory of compiled pattern spec before bailing.
    - CVE-2021-44540
  * SECURITY UPDATE: XSS
    - debian/patches/CVE-2021-44543.patch: fixed the cgi_error_no_template()
      by encoding the template name.
    - CVE-2021-44543

 -- Amir Naseredini <amir.naseredini@canonical.com>  Thu, 19 Jan 2023 11:16:20 +0000

privoxy (3.0.26-5ubuntu0.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow
    - debian/patches/38_CVE-2021-20217.patch: Prevent an assertion by a
      crafted CGI request.
    - CVE-2021-20217
  * SECURITY UPDATE: Memory leak
    - debian/patches/40_CVE-2021-20216.patch: Fix a memory leak.
    - debian/patches/41_CVE-2020-35502.patch: Fixed memory leaks when a
      response is buffered and the buffer limit is reached or Privoxy is
      running out of memory.
    - debian/patches/42_CVE-2021-20209.patch: Fixed a memory leak in the
      show-status CGI handler when no action files are configured.
    - debian/patches/43_CVE-2021-20210.patch: Fixed a memory leak in the show-status
      CGI handler when no filter files are configured.
    - debian/patches/44_CVE-2021-20211.patch: Fixes a memory leak when client tags
      are active.
    - debian/patches/45_CVE-2021-20212.patch: Fixed a memory leak if multiple
      filters are executed and the last one is skipped due to a pcre error.
    - debian/patches/48_CVE-2021-20215.patch: Fixed memory leaks in the show-status
      CGI handler when memory allocations fail.
    - CVE-2021-20216
    - CVE-2020-35502
    - CVE-2021-20209
    - CVE-2021-20210
    - CVE-2021-20211
    - CVE-2021-20212
    - CVE-2021-20215
  * SECURITY UPDATE: Denial of Service
    - debian/patches/46_CVE-2021-20213.patch: Prevent an unlikely dereference of a
      NULL-pointer that could result in a crash if accept-intercepted-requests
      was enabled.
    - debian/patches/49_CVE-2021-20272.patch: Remove an assertion that could be
      triggered with a crafted CGI request.
    - debian/patches/50_CVE-2021-20273.patch: Overrule invalid image types.
      Prevents a crash with a crafted CGI request if Privoxy is toggled off.
    - debian/patches/51_CVE-2021-20275.patch: Prevent invalid read of size two.
    - debian/patches/52_CVE-2021-20276.patch: Obsolete pcre: Prevent invalid memory
      accesses.
    - CVE-2021-20213
    - CVE-2021-20272
    - CVE-2021-20273
    - CVE-2021-20275
    - CVE-2021-20276
  * Fix detection of insufficient data: debian/patches/39_decompress_iob.patch

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Tue, 16 Mar 2021 15:51:43 +0100

privoxy (3.0.26-5) unstable; urgency=medium

  * Add ru debconf translation.  Thanks to Lev Lamberov (Closes: #883110).
  * Optimize patches for gbp pq.
  * Upgrade to Standards-Version 4.1.3 (no changes).
  * Upgrade to debhelper v11 (remove systemd from dh call).

 -- Roland Rosenfeld <roland@debian.org>  Sat, 20 Jan 2018 12:49:42 +0100

privoxy (3.0.26-4) unstable; urgency=medium

  * Add pt debconf translation.  Thanks to Rui Branco (Closes: #858743).
  * Add description to 36_openspopenjade.patch.
  * Upgrade to debhelper v10 and remove dh-systemd build dependency.
  * debhelper v10 replaces autotools-dev.
  * Remove Testsuite header, since this is automatically added.
  * Upgrade to Standards-Version 4.1.1
    - change copyrights-format to https.

 -- Roland Rosenfeld <roland@debian.org>  Wed, 01 Nov 2017 10:45:49 +0100

privoxy (3.0.26-3) unstable; urgency=medium

  * Add da debconf translation.  Thanks to Joe Dalton (Closes: #850876).
  * 37_adventofcode: unlock adventofcode.com (Closes: #848211).

 -- Roland Rosenfeld <roland@debian.org>  Wed, 11 Jan 2017 22:24:55 +0100

privoxy (3.0.26-2) unstable; urgency=medium

  * Add db_stop to postinst, since upgrade fails otherwise in some
    situations (Closes: #835409).
  * Replace sp and jade with opensp and openjade.  Thanks to Neil Roeth
    for providing a patch (Closes: #837207).

 -- Roland Rosenfeld <roland@debian.org>  Sat, 10 Sep 2016 08:48:35 +0200

privoxy (3.0.26-1) unstable; urgency=medium

  * New upstream version 3.0.26.
  * This includes 36_listen-nohost.patch.
  * Updated all patches to new version.

 -- Roland Rosenfeld <roland@debian.org>  Sat, 27 Aug 2016 22:28:32 +0200

privoxy (3.0.25-2) unstable; urgency=medium

  * Add pt_BR debconf translation.  Thanks to Adriano Rafael Gomes
    (Closes: #827327).
  * Symlink p_doc.css to user-manual.
  * Install regression-tests.action.
  * Enable autopkgtest and run privoxy-regression-test.pl.
  * Install privoxy-regression-test and man page to binary package.
  * Updated debian/copyright to catch all copyright variants.
  * Remove outdated stuff from README.Debian.
  * 36_listen-nohost: Fix crashes with "listen-addr :8118" (Closes: #834941).

 -- Roland Rosenfeld <roland@debian.org>  Tue, 23 Aug 2016 09:27:34 +0200

privoxy (3.0.25-1) unstable; urgency=medium

  * New upstream version 3.0.25 (beta).
  * Adapt all patches to new upstream version.
  * Update debian/copyright to new privoxy home.
  * Add sv debconf translation.  Thanks to Jonatan Nyberg (Closes: #824913).
  * Add fr debconf translation.  Thanks to Steve Petruzzello (Closes: #825478).
  * Add nl debconf translation.  Thanks to Frans Spiesschaert (Closes: #825691).
  * privoxy.service: Run after network.target (Closes: #825358).

 -- Roland Rosenfeld <roland@debian.org>  Sat, 28 May 2016 23:13:56 +0200

privoxy (3.0.24-2) unstable; urgency=medium

  * Upgrade Standards-Version to 3.9.8 (no changes).
  * Add -p to QUILT_DIFF_OPTS.
  * Add Documentation key to privoxy.service.
  * 35_man-spelling: Fix spelling error in privoxy-log-parser(1).
  * Add debconf and ucf support to make listen-address configurable.
    Thanks to James Valleroy for providing the code (Closes: #798219).
  * Remove 28_listen_localhost, but listen on 127.0.0.1:8118 and
    [::1]:8118 by default, since otherwise privoxy listens only on IPv6
    (Closes: #518010, #557443).
  * Change several URLs from http to https.

 -- Roland Rosenfeld <roland@debian.org>  Sun, 01 May 2016 14:21:22 +0200

# For older changelog entries, run 'apt-get changelog privoxy'
