privoxy (3.0.28-2ubuntu0.2) focal-security; urgency=medium

  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2021-44540.patch: fixed the  get_url_spec_param() 
      by freeing memory of compiled pattern spec before bailing.
    - CVE-2021-44540
  * SECURITY UPDATE: XSS
    - debian/patches/CVE-2021-44543.patch: fixed the cgi_error_no_template()
      by encoding the template name.
    - CVE-2021-44543

 -- Amir Naseredini <amir.naseredini@canonical.com>  Mon, 23 Jan 2023 11:22:07 +0000

privoxy (3.0.28-2ubuntu0.1) focal-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow
    - debian/patches/38_CVE-2021-20217.patch: Prevent an assertion by a
      crafted CGI request.
    - CVE-2021-20217
  * SECURITY UPDATE: Memory leak
    - debian/patches/40_CVE-2021-20216.patch: Fix a memory leak.
    - debian/patches/41_CVE-2020-35502.patch: Fixed memory leaks when a
      response is buffered and the buffer limit is reached or Privoxy is
      running out of memory.
    - debian/patches/42_CVE-2021-20209.patch: Fixed a memory leak in the
      show-status CGI handler when no action files are configured.
    - debian/patches/43_CVE-2021-20210.patch: Fixed a memory leak in the show-status
      CGI handler when no filter files are configured.
    - debian/patches/44_CVE-2021-20211.patch: Fixes a memory leak when client tags
      are active.
    - debian/patches/45_CVE-2021-20212.patch: Fixed a memory leak if multiple
      filters are executed and the last one is skipped due to a pcre error.
    - debian/patches/48_CVE-2021-20215.patch: Fixed memory leaks in the show-status
      CGI handler when memory allocations fail.
    - debian/patches/53_CVE-2021-20214.patch: Plug memory leaks.
    - CVE-2021-20216
    - CVE-2020-35502
    - CVE-2021-20209
    - CVE-2021-20210
    - CVE-2021-20211
    - CVE-2021-20212
    - CVE-2021-20215
    - CVE-2021-20214
  * SECURITY UPDATE: Denial of Service
    - debian/patches/46_CVE-2021-20213.patch: Prevent an unlikely dereference of a
      NULL-pointer that could result in a crash if accept-intercepted-requests
      was enabled.
    - debian/patches/49_CVE-2021-20272.patch: Remove an assertion that could be
      triggered with a crafted CGI request.
    - debian/patches/50_CVE-2021-20273.patch: Overrule invalid image types.
      Prevents a crash with a crafted CGI request if Privoxy is toggled off.
    - debian/patches/51_CVE-2021-20275.patch: Prevent invalid read of size two.
    - debian/patches/52_CVE-2021-20276.patch: Obsolete pcre: Prevent invalid memory
      accesses.
    - CVE-2021-20213
    - CVE-2021-20272
    - CVE-2021-20273
    - CVE-2021-20275
    - CVE-2021-20276
  * Fix detection of insufficient data: debian/patches/39_decompress_iob.patch

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Thu, 18 Mar 2021 18:01:17 +0100

privoxy (3.0.28-2) unstable; urgency=medium

  * d/tests/privoxy-regression-test: Remove tmpdir on exit.
  * 36_trusted-cgi-referer-example: Comment trusted-cgi-referer pointing
    to example.org
  * d/maintscript: Remove orphaned /etc/privoxy/templates/show-version
    (Closes: #918110).
  * 37_ppedit-tests403: Update a bunch of regression tests that have to
    expect status code 403 now.
  * Enable enable-edit-actions in privoxy-regression-test again.
  * Upgrade to debhelper v12.
  * Update (minimal) upstream signing key.
  * Add Pre-Depends: ${misc:Pre-Depends} for --skip-systemd-native.

 -- Roland Rosenfeld <roland@debian.org>  Sun, 06 Jan 2019 13:07:14 +0100

privoxy (3.0.28-1) unstable; urgency=medium

  [ Roland Rosenfeld ]
  * Add es debconf translation.  Thanks to Jonathan Bustillos (Closes: #903863).
  * 38_connection_close: Don't add a "Connection" header for CONNECT requests.

  [ Ondřej Nový ]
  * d/tests: Use AUTOPKGTEST_TMP instead of ADTTMP
  * d/watch: Use https protocol

  [ Roland Rosenfeld ]
  * d/tests: Fix leftover ADTTMP.
  * Add salsa CI pipeline in debian/gitlab-ci.yml.
  * New upstream version 3.0.28.
  * Adapt all patches to new version (06_8bit_manual is implemented in a
    better way upstream now, 36_openspopenjade is replaced by some
    autoconf code, 37_adventofcode and 38_connection_close are included
    upstream).
  * Update debian/copyright.
  * Upgrade to Standards-Version 4.3.0 (Declare Rules-Requires-Root: no).
  * Move PID file from /var/run to /run.
  * Undo voodoo to remove CVS tags from configs since upstream uses git
    now.
  * Disable enable-edit-actions in privoxy-regression-test, since the test
    seems to be broken (does not use referrer, which is required here).

 -- Roland Rosenfeld <roland@debian.org>  Mon, 31 Dec 2018 16:52:27 +0100

privoxy (3.0.26-6) unstable; urgency=medium

  * Fix typo in patch description.
  * postinst: avoid using chown -R.
  * Move source.lintian-overrides to soure/lintian-overrides.
  * Add Vcs-headers pointing to salsa.
  * Upgrade to Standards-Version 4.1.4 (no changes).

 -- Roland Rosenfeld <roland@debian.org>  Sun, 29 Apr 2018 11:57:47 +0200

privoxy (3.0.26-5) unstable; urgency=medium

  * Add ru debconf translation.  Thanks to Lev Lamberov (Closes: #883110).
  * Optimize patches for gbp pq.
  * Upgrade to Standards-Version 4.1.3 (no changes).
  * Upgrade to debhelper v11 (remove systemd from dh call).

 -- Roland Rosenfeld <roland@debian.org>  Sat, 20 Jan 2018 12:49:42 +0100

privoxy (3.0.26-4) unstable; urgency=medium

  * Add pt debconf translation.  Thanks to Rui Branco (Closes: #858743).
  * Add description to 36_openspopenjade.patch.
  * Upgrade to debhelper v10 and remove dh-systemd build dependency.
  * debhelper v10 replaces autotools-dev.
  * Remove Testsuite header, since this is automatically added.
  * Upgrade to Standards-Version 4.1.1
    - change copyrights-format to https.

 -- Roland Rosenfeld <roland@debian.org>  Wed, 01 Nov 2017 10:45:49 +0100

privoxy (3.0.26-3) unstable; urgency=medium

  * Add da debconf translation.  Thanks to Joe Dalton (Closes: #850876).
  * 37_adventofcode: unlock adventofcode.com (Closes: #848211).

 -- Roland Rosenfeld <roland@debian.org>  Wed, 11 Jan 2017 22:24:55 +0100

privoxy (3.0.26-2) unstable; urgency=medium

  * Add db_stop to postinst, since upgrade fails otherwise in some
    situations (Closes: #835409).
  * Replace sp and jade with opensp and openjade.  Thanks to Neil Roeth
    for providing a patch (Closes: #837207).

 -- Roland Rosenfeld <roland@debian.org>  Sat, 10 Sep 2016 08:48:35 +0200

privoxy (3.0.26-1) unstable; urgency=medium

  * New upstream version 3.0.26.
  * This includes 36_listen-nohost.patch.
  * Updated all patches to new version.

 -- Roland Rosenfeld <roland@debian.org>  Sat, 27 Aug 2016 22:28:32 +0200

# For older changelog entries, run 'apt-get changelog privoxy'
