CVE-2021-44540

A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled pattern spec before bailing.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 28%
VendorProductVersion
privoxyprivoxy
𝑥
< 3.0.33
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
privoxy
bullseye
3.0.32-2+deb11u1
fixed
bookworm
3.0.34-1
fixed
sid
3.0.34-6
fixed
trixie
3.0.34-6
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
privoxy
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
not-affected
jammy
not-affected
impish
ignored
hirsute
ignored
focal
Fixed 3.0.28-2ubuntu0.2
released
bionic
Fixed 3.0.26-5ubuntu0.3
released
xenial
needs-triage
trusty
needed
Common Weakness Enumeration
References
https://www.privoxy.org/3.0.33/user-manual/whatsnew.html%2C
https://www.privoxy.org/gitweb/?p=privoxy.git%3Ba=commit%3Bh=652b4b7cb0
https://www.privoxy.org/3.0.33/user-manual/whatsnew.html%2C
https://www.privoxy.org/gitweb/?p=privoxy.git%3Ba=commit%3Bh=652b4b7cb0