CVE-2020-35502: 
Privoxy vulnerability analysis and mitigation

A flaw was discovered in Privoxy versions before 3.0.29, identified as CVE-2020-35502. The vulnerability involves memory leaks that occur when a response is buffered and either the buffer limit is reached or Privoxy runs out of memory (CVE Mitre, NVD). The vulnerability was disclosed in December 2020.

The vulnerability stems from improper memory management in Privoxy's response buffering mechanism. When the buffer limit is reached or when the system experiences memory constraints, the application fails to properly free allocated memory, leading to memory leaks. This issue was addressed through two specific commits in the Privoxy codebase (Privoxy Manual).

The exploitation of this vulnerability can lead to a system crash due to resource exhaustion caused by memory leaks (Red Hat Bugzilla, Gentoo Security).

The vulnerability was fixed in Privoxy version 3.0.29. Users are advised to upgrade to this version or later. Multiple distributions have released patched versions: Ubuntu (3.0.28-3ubuntu0.1 for 20.10), Debian (3.0.32-2+deb11u1 for bullseye), and Gentoo (3.0.32) (Debian Security, Ubuntu Notice).