1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
2 "http://www.w3.org/TR/html4/loose.dtd">
6 <title>What's New in this Release</title>
7 <meta name="GENERATOR" content=
8 "Modular DocBook HTML Stylesheet Version 1.79">
9 <link rel="HOME" title="Privoxy 3.0.25 User Manual" href="index.html">
10 <link rel="PREVIOUS" title="Installation" href="installation.html">
11 <link rel="NEXT" title="Quickstart to Using Privoxy" href=
13 <link rel="STYLESHEET" type="text/css" href="../p_doc.css">
14 <meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
15 <link rel="STYLESHEET" type="text/css" href="p_doc.css">
18 <body class="SECT1" bgcolor="#EEEEEE" text="#000000" link="#0000FF" vlink=
19 "#840084" alink="#0000FF">
20 <div class="NAVHEADER">
21 <table summary="Header navigation table" width="100%" border="0"
22 cellpadding="0" cellspacing="0">
24 <th colspan="3" align="center">Privoxy 3.0.25 User Manual</th>
28 <td width="10%" align="left" valign="bottom"><a href=
29 "installation.html" accesskey="P">Prev</a></td>
31 <td width="80%" align="center" valign="bottom"></td>
33 <td width="10%" align="right" valign="bottom"><a href=
34 "quickstart.html" accesskey="N">Next</a></td>
37 <hr align="left" width="100%">
41 <h1 class="SECT1"><a name="WHATSNEW" id="WHATSNEW">3. What's New in this
44 <p><span class="APPLICATION">Privoxy 3.0.24</span> stable contains a
45 couple of new features but is mainly a bug-fix release. Two of the fixed
46 bugs are security issues and may be used to remotely trigger crashes on
47 platforms that carefully check memory accesses (most don't).</p>
51 <p>Security fixes (denial of service):</p>
55 <p>Prevent invalid reads in case of corrupt chunk-encoded
56 content. CVE-2016-1982. Bug discovered with afl-fuzz and
61 <p>Remove empty Host headers in client requests. Previously they
62 would result in invalid reads. CVE-2016-1983. Bug discovered with
63 afl-fuzz and AddressSanitizer.</p>
73 <p>When using socks5t, send the request body optimistically as
74 well. Previously the request body wasn't guaranteed to be sent at
75 all and the error message incorrectly blamed the server. Fixes
76 #1686 reported by Peter Müller and G4JC.</p>
80 <p>Fixed buffer scaling in execute_external_filter() that could
81 lead to crashes. Submitted by Yang Xia in #892.</p>
85 <p>Fixed crashes when executing external filters on platforms
86 like Mac OS X. Reported by Jonathan McKenzie on
91 <p>Properly parse ACL directives with ports when compiled with
92 HAVE_RFC2553. Previously the port wasn't removed from the host
93 and in case of 'permit-access 127.0.0.1 example.org:80' Privoxy
94 would try (and fail) to resolve "example.org:80" instead of
95 example.org. Reported by Pak Chan on ijbswa-users@.</p>
99 <p>Check requests more carefully before serving them forcefully
100 when blocks aren't enforced. Privoxy always adds the force token
101 at the beginning of the path, but would previously accept it
102 anywhere in the request line. This could result in requests being
103 served that should be blocked. For example in case of pages that
104 were loaded with force and contained JavaScript to create
105 additionally requests that embed the origin URL (thus inheriting
106 the force prefix). The bug is not considered a security issue and
107 the fix does not make it harder for remote sites to intentionally
108 circumvent blocks if Privoxy isn't configured to enforce them.
109 Fixes #1695 reported by Korda.</p>
113 <p>Normalize the request line in intercepted requests to make
114 rewriting the destination more convenient. Previously rewrites
115 for intercepted requests were expected to fail unless $hostport
116 was being used, but they failed "the wrong way" and would result
117 in an out-of-memory message (vanilla host patterns) or a crash
118 (extended host patterns). Reported by "Guybrush Threepwood" in
123 <p>Enable socket lingering for the correct socket. Previously it
124 was repeatedly enabled for the listen socket instead of for the
125 accepted socket. The bug was found by code inspection and did not
126 cause any (reported) issues.</p>
130 <p>Detect and reject parameters for parameter-less actions.
131 Previously they were silently ignored.</p>
135 <p>Fixed invalid reads in internal and outdated pcre code. Found
136 with afl-fuzz and AddressSanitizer.</p>
140 <p>Prevent invalid read when loading invalid action files. Found
141 with afl-fuzz and AddressSanitizer.</p>
145 <p>Windows build: Use the correct function to close the event
146 handle. It's unclear if this bug had a negative impact on
147 Privoxy's behaviour. Reported by Jarry Xu in #891.</p>
151 <p>In case of invalid forward-socks5(t) directives, use the
152 correct directive name in the error messages. Previously they
153 referred to forward-socks4t failures. Reported by Joel Verhagen
160 <p>General improvements:</p>
164 <p>Set NO_DELAY flag for the accepting socket. This significantly
165 reduces the latency if the operating system is not configured to
166 set the flag by default. Reported by Johan Sintorn in #894.</p>
170 <p>Allow to build with mingw x86_64. Submitted by Rustam
171 Abdullaev in #135.</p>
175 <p>Introduce the new forwarding type 'forward-webserver'.
176 Currently it is only supported by the forward-override{} action
177 and there's no config directive with the same name. The
178 forwarding type is similar to 'forward', but the request line
179 only contains the path instead of the complete URL.</p>
183 <p>The CGI editor no longer treats 'standard.action' special.
184 Nowadays the official "standards" are part of default.action and
185 there's no obvious reason to disallow editing them through the
186 cgi editor anyway (if the user decided that the lack of
187 authentication isn't an issue in her environment).</p>
191 <p>Improved error messages when rejecting intercepted requests
192 with unknown destination.</p>
196 <p>A couple of log messages now include the number of active
201 <p>Removed non-standard Proxy-Agent headers in HTTP snipplets to
202 make testing more convenient.</p>
206 <p>Include the error code for pcre errors Privoxy does not
211 <p>Config directives with numerical arguments are checked more
216 <p>Privoxy's malloc() wrapper has been changed to prevent
217 zero-size allocations which should only occur as the result of
222 <p>Various cosmetic changes.</p>
228 <p>Action file improvements:</p>
232 <p>Unblock ".deutschlandradiokultur.de/". Reported by u302320 in
237 <p>Add two fast-redirect exceptions for "yandex.ru".</p>
241 <p>Disable filter{banners-by-size} for ".plasmaservice.de/".</p>
245 <p>Unblock "klikki.fi/adv/".</p>
249 <p>Block requests for "resources.infolinks.com/". Reported by
250 "Black Rider" on ijbswa-users@.</p>
254 <p>Block a bunch of criteo domains. Reported by Black Rider.</p>
258 <p>Block "abs.proxistore.com/abe/". Reported by Black Rider.</p>
262 <p>Disable filter{banners-by-size} for
263 ".black-mosquito.org/".</p>
267 <p>Disable fast-redirects for "disqus.com/".</p>
273 <p>Documentation improvements:</p>
277 <p>FAQ: Explicitly point fingers at ASUS as an example of a
278 company that has been reported to force malware based on Privoxy
279 upon its customers.</p>
283 <p>Correctly document the action type for a bunch of
284 "multi-value" actions that were incorrectly documented to be
285 "parameterized". Reported by Gregory Seidman on
290 <p>Fixed the documented type of the forward-override{} action
291 which is obviously 'parameterized'.</p>
297 <p>Website improvements:</p>
301 <p>Users who don't trust binaries served by SourceForge can get
302 them from a mirror. Migrating away from SourceForge is planned
303 for 2016 (TODO list item #53).</p>
307 <p>The website is now available as onion service
308 (http://jvauzb4sb3bwlsnc.onion/).</p>
315 <h2 class="SECT2"><a name="UPGRADERSNOTE" id="UPGRADERSNOTE">3.1. Note
316 to Upgraders</a></h2>
318 <p>A quick list of things to be aware of before upgrading from earlier
319 versions of <span class="APPLICATION">Privoxy</span>:</p>
323 <p>The recommended way to upgrade <span class=
324 "APPLICATION">Privoxy</span> is to backup your old configuration
325 files, install the new ones, verify that <span class=
326 "APPLICATION">Privoxy</span> is working correctly and finally merge
327 back your changes using <span class="APPLICATION">diff</span> and
328 maybe <span class="APPLICATION">patch</span>.</p>
330 <p>There are a number of new features in each <span class=
331 "APPLICATION">Privoxy</span> release and most of them have to be
332 explicitly enabled in the configuration files. Old configuration
333 files obviously don't do that and due to syntax changes using old
334 configuration files with a new <span class=
335 "APPLICATION">Privoxy</span> isn't always possible anyway.</p>
339 <p>Note that some installers remove earlier versions completely,
340 including configuration files, therefore you should really save any
341 important configuration files!</p>
345 <p>On the other hand, other installers don't overwrite existing
346 configuration files, thinking you will want to do that
351 <p>In the default configuration only fatal errors are logged now.
352 You can change that in the <a href="config.html#DEBUG">debug
353 section</a> of the configuration file. You may also want to enable
354 more verbose logging until you verified that the new <span class=
355 "APPLICATION">Privoxy</span> version is working as expected.</p>
359 <p>Three other config file settings are now off by default:
360 <a href="config.html#ENABLE-REMOTE-TOGGLE">enable-remote-toggle</a>,
362 "config.html#ENABLE-REMOTE-HTTP-TOGGLE">enable-remote-http-toggle</a>,
364 "config.html#ENABLE-EDIT-ACTIONS">enable-edit-actions</a>. If you
365 use or want these, you will need to explicitly enable them, and be
366 aware of the security issues involved.</p>
372 <div class="NAVFOOTER">
373 <hr align="left" width="100%">
375 <table summary="Footer navigation table" width="100%" border="0"
376 cellpadding="0" cellspacing="0">
378 <td width="33%" align="left" valign="top"><a href="installation.html"
379 accesskey="P">Prev</a></td>
381 <td width="34%" align="center" valign="top"><a href="index.html"
382 accesskey="H">Home</a></td>
384 <td width="33%" align="right" valign="top"><a href="quickstart.html"
385 accesskey="N">Next</a></td>
389 <td width="33%" align="left" valign="top">Installation</td>
391 <td width="34%" align="center" valign="top"> </td>
393 <td width="33%" align="right" valign="top">Quickstart to Using