--- privoxy-3.0.16.orig/debian/control
+++ privoxy-3.0.16/debian/control
@@ -0,0 +1,24 @@
+Source: privoxy
+Section: web
+Priority: optional
+Maintainer: Roland Rosenfeld <roland@debian.org>
+Build-Depends: debhelper (>= 5.0.0), autoconf, autotools-dev, libpcre3-dev,
+ jade, docbook-dsssl, docbook, w3m, sp, sgmlspl, groff, man2html, dpatch,
+ zlib1g-dev
+Standards-Version: 3.8.3
+Homepage: http://www.privoxy.org/
+
+Package: privoxy
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, ${perl:Depends}, logrotate,
+ adduser, lsb-base (>= 3.2-13)
+Recommends: doc-base
+Description: Privacy enhancing HTTP Proxy
+ Privoxy is a web proxy with advanced filtering capabilities for
+ protecting privacy, filtering web page content, managing cookies,
+ controlling access, and removing ads, banners, pop-ups and other
+ obnoxious Internet junk. Privoxy has a very flexible configuration
+ and can be customized to suit individual needs and tastes. Privoxy
+ has application for both stand-alone systems and multi-user networks.
+ .
+ Privoxy is based on Internet Junkbuster (tm).
--- privoxy-3.0.16.orig/debian/docs
+++ privoxy-3.0.16/debian/docs
@@ -0,0 +1,10 @@
+README
+AUTHORS
+TODO
+doc/webserver/faq
+doc/webserver/user-manual
+doc/webserver/developer-manual
+doc/webserver/images
+doc/webserver/p_doc.css
+doc/webserver/privoxy-index.html
+doc/webserver/man-page
--- privoxy-3.0.16.orig/debian/watch
+++ privoxy-3.0.16/debian/watch
@@ -0,0 +1,8 @@
+# See uscan(1) for format
+
+# Compulsory line, this is a version 3 file
+version=3
+
+#http://sourceforge.net/project/showfiles.php?group_id=11118 http://prdownloads.sourceforge.net/ijbswa/privoxy-(.*)-stable-src.tar.gz\?download
+
+http://sf.net/ijbswa/privoxy-(\d+.*)-(?:stable|beta)-src.tar.gz
--- privoxy-3.0.16.orig/debian/copyright
+++ privoxy-3.0.16/debian/copyright
@@ -0,0 +1,47 @@
+This package was debianized by Roland Rosenfeld <roland@debian.org> on
+Fri, 29 Mar 2002 11:52:03 +0100.
+
+It was downloaded from http://www.privoxy.org/ and
+http://sourceforge.net/project/showfiles.php?group_id=11118
+
+Upstream Authors: ijbswa-developers@lists.sourceforge.net
+
+Current Development Team:
+
+ Hal Burgiss (docs)
+ Jon Foster
+ Andreas Oesterhelt
+ David Schmidt (OS/2, Mac OSX ports)
+
+Originally developed by:
+
+ Junkbusters Corp.
+ Anonymous Coders
+
+Copyright:     Written by and Copyright (C) 2001-2010 the
+               Privoxy team.  http://www.privoxy.org/
+
+               Based on the Internet Junkbuster originally written
+               by and Copyright (C) 1997 Anonymous Coders and 
+               Junkbusters Corporation.  http://www.junkbusters.com
+
+               This program is free software; you can redistribute it 
+               and/or modify it under the terms of the GNU General
+               Public License as published by the Free Software
+               Foundation; either version 2 of the License, or (at
+               your option) any later version.
+
+               This program is distributed in the hope that it will
+               be useful, but WITHOUT ANY WARRANTY; without even the
+               implied warranty of MERCHANTABILITY or FITNESS FOR A
+               PARTICULAR PURPOSE.  See the GNU General Public
+               License for more details.
+
+               The GNU General Public License should be included with
+               this file.  If not, you can view it at
+               http://www.gnu.org/copyleft/gpl.html
+               or write to the Free Software Foundation, Inc., 
+               51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
+
+The complete GNU General Public License can be found at
+/usr/share/common-licenses/GPL-2
--- privoxy-3.0.16.orig/debian/doc-base.user
+++ privoxy-3.0.16/debian/doc-base.user
@@ -0,0 +1,10 @@
+Document: privoxy-user
+Title: Privoxy User Manual
+Author: Privoxy Developers
+Abstract: The user manual gives users information on how to install,
+ configure and use Privoxy.  Privoxy is a filtering web proxy.
+Section: Network/Web Browsing
+
+Format: HTML
+Index: /usr/share/doc/privoxy/user-manual/index.html
+Files: /usr/share/doc/privoxy/user-manual/*.html
--- privoxy-3.0.16.orig/debian/init.d
+++ privoxy-3.0.16/debian/init.d
@@ -0,0 +1,181 @@
+#! /bin/sh
+### BEGIN INIT INFO
+# Provides:          privoxy
+# Required-Start:    $local_fs $remote_fs $network $time
+# Required-Stop:     $local_fs $remote_fs $network $time
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Privacy enhancing HTTP Proxy
+# Description:       Privoxy is a web proxy with advanced filtering
+#                    capabilities for protecting privacy, filtering
+#                    web page content, managing cookies, controlling
+#                    access, and removing ads, banners, pop-ups and
+#                    other obnoxious Internet junk.
+### END INIT INFO
+
+# Author: Roland Rosenfeld <roland@debian.org>
+
+# Do NOT "set -e"
+
+# PATH should only include /usr/* if it runs after the mountnfs.sh script
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+DESC="filtering proxy server"
+NAME=privoxy
+DAEMON=/usr/sbin/$NAME
+PIDFILE=/var/run/$NAME.pid
+OWNER=privoxy
+CONFIGFILE=/etc/privoxy/config
+DAEMON_ARGS="--pidfile $PIDFILE --user $OWNER $CONFIGFILE"
+SCRIPTNAME=/etc/init.d/$NAME
+LOGDIR=/var/log/privoxy
+DEFAULTSFILE=/etc/default/$NAME
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Read configuration variable file if it is present
+[ -r $DEFAULTSFILE ] && . $DEFAULTSFILE
+
+# Create log directory if it does not exist
+if [ ! -d "$LOGDIR" ]; then
+    mkdir -m 750 $LOGDIR
+    chown $OWNER:adm $LOGDIR
+fi
+
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
+. /lib/lsb/init-functions
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+	# Return
+	#   0 if daemon has been started
+	#   1 if daemon was already running
+	#   2 if daemon could not be started
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
+		|| return 1
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \
+		$DAEMON_ARGS \
+		|| return 2
+	# Add code here, if necessary, that waits for the process to be ready
+	# to handle requests from services started subsequently which depend
+	# on this one.  As a last resort, sleep for some time.
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+	# Return
+	#   0 if daemon has been stopped
+	#   1 if daemon was already stopped
+	#   2 if daemon could not be stopped
+	#   other if a failure occurred
+	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
+	RETVAL="$?"
+	[ "$RETVAL" = 2 ] && return 2
+	# Wait for children to finish too if this is a daemon that forks
+	# and if the daemon is only ever run from this initscript.
+	# If the above conditions are not satisfied then add some other code
+	# that waits for the process to drop all resources that could be
+	# needed by services started subsequently.  A last resort is to
+	# sleep for some time.
+	start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
+	[ "$?" = 2 ] && return 2
+	# Many daemons don't delete their pidfiles when they exit.
+	rm -f $PIDFILE
+	return "$RETVAL"
+}
+
+#
+# Function that sends a SIGHUP to the daemon/service
+#
+do_reload() {
+	#
+	# If the daemon can reload its configuration without
+	# restarting (for example, when it is sent a SIGHUP),
+	# then implement that here.
+	#
+	start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
+	return 0
+}
+
+
+case "$1" in
+  start)
+	if [ "$RUN_DAEMON" = "no" ]; then
+            [ "$VERBOSE" != no ] && log_warning_msg "Not starting $DESC (disabled in $DEFAULTSFILE)."
+            exit 0
+	fi
+
+	[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
+	do_start
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  stop)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
+	do_stop
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  #reload|force-reload)
+	#
+	# If do_reload() is not implemented then leave this commented out
+	# and leave 'force-reload' as an alias for 'restart'.
+	#
+	#log_daemon_msg "Reloading $DESC" "$NAME"
+	#do_reload
+	#log_end_msg $?
+	#;;
+  restart|force-reload)
+	#
+	# If the "reload" option is implemented then remove the
+	# 'force-reload' alias
+	#
+	if [ "$RUN_DAEMON" = "no" ]; then
+            [ "$VERBOSE" != no ] && log_warning_msg "Not restarting $DESC (disabled in $DEFAULTSFILE)."
+            exit 0
+	fi
+
+	log_daemon_msg "Restarting $DESC" "$NAME"
+	do_stop
+	case "$?" in
+	  0|1)
+		do_start
+		case "$?" in
+			0) log_end_msg 0 ;;
+			1) log_end_msg 1 ;; # Old process is still running
+			*) log_end_msg 1 ;; # Failed to start
+		esac
+		;;
+	  *)
+	  	# Failed to stop
+		log_end_msg 1
+		;;
+	esac
+	;;
+  status)
+        status_of_proc "$DAEMON" "$NAME"
+        exit $?
+        ;;
+
+  *)
+	#echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
+	echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload|status}" >&2
+	exit 3
+	;;
+esac
+
+:
--- privoxy-3.0.16.orig/debian/changelog
+++ privoxy-3.0.16/debian/changelog
@@ -0,0 +1,616 @@
+privoxy (3.0.16-1+deb6u1) squeeze-lts; urgency=medium
+
+  * Non-maintainer upload by the Squeeze LTS team.
+  * Thanks to Roland Rosenfeld for maintaining privoxy and preparing these
+    patches:
+    - 35_CVE-2015-1031-CID66394: unmap(): Prevent use-after-free if the map
+      only consists of one item.  CID 66394.
+    - 36_CVE-2015-1031-CID66376: pcrs_execute(): Consistently set *result to
+      NULL in case of errors.  Should make use-after-free in the caller less
+      likely.  CID 66391, CID 66376.
+    - 38_CVE-2015-1381: multiple segmentation faults and memory leaks in the
+      pcrs code.
+    - 39_CVE-2015-1382: invalid read.
+
+ -- Holger Levsen <holger@debian.org>  Wed, 28 Jan 2015 19:44:30 +0100
+
+privoxy (3.0.16-1) unstable; urgency=low
+
+  * New upstream version 3.0.16-stable.
+  * Adapt all patches to the new version.
+  * 30_localhost_fixup: removed, since this should no longer be necessary.
+  * 31_handle-as-empty-doc-returns-ok: now included upstream.
+  * 32_bind_fixup: Work around bind problems on startup (Closes: #534735).
+
+ -- Roland Rosenfeld <roland@debian.org>  Tue, 18 May 2010 10:14:18 +0200
+
+privoxy (3.0.15-3) unstable; urgency=low
+
+  * Add Build-Dependency on docbook because docbook-xml which may be
+    chained via docbook-dsssl as an alternative to docbook may not be
+    enough on a unclean build environment. This should now also build on
+    the mips buildd.
+  * 31_handle-as-empty-doc-returns-ok: Patch from SourceForge that work2
+    around Firefox bug to wait forever if proxy returns a failure status
+    code in response to the CONNECT (Closes: #561126).
+
+ -- Roland Rosenfeld <roland@debian.org>  Fri, 25 Dec 2009 11:30:29 +0100
+
+privoxy (3.0.15-2) unstable; urgency=low
+
+  * 30_localhost_fixup: Remove workaround for "localhost" listen-address,
+    which should solve all problems with privoxy not starting. 
+    (Closes: #534735).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 13 Dec 2009 10:09:11 +0100
+
+privoxy (3.0.15-1) unstable; urgency=low
+
+  * New upstream version 3.0.15-beta.
+  * Adapted all patches to the new upstream version.
+  * Added debian/README.source (from dpatch package) to explain how dpatch
+    works.
+  * Upgrade to Standards-Version 3.8.3 (no changes).
+  * 29_typos: fix some common typos.
+
+ -- Roland Rosenfeld <roland@debian.org>  Sat, 14 Nov 2009 14:22:31 +0100
+
+privoxy (3.0.14-1) unstable; urgency=low
+
+  * New upstream version 3.0.14-beta.
+  * Adapted all patches to the new upstream version.
+  * --enable-no-gifs (uses PNG instead of GIF in replacement files).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 26 Jul 2009 12:06:00 +0200
+
+privoxy (3.0.13-1) unstable; urgency=low
+
+  * New upstream version 3.0.13-beta.
+  * Adapted all patches to the new upstream version.
+  * Removed 03_ipv6, because IPv6 is now supported upstream.
+  * Upgrade to Standards-Version 3.8.1 (no changes)
+  * Fix matcha-all.action typo in debian/postinst (Closes: #534270).
+
+ -- Roland Rosenfeld <roland@debian.org>  Tue, 23 Jun 2009 15:09:08 +0200
+
+privoxy (3.0.12-2) unstable; urgency=low
+
+  * 03_ipv6: Use s6_addr instead of in6_u, which is not portable.
+
+ -- Roland Rosenfeld <roland@debian.org>  Wed, 25 Mar 2009 21:41:20 +0100
+
+privoxy (3.0.12-1) unstable; urgency=low
+
+  * New upstream version 3.0.12-stable.
+  * Adapt all patches to new upstream version.
+  * Remove 30_quiet_start, because this is provided upstream now.
+
+ -- Roland Rosenfeld <roland@debian.org>  Wed, 25 Mar 2009 13:27:30 +0100
+
+privoxy (3.0.11-1) unstable; urgency=low
+
+  * New upstream version 3.0.11-stable.
+  * 19_manpage_fixup incorporated upstream now.
+  * 24_global_action is incorporated upstream in a similar way.
+  * postinst: try to make removal of standards.action and global.action
+    and new file match-all.action smooth to a user who does not want to
+    modify his config file.
+  * 30_quiet_start: Suppress INFO log messages on stderr at program startup.
+  * Stop redirecting stderr to errorlog file but print all config file
+    errors to stderr at startup.  This closes the stderr filehandle since
+    upstream fixed the behavior in jcc.c 1.153.
+    This also solves the problem, that syntax errors in config file
+    weren't noticed, cause they are written to the console on start now
+    (Closes: #375174)
+  * Modify init.d script to be more lsb compliant.
+    Depends on lsb-base (>= 3.2-13) 
+  * Allow disabling privoxy via RUN_DAEMON=no in /etc/default/privoxy.
+    (Closes: #482563).
+  * Update README.Debian to fit all changes.
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 22 Feb 2009 22:07:08 +0100
+
+privoxy (3.0.10-2) unstable; urgency=low
+
+  * IPv6 patch added again: 03_ipv6: privoxy-3.0.10-ipv6-all-6.diff by
+    Petr PÃ­saÅ™ (Closes: #179461).
+    It seems that the old bugs #391600 and #393605, which appeared with 
+    the previous version, are fixed now.
+  * 28_listen_localhost: Listen on localhost:8118 instead of 127.0.0.1:8118,
+    because this is independent from localhost IP (127.0.0.1 vs. 127.0.1.1)
+    and also supports IPv6 (Closes: #512888).
+  * 05_default_action: unblock qa.debian.org/popcon-graph.php (Closes: #479525)
+  * Create log dir in init script, if it does not exist (Closes: #491423).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 15 Feb 2009 13:39:10 +0100
+
+privoxy (3.0.10-1) UNRELEASED; urgency=low
+
+  * Not released to Debian but only on sourceforge.net.
+  * New upstream version 3.0.10-stable (Closes: #499324).
+  * Install privoxy-log-parser into /usr/bin.
+  * Add lintian-override for libtool warnings according pcre, because we
+    do not use this version of pcre but the one from libpcre3-dev.
+
+ -- Roland Rosenfeld <roland@debian.org>  Sat, 20 Sep 2008 17:33:30 +0200
+
+privoxy (3.0.9-1) unstable; urgency=low
+
+  * New upstream version 3.0.9-beta.
+  * Upgrade all patches to new version:
+    - 20_makefile_fixup included upstream.
+  * The new version doesn't support PDF documentation any more, so remove
+    it from the Debian package.
+    -> Stop Build-Depending on htmldoc.
+  * The new version doesn't support text/plain documentation any more, so
+    remove it from the Debian package.
+  * Upgrade to Standards-Version 3.8.0 (no changes)
+  * Move documentation from doc-base section Apps/Net to Network/Web Browsing.
+  * chown user:group instead of user.group in postinst to be more compatible.
+  * 05_defaut_action: unblock qa.debian.org/popcon.php (Closes: #479525).
+
+ -- Roland Rosenfeld <roland@debian.org>  Mon, 07 Jul 2008 22:35:17 +0200
+
+privoxy (3.0.8-1) unstable; urgency=low
+
+  * New upstream release 3.0.8-stable.
+  * Upgrade all patches to new version.
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 20 Jan 2008 22:19:02 +0100
+
+privoxy (3.0.7-2) unstable; urgency=low
+
+  * Remove trailing space from debian/patches/00list to make lintian happy.
+  * postinst: On upgrade from 3.0.6 and below the config file format
+    changed: actionsfile now needs filename.action as parameter instead of
+    filename. Fix this config file change in postinst if necessary.
+    (Closes: #456274).
+  * Upgrade to Standards-Version 3.7.3 (no changes).
+  * 19_manpage_fixup: Replace "Ã¶" by "\[:o]" in privoxy.8.
+
+ -- Roland Rosenfeld <roland@debian.org>  Sat, 12 Jan 2008 16:02:14 +0100
+
+privoxy (3.0.7-1) unstable; urgency=low
+
+  * New upstream version 3.0.7-beta.
+  * Adapt all patches to new version.
+  * Enable new zlib feature (Closes: #368448):
+    - build-depend on zlib1g-dev
+    - disable prevent-compression in 25_standard_medium.dpatch
+  * Remove 28_pcre_returncode.dpatch, which is now applied upstream.
+  * Remove 23_fix_faq_id.dpatch, which is now applied upstream.
+  * Fix Homepage header in control file.
+  * 05_defaut_action: disable filter{js-annoyances} for
+    http://www.memo.de/ (Closes: #441256).
+  * Update debian/watch file based on an idea of Raphael Geissert.
+    (Closes: #449643)
+
+ -- Roland Rosenfeld <roland@debian.org>  Tue, 11 Dec 2007 19:34:35 +0100
+
+privoxy (3.0.6-4) unstable; urgency=low
+
+  * Set "enable-remote-http-toggle 0" by default because otherwise
+    requests may be able to bypass filtering by setting "X-Filter: No"
+    headers using some strange javascript code.
+  * Disable default logging of every GET/POST/CONNECT request to protect
+    your privacy a bit more.
+  * 05_defaut_action: Stop blocking Andorra ccTLD (.ad) (Closes: #445461).
+  * Run make clean/distclean only if GNUmakefile exists in debian/rules.
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 21 Oct 2007 12:47:51 +0200
+
+privoxy (3.0.6-3) unstable; urgency=low
+
+  * According to http://wiki.debian.org/AccountHandlingInMaintainerScripts
+    removing system users in postrm isn't a good idea. So the removal of
+    user privoxy in postrm was disabled and deluser/adduser of existing
+    user in postinst was also removed. This should avoid problems with
+    purging privoxy if passwd package isn't installed (Closes: #417015).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sat, 19 May 2007 21:22:42 +0200
+
+privoxy (3.0.6-2) unstable; urgency=medium
+
+  * 28_pcre_returncode: Don't crash if pcre returns an error code that
+    pcrs didn't expect (Closes: #404284).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sat, 23 Dec 2006 21:47:12 +0100
+
+privoxy (3.0.6-1) unstable; urgency=low
+
+  * New upstream release 3.0.6.
+    - remove 28_usermanual_slash.dpatch, which is already included
+      upstream now.
+  * README.Debian: mention that privoxy has to be used as HTTP proxy to
+    access http://p.p/ URLs (Closes: #398162).
+
+ -- Roland Rosenfeld <roland@debian.org>  Mon, 20 Nov 2006 19:29:27 +0100
+
+privoxy (3.0.5-beta-3) unstable; urgency=medium
+
+  * Disable the IPv6 patch, because this is seems to have too many bugs
+    for a release right now.  
+    - This reopens #179461.
+    - This solves the problem, that "listen-address :8118" listens on
+      localhost only (Closes: #391600).
+    - This solves the problem, that regex pattern at front of hostname
+      is ignored (Closes: #393605). 
+  * Use /usr/share/dpatch/dpatch.make in debian/rules instead of adding
+    the content by hand.
+  * Extended version of 26_edit_only_writable.dpatch by Fabian Keil.  Now
+    shows a message, that the file is write protected.  See SF#1564026.
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 22 Oct 2006 11:53:02 +0200
+
+privoxy (3.0.5-beta-2) unstable; urgency=low
+
+  * 27_remove_nsl.dpatch: Remove unnecessary linking against libnsl.
+  * 28_usermanual_slash.dpatch: Redirect http://p.p/user-manual (without
+    trailing slash) to http://p.p/user-manual/ (with trailing slash),
+    otherwise the links will be broken (Closes: #244931).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sat,  7 Oct 2006 13:12:13 +0200
+
+privoxy (3.0.5-beta-1) unstable; urgency=low
+
+  * New upstream version 3.0.5-beta.
+  * hide-referrer{foo} now allows everything as a forged referrer not 
+    only http/https URLs and ignoring invalid URLs (Closes: #258193).  
+  * Fixes the name of the filter from "popups" to "all-popups" in
+    user.action. (Closes: #385886).
+  * Block http://www.google-analytics.com/urchin.js because this is used
+    for cross site user tracking according to
+    http://www.google.com/analytics/ (Closes: #340913).
+  * Adapted all patches to this version.
+  * The following patches are incorporated upstream now, so they are no
+    longer needed: 01_local_usermanual.dpatch, 04_nomultiproxy.dpatch,
+    07_typos.dpatch, 08_log_pthread.dpatch, 09_no_identity.dpatch,
+    12_multiple-filters.dpatch, 13_memory.dpatch, 18_dns_retry.dpatch.
+  * 20_makefile_fixup.dpatch: Fix a syntax error in the GNUmakefile.in.
+  * 05_default_action.dpatch: main parts are incorporated upstream now.
+  * 05_default_action.dpatch: disable filter ie-eploits for amazon.de,
+    cause they use %01 and %02 as delimiters for multipage results
+    (Closes: #243245).
+  * 03_ipv6.dpatch: Add IPv6 support (Closes: #179461).
+  * 23_fix_faq_id.dpatch: Fix value of id attribute in <sect2> tag (no
+    underscore allowed) of faq.sgml.
+  * 24_global_action.dpatch: Move the global default for all pages (/)
+    from default.action to global.action to make updates with local
+    configurations easier.
+  * 25_standard_medium.dpatch: Change the global default from
+    standard.Cautious to standard.Medium, which is similar to the old
+    3.0.3 behavior and doesn't change too much (only
+    filter{js-annoyances}, filter{html-annoyances} and
+    filter{unsolicited-popups} are switched off now additionally because
+    they often cause trouble by using very much CPU time).
+  * 26_edit_only_writable.dpatch: Hide the edit button on
+    http://p.p/show-status if action file can not be written by the
+    privoxy user.
+  * default.action and standard.action are no longer owned by privoxy but
+    by root to show that these files are maintained upstream while users
+    should maintain their local changes in global.action and user.action.
+  * Add LSB compliance to init.d script (INIT INFO and status).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sat, 23 Sep 2006 23:37:03 +0200
+
+privoxy (3.0.3-2-2) unstable; urgency=low
+
+  * Upgrade to Standards-Version 3.7.2 (no changes).
+  * 17_502_no_such_domain.dpatch: Changes the 404 HTTP status code of the
+    "No such Domain" template to 502 Bad Gateway, which seems to be more
+    correct according to http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
+    (Closes: #380389).
+  * Disable filter{js-annoyances} and filter{unsolicited-popups} for
+    .cnrs.fr and blogs.msdn.com, because these sites consume very much CPU
+    time otherwise (Closes: #377843).
+  * 18_dns_retry.dpatch by Fabian Keil <fk@fabiankeil.de>: 10 retries
+    before giving up DNS lookup. This hopefully Closes: #335660.
+  * 19_manpage_fixup.dpatch:
+    - Convert Latin-1 char Ã¡ to groff equivalent in man page.
+    - Quote minus signs to differentiate them from hyphens.
+  * Do not filter{banners-by-size} on .w3.org pages, because these often
+    contain validator icons (Closes: #319025).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sat,  5 Aug 2006 15:15:17 +0200
+
+privoxy (3.0.3-2-1) unstable; urgency=low
+
+  * New upstream version 3.0.3-2.
+  * Add debian/watch file.
+  * Remove parts of 13_memory.dpatch, which seems to free too much
+    memory (Closes: #353110, #354611).
+
+ -- Roland Rosenfeld <roland@debian.org>  Mon, 27 Feb 2006 23:28:52 +0100
+
+privoxy (3.0.3-6) unstable; urgency=low
+
+  * Now hopefully really redirect all output of logrotate to /dev/null
+    (Closes: #314868).
+  * Migrate all patches to dpatch mechanism.
+  * Upgrade to debhelper 5.
+  * Call htmldoc with parameter --no-embedfonts to keep PDF files small.
+  * Build-Depends on htmldoc (>= 1.8.25-1), because older versions caused
+    broken PDF documentation on 64bit systems.
+  * Fix some typos in user-manual.
+  * Add multiple filter file support (from CVS) (Closes: #201177).
+  * Fix some memory leaks, mallocs, double frees (from CVS).
+  * Remove CVS $-tags from config files to make it easier for users to
+    keep the configuration in a VCS (Closes: #350799).
+  * Remove trailing spaces from all config files now.
+  * Build man page (and HTML version of it) at build time.
+
+ -- Roland Rosenfeld <roland@debian.org>  Sat, 11 Feb 2006 21:27:14 +0100
+
+privoxy (3.0.3-5) unstable; urgency=low
+
+  * Redirect output of restart script in logrotate to /dev/null
+    (Closes: #314868).
+  * Upgrade to Standards-Version 3.6.2:
+    - Recommends: doc-base
+  * Build-Depends on autotools-dev and copy config.guess and config.sub
+    from there on every build (Closes: #332767).
+  * After dechunking remove the "chunked"-header instead of replacing it
+    by an d"identity" header. Thanks to Michael Shields for reporting this
+    (Closes: #318683).
+  * Update address of FSF in copyright file.
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun,  9 Oct 2005 13:44:55 +0200
+
+privoxy (3.0.3-4) unstable; urgency=low
+
+  * Stop converting entities to 8bit chars in the documentation 
+    (Closes: #203697).
+  * Fix typos ('persistant' and 'Januar') in man page and man page sources
+    (Closes: #302145).
+  * Restart privoxy in logrotate script instead of sendig a kill -HUP, to
+    triggering reopen of log files (Closes: #285059).
+  * Apply patch by Jindrich Makovicka to fix race conditions in log
+    writing functions (Closes: #299662).
+  * Stop hiding referrer for www.petitiononline.com/mod_perl/signed.cgi,
+    because this site does not work otherwise (Closes: #250407).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 15 May 2005 15:28:56 +0200
+
+privoxy (3.0.3-3) unstable; urgency=low
+
+  * Now really remove multiproxy.org from all documentation, not only from
+    the config file (Closes: #198953). 
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 15 Feb 2004 23:11:29 +0100
+
+privoxy (3.0.3-2) unstable; urgency=low
+
+  * no banners-by-side on "/valid-" images, because that's usually from
+    validator.w3.org (Closes: #221009).
+  * Upgrade to Standards-Version 3.6.1 (no changes).
+  * Add Homepage URL to the package description.
+  * If the privoxy user is already existing as a non-system user in
+    postinst, this no longer fails, but deletes the non-system user before
+    adding it again as a system user (Closes: #232724).
+  * Use deluser instead of userdel in postrm.
+  * Redirect stderr of privoxy to /var/log/privoxy/errfile to avoid
+    problems with kept open file descriptors (Closes: #200712).
+  * Remove comment from config file, which points to list of open proxies
+    at multiproxy.org (Closes: #198953).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 15 Feb 2004 15:13:27 +0100
+
+privoxy (3.0.3-1) unstable; urgency=low
+
+  * New upstream version 3.0.3.
+    - This introduces workarounds for server (PHP <4.2.3) bugs including
+      the "blank page" problem (Closes: #215231).
+    - Avoid the conversion of "open" in scripts to "PrivoxyWindowOpen"
+      (Closes: #197995). 
+    - "advocancy" is no longer blocked (Closes: #202042).
+    - Fixed yet another two memory leaks (Closes: #215911).
+  * Stop backup of pdf directory, because it is no longer contained in the
+    upstream package.
+  * Create doc/pdf, which is missing upstream.
+  * disable filter{unsolicited-popups} for www.perl.com/language/newdocs/pod/ 
+    to avoid problems with "PrivoxyWindowOpen" in Perl manuals
+    (Closes: #195311).
+  * Apply patch make privoxy compilable on woody where htmldoc --version
+    doesn't exist (Closes: #216524).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sat, 31 Jan 2004 11:25:53 +0100
+
+privoxy (3.0.2-5) unstable; urgency=low
+
+  * Merge corrections from upstream default.action 1.7.
+    - demoronizer filter (which caused trouble on non latin1 charsets) is
+      now switched off by default (Closes: #202234).
+
+ -- Roland Rosenfeld <roland@debian.org>  Tue,  9 Sep 2003 21:31:51 +0200
+
+privoxy (3.0.2-4) unstable; urgency=low
+
+  * Add a versioned build dependency on htmldoc (>= 1.8.20), because there
+    seem to be some options mission in the old 1.8.17 (Closes: #192457).
+  * Merge rotation of logfile and jarfile in logrotate script.
+  * Test whether /var/run/privoxy.pid is existing and don't bother when no
+    privoxy is running in logrotate script (Closes: #191838).
+  * Remove /var/run/privoxy.pid on privoxy stop in init.d script.
+  * Mention apt-get instead of dpkg in user-manual (Closes: #189239).
+  * Remove trailing whitespace from text versions of user-manual,
+    developer-manual and faq (Closes: #192566).
+
+ -- Roland Rosenfeld <roland@debian.org>  Fri,  9 May 2003 08:21:30 +0200
+
+privoxy (3.0.2-3) unstable; urgency=low
+
+  * Stop filtering favicon.ico, which may cause trouble (Closes: #188947).
+  * Send SIGHUP to privoxy instead of touching /etc/provoxy/config in
+    logrotate script to tell privoxy that the logfiles were rotated
+    (Closes: #189240).
+  * Remove trailing spaces from config file (Closes: #189240).
+  * Install man page as privoxy(8) instead of privoxy(1), because this is
+    a system binary.
+  * Build HTML, text, and PDF versions of the documentation from source.
+  * Fix setting of dodk in configure.in.
+  * Add option "--linkcolor #0000ff" to htmldoc call in ldp_print to be
+    independent of ~/.htmldocrc color setting.
+  * Mention PDF and text version of the documentation in doc-base files.
+  * Install PDF version of the documentation, too.
+  * Install HTML version of the man page, too.
+
+ -- Roland Rosenfeld <roland@debian.org>  Mon, 21 Apr 2003 11:11:31 +0200
+
+privoxy (3.0.2-2) unstable; urgency=low
+
+  * Don't apply any filters to {bugs|lists}.debian.org (Closes: #186537).
+  * Prepend "http://config.privoxy.org" before "/user-manual/" to always
+    get a correct URL for the local user-manual (also on 404 error pages).
+    (Closes SF-719724).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 13 Apr 2003 12:49:15 +0200
+
+privoxy (3.0.2-1) unstable; urgency=low
+
+  * New upstream version 3.0.2.
+  * Update Standards-Version to 3.5.9 (no changes).
+
+ -- Roland Rosenfeld <roland@debian.org>  Wed, 26 Mar 2003 19:45:07 +0100
+
+privoxy (3.0.0-6) unstable; urgency=low
+
+  * Fixed a bug in local user-manual patch, which failed when accessing
+    http://config.privoxy.org/user-manual/ (without a file name).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun,  2 Mar 2003 13:40:48 +0100
+
+privoxy (3.0.0-5) unstable; urgency=low
+
+  * Stop build-depending on special versions of libc6-dev and gcc.
+    Hopefully all auto-builders run new versions which shouldn't cause
+    trouble (Closes: #182267)  
+
+ -- Roland Rosenfeld <roland@debian.org>  Mon, 24 Feb 2003 19:07:11 +0100
+
+privoxy (3.0.0-4) unstable; urgency=low
+
+  * Set "enable-edit-actions 0" and "enable-remote-toggle 0" in config
+    file, instead of simply commenting out these two lines.  Mention this
+    configuration change in README.Debian (Closes: #172965, #172966).
+  * Add new "cgi" user-manual, which sends the user manual to the client
+    and activate it in config file (Closes: #148128).
+  * Build-Depend on libc6-dev (>> 2.2.5) to avoid problems with pthread
+    (Closes: #158306, #162693).
+  * Don't search for user bsmtp in /etc/passwd before using adduser.
+    adduser handles already existing users correct.
+  * Remove /etc/provoxy on purge (Closes: #164039).
+  * Upgrade to Standards-Version 3.5.8:
+    - remove support for DEB_BUILD_OPTION "debug"
+    - add support for DEB_BUILD_OPTION "noopt"
+  * Upgrade to debhelper >=4 and use debian/compat instead of DH_COMPAT.
+  * Upgrade config.guess and config.sub (from autotools-dev 20030110.1).
+  * Remove no-pthread workaround for hppa and build-depend on gcc >=3.2.2,
+    which supports -pthread on hppa, too.
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 23 Feb 2003 13:34:11 +0100
+
+privoxy (3.0.0-3) unstable; urgency=low
+
+  * Add aliases "wafer" and "vanilla-wafer" for "send-wafer" and
+    "send-vanilla-wafer" to actionlist to provide backward compatibility
+    to 2.9.14 (Closes: #154647).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun,  8 Sep 2002 11:43:38 +0200
+
+privoxy (3.0.0-2) unstable; urgency=low
+
+  * Recompile with libc6 from testing (instead of unstable).
+
+ -- Roland Rosenfeld <roland@debian.org>  Fri,  6 Sep 2002 17:32:35 +0200
+
+privoxy (3.0.0-1) unstable; urgency=low
+
+  * New upstream version (Closes: #158613).
+  * Remove version number from config file, to avoid changing it on every
+    new upstream version.  Sorry, this time you will still be bothered...
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun,  1 Sep 2002 18:58:07 +0200
+
+privoxy (2.9.20-1) unstable; urgency=low
+
+  * New upstream version.
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 11 Aug 2002 11:05:01 +0200
+
+privoxy (2.9.18-2) unstable; urgency=low
+
+  * Disable docbook, we use the precompiled docs (Closes: #155989).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sat, 10 Aug 2002 09:36:58 +0200
+
+privoxy (2.9.18-1) unstable; urgency=low
+
+  * New upstream version.
+  * Use start-stop-daemon for starting privoxy to avoid problems on start,
+    when privoxy is already running (Closes: #154882).
+  * Undo broken -Ipcre inclusion in GNUmakefile.in, which causes trouble
+    with using wrong pcreposix.h.
+
+ -- Roland Rosenfeld <roland@debian.org>  Thu,  8 Aug 2002 21:01:48 +0200
+
+privoxy (2.9.16-1) unstable; urgency=low
+
+  * New upstream version.
+  * Exclude CVS files from dh_installdocs (when compiling from CVS).
+  * Add user.action and standard.action to /etc/privoxy.
+  * Install images for html version of documentation.
+  * Do no longer build html and txt versions of documentation using
+    docbook, but use the converted versions which come with the upstream
+    package.
+  * default.action fixed upstream: "downloads" no longer blocked 
+    (Closes: #148290).
+  * default.filter fixed upstream: Made WeBugs job ungreedy (Closes: #149450).
+  * Remove the "beta" from the version number (the final release will be
+    named 3.0, so it's superfluous).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sat, 27 Jul 2002 18:55:11 +0200
+
+privoxy (2.9.14-beta-4) unstable; urgency=low
+
+  * Damn, why did I write "i386-linux" into the rules file, when I try to
+    write a work around for hppa?  Fixed now (Closes: #148227).
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 26 May 2002 22:33:26 +0200
+
+privoxy (2.9.14-beta-3) unstable; urgency=low
+
+  * Fix typo ('[' instead of '{') in default.action (Closes: #148122).
+  * Disable edit-actions and remote-toggle in config file by default
+    (Closes: #148125).
+  * Use --disable-pthread on hppa, to avoid problem with hppa gcc not
+    supporting -pthread option (Closes: #148117).
+  * Install p_doc.css in documentation directory.
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 26 May 2002 01:40:18 +0200
+
+privoxy (2.9.14-beta-2) unstable; urgency=low
+
+  * Fix debian/rules clean to really clean.
+  * Change owner of /etc/privoxy/{*.action|trust} to privoxy in postinst,
+    to allow modification of these files web interface (Closes: SF-552144).
+
+ -- Roland Rosenfeld <roland@debian.org>  Thu, 23 May 2002 18:38:27 +0200
+
+privoxy (2.9.14-beta-1) unstable; urgency=low
+
+  * New upstream version.
+
+ -- Roland Rosenfeld <roland@debian.org>  Sat, 13 Apr 2002 18:05:26 +0200
+
+privoxy (2.9.13-beta-2) unstable; urgency=low
+
+  * Create HTML and ASCII versions of the documentation using docbook now.
+
+ -- Roland Rosenfeld <roland@debian.org>  Sun, 31 Mar 2002 23:53:28 +0200
+
+privoxy (2.9.13-beta-1) unstable; urgency=low
+
+  * Initial Release.
+
+ -- Roland Rosenfeld <roland@debian.org>  Fri, 29 Mar 2002 11:52:03 +0100
+
--- privoxy-3.0.16.orig/debian/dirs
+++ privoxy-3.0.16/debian/dirs
@@ -0,0 +1,6 @@
+etc/privoxy
+usr/bin
+usr/sbin
+usr/share/doc/privoxy
+var/log/privoxy
+usr/share/man/man1
--- privoxy-3.0.16.orig/debian/doc-base.faq
+++ privoxy-3.0.16/debian/doc-base.faq
@@ -0,0 +1,11 @@
+Document: privoxy-faq
+Title: Privoxy Frequently Asked Questions
+Author: Privoxy Developers
+Abstract: The FAQ document gives users and developers alike answers to
+ frequently asked questions about Privoxy.  Privoxy is a filtering web
+ proxy.
+Section: Network/Web Browsing
+
+Format: HTML
+Index: /usr/share/doc/privoxy/faq/index.html
+Files: /usr/share/doc/privoxy/faq/*.html
--- privoxy-3.0.16.orig/debian/postrm
+++ privoxy-3.0.16/debian/postrm
@@ -0,0 +1,41 @@
+#! /bin/sh
+# postrm script for privoxy
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    purge)
+        # deluser --quiet privoxy
+        rm -rf /var/log/privoxy /etc/privoxy
+        ;;
+
+    remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+        ;;
+
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- privoxy-3.0.16.orig/debian/README.Debian
+++ privoxy-3.0.16/debian/README.Debian
@@ -0,0 +1,47 @@
+privoxy for Debian
+==================
+
+- enable-edit-actions, enable-remote-toggle, and
+  enable-remote-http-toggle are disabled in the Debian package for
+  security reasons, because these options allow every user of your
+  privoxy to change its configuration.  Except this there exist
+  exploits using Java and/or JavaScript that tell your browser to send
+  out requests for disabling the proxy or the filtering, which may
+  compromise your anonymity.  If you still want to use these features,
+  you can enable them in /etc/privoxy/config and do a
+  "/etc/init.d/privoxy restart".
+
+- Experimental IPv6 support was added to the package.
+
+- The global default for all URLs (/) is now set in match-all.action
+  in contrast to versions up to 3.0.10, where a Debian only patch
+  configured them in global.action.
+
+- Since 3.0.5 the upstream package uses the Cautious default settings
+  instead of Medium (like 3.0.3 did).  To avoid problems on upgrades
+  of old packages, the Debian package still uses the Medium settings.
+  You can find the different profiles in /etc/privoxy/default.action.
+  To change the default, go to http://p.p/edit-actions-list?f=match-all
+  (this can also be reached from http://p.p/show-status via the
+  match-all.action edit link.  p.p is a privoxy internal address, so you
+  need to use privoxy as your HTTP proxy before you can access these
+  URLs) and modify the default to your needs.  You can either set one
+  of the standard profiles (Cautious, Medium, or Advanced) or change
+  every single setting using the "Edit" button.  It is necessary to
+  set "enable-edit-actions 1" (see above) in /etc/privoxy/config to
+  use the web interface.  Alternatively you can modify
+  /etc/privoxy/match-all.action by hand.  The other templates are
+  available in /etc/privoxy/default.action (search for lines starting
+  with "standard.".
+
+- /etc/privoxy/default.action is now owned by root, so you can not
+  modify it via http://p.p/edit-actions-list?f=default any longer
+  (assumed that you set "enable-edit-action 1" above).  You should
+  realize your local adaptions in /etc/privoxy/match-all.action and
+  /etc/privoxy/user.action, so default.action can be easily upgraded
+  by new package versions.  If you do not like this change, feel free
+  to change the owner of default.action to "privoxy" and the file is
+  editable again.
+
+Roland Rosenfeld <roland@debian.org>
+$Id: README.Debian,v 1.8 2009-02-22 21:07:20 roland Exp $
--- privoxy-3.0.16.orig/debian/README.source
+++ privoxy-3.0.16/debian/README.source
@@ -0,0 +1,31 @@
+This package uses dpatch to manage all modifications to the upstream
+source. Changes are stored in the source package as diffs in
+debian/patches and applied during the build.
+
+To get the fully patched source after unpacking the source package, cd
+to the root level of the source package and run:
+
+    debian/rules patch
+
+Removing a patch is as simple as removing its entry from the
+debian/patches/00list file, and please also remove the patch file
+itself.
+
+Creating a new patch is done with "dpatch-edit-patch patch XX_patchname"
+where you should replace XX with a new number and patchname with a
+descriptive shortname of the patch. You can then simply edit all the
+files your patch wants to edit, and then simply "exit 0" from the shell
+to actually create the patch file.
+
+To tweak an already existing patch, call "dpatch-edit-patch XX_patchname"
+and replace XX_patchname with the actual filename from debian/patches
+you want to use.
+
+To clean up afterwards again, "debian/rules unpatch" will do the
+work for you - or you can of course choose to call
+"fakeroot debian/rules clean" all together.
+
+--- 
+
+original text by Gerfried Fuchs, edited by Junichi Uekawa <dancer@debian.org>
+10 Aug 2008.
--- privoxy-3.0.16.orig/debian/postinst
+++ privoxy-3.0.16/debian/postinst
@@ -0,0 +1,104 @@
+#! /bin/sh
+# postinst script for privoxy
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+#
+# quoting from the policy:
+#     Any necessary prompting should almost always be confined to the
+#     post-installation script, and should be protected with a conditional
+#     so that unnecessary prompting doesn't happen if a package's
+#     installation fails and the `postinst' is called with `abort-upgrade',
+#     `abort-remove' or `abort-deconfigure'.
+
+CONFDIR=/etc/privoxy
+CONFIG=$CONFDIR/config
+
+case "$1" in
+    configure)
+        adduser --quiet --system --home $CONFDIR --no-create-home \
+	    --ingroup nogroup --disabled-password privoxy
+        chown -R privoxy:adm /var/log/privoxy
+        chmod 750 /var/log/privoxy
+	chown privoxy $CONFDIR/user.action $CONFDIR/trust
+	[ -f $CONFDIR/match-all.action ] \
+	    && chown privoxy $CONFDIR/match-all.action
+
+	if [ "x$2" != "x" ] && dpkg --compare-versions "$2" lt "3.0.4"
+	then
+	    # Upgrading from a 3.0.3* version
+	    chown root $CONFDIR/default.action
+	fi
+
+	if [ "x$2" != "x" ] && dpkg --compare-versions "$2" lt "3.0.7" \
+	    && grep -q '^actionsfile [a-z]*[[:space:]]*#.*$' $CONFIG
+	then
+	    # Upgrading from version before 3.0.7 where the user kept his old 
+	    # (modified) config file:
+	    # Try to change   "actionsfile foo"  to  "actionsfile foo.action"
+	    # as needed in 3.0.7:
+	    sed 's/^actionsfile \([a-z]*\)\([ 	]*\#\)/actionsfile \1.action\2/' \
+		-i.bak $CONFIG
+	fi
+
+	if [ "x$2" != "x" ] && dpkg --compare-versions "$2" lt "3.0.11"
+	then
+	    # Upgrading from a version before 3.0.11
+	    # Try to work around problems with missing action files
+	    if grep -q '^actionsfile.*global.action' $CONFIG
+	    then
+		if [ -e $CONFDIR/global.action ]
+		then
+		    mv $CONFDIR/global.action $CONFDIR/global.action.dpkg-old
+		fi
+		(cd $CONFDIR; ln -s match-all.action global.action)
+	    fi
+	    if grep -q '^actionsfile.*standard.action' $CONFIG
+	    then
+		if [ -e $CONFDIR/standard.action ]
+		then
+		    if ! grep -q migration $CONFDIR/standard.action
+		    then
+			mv $CONFDIR/standard.action \
+			    $CONFDIR/standard.action.dpkg-old
+			echo "# migration file. Not used in 3.0.11 and newer" \
+			    > $CONFDIR/standard.action
+		    fi
+		else
+		    echo "# migration file. Not used in 3.0.11 and newer" \
+			> $CONFDIR/standard.action
+		fi
+	    fi
+	fi
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
+
+
--- privoxy-3.0.16.orig/debian/logrotate
+++ privoxy-3.0.16/debian/logrotate
@@ -0,0 +1,17 @@
+/var/log/privoxy/logfile /var/log/privoxy/jarfile /var/log/privoxy/errorfile {
+	create 0640 privoxy adm
+	missingok
+	weekly
+	rotate 7
+	compress
+	sharedscripts
+	postrotate
+	        if [ -x /usr/sbin/invoke-rc.d ]; then
+        	        invoke-rc.d privoxy restart > /dev/null
+	        else
+			if [ -f /var/run/privoxy.pid ]; then
+	        	        /etc/init.d/privoxy restart > /dev/null
+			fi
+	        fi
+	endscript
+}
--- privoxy-3.0.16.orig/debian/manpages
+++ privoxy-3.0.16/debian/manpages
@@ -0,0 +1 @@
+privoxy.8
--- privoxy-3.0.16.orig/debian/source.lintian-overrides
+++ privoxy-3.0.16/debian/source.lintian-overrides
@@ -0,0 +1,4 @@
+# we don't use the local pcre source but use the ones from libpcre3-dev,
+# so we can ignore the warnings about old libtool versions:
+privoxy source: ancient-libtool pcre/ltconfig
+privoxy source: ancient-libtool pcre/ltmain.sh 1.3.4
--- privoxy-3.0.16.orig/debian/rules
+++ privoxy-3.0.16/debian/rules
@@ -0,0 +1,139 @@
+#!/usr/bin/make -f
+#
+# (C) 2002-2008 Roland Rosenfeld <roland@debian.org>, based on
+# Sample debian/rules that uses debhelper.
+# This file is public domain software, originally written by Joey Hess. 
+
+# Uncomment this to turn on verbose mode.
+#export DH_VERBOSE=1
+
+# These are used for cross-compiling and for saving the configure script
+# from having to guess our platform (since we know it already)
+DEB_HOST_GNU_TYPE   ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
+DEB_BUILD_GNU_TYPE  ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
+
+DEBDIR=`pwd`/debian/privoxy
+
+# Include dpatch stuff.
+include /usr/share/dpatch/dpatch.make
+
+OPTIMIZE=
+ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
+        OPTIMIZE=-O0
+else
+        OPTIMIZE=-O2
+endif
+
+build: build-stamp
+build-stamp: patch-stamp
+	dh_testdir
+
+	autoheader
+	autoconf
+	env CFLAGS="$(OPTIMIZE) -g" \
+		./configure --prefix=/usr --sysconfdir=/etc \
+		--mandir=/usr/share/man	$(WITHDEBUG) \
+		--enable-zlib --enable-no-gifs \
+		--with-docbook=/usr/share/sgml/docbook/stylesheet/dsssl/modular
+	$(MAKE)
+	$(MAKE) dok
+	env -u LANG $(MAKE) man
+	$(MAKE) man2html
+
+	touch build-stamp
+
+clean: clean1 unpatch
+clean1:
+	dh_testdir
+	dh_testroot
+	rm -f build-stamp configure-stamp
+
+	[ ! -f GNUmakefile ] || $(MAKE) clean
+	[ ! -f GNUmakefile ] || $(MAKE) distclean
+	rm -f configure config.h GNUmakefile
+	rm -f privoxy.8
+
+	rm -rf obj
+	rm -f ActivityConsole.jar
+	rm -f src/java/org/privoxy/activityconsole/*.class
+
+	rm -f doc/source/ldp.dsl
+	rm -rf doc/source/temp
+
+	dh_clean -Xrc.privoxy.orig
+
+install: build-stamp
+	dh_testdir
+	dh_testroot
+	dh_clean -k -Xrc.privoxy.orig
+	dh_installdirs
+
+	install -m 0755 privoxy $(DEBDIR)/usr/sbin/privoxy
+
+	install -m 644 config $(DEBDIR)/etc/privoxy/config
+	install -m 0644 default.action $(DEBDIR)/etc/privoxy/default.action
+	install -m 0644 match-all.action $(DEBDIR)/etc/privoxy/match-all.action
+	install -m 0644 user.action $(DEBDIR)/etc/privoxy/user.action
+	install -m 0644 default.filter $(DEBDIR)/etc/privoxy/default.filter
+	install -m 0644 trust $(DEBDIR)/etc/privoxy/trust
+
+	install -m 0755 tools/privoxy-log-parser.pl \
+		$(DEBDIR)/usr/bin/privoxy-log-parser
+	pod2man tools/privoxy-log-parser.pl \
+		> $(DEBDIR)/usr/share/man/man1/privoxy-log-parser.1
+
+	cp -r templates $(DEBDIR)/etc/privoxy/
+	rm -f $(DEBDIR)/etc/privoxy/templates/*~
+	rm -rf $(DEBDIR)/etc/privoxy/templates/CVS
+
+#	Remove CVS tags and trailing spaces from config files:
+	find $(DEBDIR)/etc/privoxy -type f \
+	| xargs grep -l '\$$[A-Z][^$$]*:[^$$]*\$$' \
+	| while read f; do \
+	    sed -e 's/\$$\(Id: [^$$]*,v\)[^$$]*\$$/\1/' \
+		-e 's/\$$\(Source: [^$$]*\)\$$/\1/' \
+		-e 's/\$$\(Log: [^$$]*\)\$$/\1/' \
+		-e 's/ *$$//' < $$f > $$f.new; \
+	    mv -f $$f.new $$f; \
+	done
+
+# Build architecture-independent files here.
+binary-indep: build-stamp install
+# We have nothing to do by default.
+
+# Build architecture-dependent files here.
+binary-arch: build-stamp install
+	dh_testdir
+	dh_testroot
+#	dh_installdebconf	
+	dh_installdocs -XCVS
+	(cd $(DEBDIR)/usr/share/doc/privoxy/; \
+	 mv privoxy-index.html index.html)
+	dh_installexamples
+	dh_installmenu
+	dh_installlogrotate
+#	dh_installemacsen
+#	dh_installpam
+#	dh_installmime
+	dh_installinit
+	dh_installcron
+	dh_installman
+	dh_installinfo
+#	dh_undocumented
+	dh_installchangelogs ChangeLog
+	dh_link
+	dh_strip
+	dh_compress
+	dh_fixperms
+#	dh_makeshlibs
+	dh_installdeb
+	dh_perl
+	dh_shlibdeps
+	dh_gencontrol
+	dh_md5sums
+	dh_builddeb
+
+binary: binary-indep binary-arch
+
+.PHONY: build clean binary-indep binary-arch binary install patch unpatch \
+	clean1
--- privoxy-3.0.16.orig/debian/doc-base.developer
+++ privoxy-3.0.16/debian/doc-base.developer
@@ -0,0 +1,12 @@
+Document: privoxy-developer
+Title: Privoxy Developer Manual
+Author: Privoxy Developers
+Abstract: The provoxy developer manual gives the users information on
+ how to help the developer team.  It provides guidance on coding,
+ testing, documentation and other issues.  Privoxy is a filtering web
+ proxy.
+Section: Network/Web Browsing
+
+Format: HTML
+Index: /usr/share/doc/privoxy/developer-manual/index.html
+Files: /usr/share/doc/privoxy/developer-manual/*.html
--- privoxy-3.0.16.orig/debian/compat
+++ privoxy-3.0.16/debian/compat
@@ -0,0 +1 @@
+5
--- privoxy-3.0.16.orig/debian/patches/36_CVE-2015-1031-CID66376.patch
+++ privoxy-3.0.16/debian/patches/36_CVE-2015-1031-CID66376.patch
@@ -0,0 +1,53 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## taken from privoxy 3.0.21-7 by <roland@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Author: Fabian Keil <fk@fabiankeil.de>
+## DP: Description: pcrs_execute(): Consistently set *result to NULL in case of errors
+## DP:  Should make use-after-free in the caller less likely.
+## DP:  CID 66391, CID 66376.
+## DP: Bug-Debian: http://bugs.debian.org/775167
+## DP: Origin: upstream, http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/pcrs.c?r1=1.45&r2=1.46
+
+@DPATCH@
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' privoxy-3.0.16~/pcrs.c privoxy-3.0.16/pcrs.c
+--- privoxy-3.0.16~/pcrs.c
++++ privoxy-3.0.16/pcrs.c
+@@ -725,7 +725,7 @@ int pcrs_execute_list(pcrs_job *joblist, char *subject, size_t subject_length, c
+  *          1  :  job = the pcrs_job to be executed
+  *          2  :  subject = the subject (== original) string
+  *          3  :  subject_length = the subject's length 
+- *          4  :  result = char** for returning  the result 
++ *          4  :  result = char** for returning the result (NULL on error)
+  *          5  :  result_length = size_t* for returning the result's length
+  *
+  * Returns     :  On success, the number of substitutions that were made.
+@@ -747,19 +747,18 @@ int pcrs_execute(pcrs_job *job, const char *subject, size_t subject_length, char
+    char *result_offset;
+ 
+    offset = i = 0;
++   *result = NULL;
+ 
+    /* 
+     * Sanity check & memory allocation
+     */
+    if (job == NULL || job->pattern == NULL || job->substitute == NULL || NULL == subject)
+    {
+-      *result = NULL;
+       return(PCRS_ERR_BADJOB);
+    }
+ 
+    if (NULL == (matches = (pcrs_match *)malloc((size_t)max_matches * sizeof(pcrs_match))))
+    {
+-      *result = NULL;
+       return(PCRS_ERR_NOMEM);
+    }
+    memset(matches, '\0', (size_t)max_matches * sizeof(pcrs_match));
+@@ -806,7 +805,6 @@ int pcrs_execute(pcrs_job *job, const char *subject, size_t subject_length, char
+          if (NULL == (dummy = (pcrs_match *)realloc(matches, (size_t)max_matches * sizeof(pcrs_match))))
+          {
+             free(matches);
+-            *result = NULL;
+             return(PCRS_ERR_NOMEM);
+          }
+          matches = dummy;
--- privoxy-3.0.16.orig/debian/patches/05_defaut_action.dpatch
+++ privoxy-3.0.16/debian/patches/05_defaut_action.dpatch
@@ -0,0 +1,41 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 05_default_action.dpatch by Roland Rosenfeld <roland@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Serveral changes/additons to default.action.
+
+@DPATCH@
+diff -urNad privoxy~/default.action.master privoxy/default.action.master
+--- privoxy~/default.action.master
++++ privoxy/default.action.master
+@@ -1656,7 +1656,7 @@
+ # URL = http://kb.adobe.com/selfservice/viewContent.do?externalId=kb402747&sliceId=1
+ .adobe.com
+ # URL = http://qa.debian.org/popcon.php
+-qa.debian.org/popcon\.php
++qa.debian.org/popcon
+ #MASTER# REMARKS: Support Requests item #2432535 2008-12-16
+ # URL = http://www.mta.info/bandt/traffic/advmain.htm
+ .mta.info/.*advmain.htm$
+@@ -2178,6 +2178,9 @@
+ #MASTER# REMARKS: Exclude per Debian bug report #377843
+ # URL = http://blogs.msdn.com/wga/archive/2006/07/16/667063.aspx
+ blogs.msdn.com
++#MASTER# REMARKS: Exclude per Debian bug report #441256
++#MASTER# PROBLEM-URL: http://www.memo.de/
++www.memo.de
+ 
+ {-filter{unsolicited-popups}}
+ # Sticky Actions = -filter{unsolicited-popups}
+@@ -2228,6 +2231,11 @@
+ {+filter{tiny-textforms}}
+ .sourceforge.net/tracker
+ 
++{-filter{ie-exploits}}
++#MASTER# REMARKS: Allow %01 and %02 in URLs as they are used in Amazon's 
++#MASTER# REMARKS: multi-page results see http://bugs.debian.org/243245
++.amazon.de
++
+ {+downgrade-http-version}
+ #MASTER# COMMENTS: This section not checked 10/17/06 HB
+ #MASTER# REMARKS: This is work-around for CUPS http configuration.
--- privoxy-3.0.16.orig/debian/patches/28_listen_localhost.dpatch
+++ privoxy-3.0.16/debian/patches/28_listen_localhost.dpatch
@@ -0,0 +1,21 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 28_listen_localhost.dpatch by Roland Rosenfeld <roland@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Listen on localhost:8118 instead of 127.0.0.1:8118, because
+## DP: this is independent from localhost IP (127.0.0.1 vs. 127.0.1.1)
+## DP: and also supports IPv6 (Closes: #512888)
+
+@DPATCH@
+diff -urNad privoxy~/config privoxy/config
+--- privoxy~/config
++++ privoxy/config
+@@ -735,7 +735,7 @@
+ #        listen-address [::1]:8118
+ #
+ #
+-listen-address  127.0.0.1:8118
++listen-address  localhost:8118
+ #
+ #
+ #  4.2. toggle
--- privoxy-3.0.16.orig/debian/patches/25_standard_medium.dpatch
+++ privoxy-3.0.16/debian/patches/25_standard_medium.dpatch
@@ -0,0 +1,29 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 25_standard_medium.dpatch by Roland Rosenfeld <roland@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Change the global default from standard.Cautious to
+## DP: standard.Medium, which is similar to the old 3.0.3 behavior and 
+## DP: doesn't change too much.
+
+@DPATCH@
+diff -urNad privoxy~/match-all.action privoxy/match-all.action
+--- privoxy~/match-all.action
++++ privoxy/match-all.action
+@@ -8,7 +8,16 @@
+ #############################################################################
+ { \
+ +change-x-forwarded-for{block} \
+++deanimate-gifs{last} \
+++filter{refresh-tags} \
+++filter{img-reorder} \
+++filter{banners-by-size} \
+++filter{webbugs} \
+++filter{jumping-windows} \
+++filter{ie-exploits} \
+ +hide-from-header{block} \
+++hide-referrer{conditional-block} \
+++session-cookies-only \
+ +set-image-blocker{pattern} \
+ }
+ / # Match all URLs
--- privoxy-3.0.16.orig/debian/patches/17_502_no_such_domain.dpatch
+++ privoxy-3.0.16/debian/patches/17_502_no_such_domain.dpatch
@@ -0,0 +1,30 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 17_502_no_such_domain.dpatch by Roland Rosenfeld <roland@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Changes the 404 HTTP status code of the "No such Domain" template
+## DP: to 502 Bad Gateway, which seems to be more correct according to 
+## DP: http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
+
+@DPATCH@
+diff -urNad privoxy~/templates/no-such-domain privoxy/templates/no-such-domain
+--- privoxy~/templates/no-such-domain
++++ privoxy/templates/no-such-domain
+@@ -79,7 +79,7 @@
+ <html>
+ 
+ <head>
+-  <title>404 - No such Domain (Privoxy@@my-hostname@)</title>
++  <title>502 - Bad Gateway (Privoxy@@my-hostname@)</title>
+   <meta http-equiv="Content-Style-Type" content="text/css">
+   <meta http-equiv="Content-Script-Type" content="text/javascript">
+   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
+@@ -95,7 +95,7 @@
+   <table summary="" cellpadding="20" cellspacing="10" border="0" width="100%">
+     <tr>
+       <td class="status">
+-        404
++        502
+       </td>     
+       <td class="title" style="width: 100%">
+ 
--- privoxy-3.0.16.orig/debian/patches/38_CVE-2015-1381.patch
+++ privoxy-3.0.16/debian/patches/38_CVE-2015-1381.patch
@@ -0,0 +1,60 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## taken from privoxy 3.0.21-7 by <roland@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Author: Fabian Keil <fk@fabiankeil.de>
+## DP: Description: pcrs_compile_replacement(): Fix multiple segfaults and memory
+## DP:  leaks ... and report errors more reliably. Previously some invalid
+## DP:  pcrs commands were silently accepted but didn't work as expected.
+## DP:  Partially discovered with afl-fuzz.
+## DP: Bug-Debian: http://bugs.debian.org/776490
+## DP: Origin: upstream, http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/pcrs.c?r1=1.46&r2=1.47
+
+@DPATCH@
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' privoxy-3.0.16~/pcrs.c privoxy-3.0.16/pcrs.c
+--- privoxy-3.0.16~/pcrs.c
++++ privoxy-3.0.16/pcrs.c
+@@ -319,6 +319,13 @@
+          if (replacement[i] == '$' && !quoted && i < (int)(length - 1))
+          {
+             char *symbol, symbols[] = "'`+&";
++            if (l >= PCRS_MAX_SUBMATCHES)
++            {
++               freez(text);
++               freez(r);
++               *errptr = PCRS_WARN_BADREF;
++               return NULL;
++            }
+             r->block_length[l] = (size_t)(k - r->block_offset[l]);
+ 
+             /* Numerical backreferences */
+@@ -330,7 +337,10 @@
+                }
+                if (r->backref[l] > capturecount)
+                {
++                  freez(text);
++                  freez(r);
+                   *errptr = PCRS_WARN_BADREF;
++                  return NULL;
+                }
+             }
+ 
+@@ -360,14 +370,17 @@
+             }
+ 
+             /* Valid and in range? -> record */
+-            if (r->backref[l] < PCRS_MAX_SUBMATCHES + 2)
++            if (0 <= r->backref[l] && r->backref[l] < PCRS_MAX_SUBMATCHES + 2)
+             {
+                r->backref_count[r->backref[l]] += 1;
+                r->block_offset[++l] = k;
+             }
+             else
+             {
++               freez(text);
++               freez(r);
+                *errptr = PCRS_WARN_BADREF;
++               return NULL;
+             }   
+             continue;
+          }
--- privoxy-3.0.16.orig/debian/patches/06_8bit_manual.dpatch
+++ privoxy-3.0.16/debian/patches/06_8bit_manual.dpatch
@@ -0,0 +1,36 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 06_8bit_manual.dpatch by Roland Rosenfeld <roland@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Stop converting 8bit chars in the documentation (#203697)
+
+@DPATCH@
+diff -urNad privoxy~/doc/source/ldp.dsl.in privoxy/doc/source/ldp.dsl.in
+--- privoxy~/doc/source/ldp.dsl.in
++++ privoxy/doc/source/ldp.dsl.in
+@@ -47,9 +47,9 @@
+ 
+ ;; this is necessary because right now jadetex does not understand
+ ;; symbolic entities, whereas things work well with numeric entities.
+-(declare-characteristic preserve-sdata?
+-  "UNREGISTERED::James Clark//Characteristic::preserve-sdata?"
+-  #f)
++;(declare-characteristic preserve-sdata?
++;  "UNREGISTERED::James Clark//Characteristic::preserve-sdata?"
++;  #f)
+ 
+ ;; put the legal notice in a separate file
+ (define %generate-legalnotice-link%
+@@ -257,9 +257,9 @@
+ 
+ ;; this is necessary because right now jadetex does not understand
+ ;; symbolic entities, whereas things work well with numeric entities.
+-(declare-characteristic preserve-sdata?
+-  "UNREGISTERED::James Clark//Characteristic::preserve-sdata?"
+-  #f)
++;(declare-characteristic preserve-sdata?
++;  "UNREGISTERED::James Clark//Characteristic::preserve-sdata?"
++;  #f)
+ 
+ ;; put the legal notice in a separate file
+ (define %generate-legalnotice-link%
--- privoxy-3.0.16.orig/debian/patches/14_config.dpatch
+++ privoxy-3.0.16/debian/patches/14_config.dpatch
@@ -0,0 +1,46 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 14_config.dpatch by Roland Rosenfeld <roland@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Several Debian specific changes to config file
+
+@DPATCH@
+diff -urNad privoxy~/config privoxy/config
+--- privoxy~/config
++++ privoxy/config
+@@ -1,6 +1,6 @@
+-#        Sample Configuration File for Privoxy v3.0.16
++#        Sample Configuration File for Privoxy
+ #
+-#  $Id: config,v 1.89 2010/02/15 16:47:12 fabiankeil Exp $
++#  Id: config,v
+ #
+ #  Copyright (C) 2001-2010 Privoxy Developers http://www.privoxy.org/
+ #
+@@ -130,7 +130,7 @@
+ #          If set, this option should be the first option in the config
+ #          file, because it is used while the config file is being read.
+ #
+-#user-manual http://www.privoxy.org/user-manual/
++user-manual /usr/share/doc/privoxy/user-manual
+ #
+ #
+ #  1.2. trust-info-url
+@@ -267,7 +267,7 @@
+ #
+ #      No trailing "/", please.
+ #
+-confdir .
++confdir /etc/privoxy
+ #
+ #
+ #  2.2. templdir
+@@ -324,7 +324,7 @@
+ #
+ #      No trailing "/", please.
+ #
+-logdir .
++logdir /var/log/privoxy
+ #
+ #
+ #  2.4. actionsfile
--- privoxy-3.0.16.orig/debian/patches/39_CVE-2015-1382.patch
+++ privoxy-3.0.16/debian/patches/39_CVE-2015-1382.patch
@@ -0,0 +1,115 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## taken from privoxy 3.0.21-7 by <roland@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Author: Fabian Keil <fk@fabiankeil.de>
+## DP: Description: Add parse_time_header(), a wrapper around parse_header_time()
+## DP:  ... which skips the header name for the callers which means
+## DP:  they can't get it wrong. Previously two callers did. This could
+## DP:  result in 'invalid read of size X' issues in case of value-less
+## DP:  headers.
+## DP:  On the systems I tested, X was always 1 and nobody but valgrind
+## DP:  cared, but with different malloc() implementations Privoxy might
+## DP:  be less lucky and segfault.
+## DP:  Partially discovered with afl-fuzz.
+## DP: Bug-Debian: http://bugs.debian.org/776490
+## DP: Origin: upstream, http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/parsers.c?r1=1.297&r2=1.298
+
+@DPATCH@
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' privoxy-3.0.16~/parsers.c privoxy-3.0.16/parsers.c
+--- privoxy-3.0.16~/parsers.c
++++ privoxy-3.0.16/parsers.c
+@@ -96,6 +96,7 @@
+ static jb_err scan_headers(struct client_state *csp);
+ static jb_err header_tagger(struct client_state *csp, char *header);
+ static jb_err parse_header_time(const char *header_time, time_t *result);
++static jb_err parse_time_header(const char *header, time_t *result);
+ 
+ static jb_err crumble                   (struct client_state *csp, char **header);
+ static jb_err filter_header             (struct client_state *csp, char **header);
+@@ -2666,22 +2667,21 @@
+    }
+    else if (0 == strcmpic(newval, "randomize"))
+    {
+-      const char *header_time = *header + sizeof("Last-Modified:");
+-
+       log_error(LOG_LEVEL_HEADER, "Randomizing: %s", *header);
+       now = time(NULL);
+ #ifdef HAVE_GMTIME_R
+       gmtime_r(&now, &gmt);
+ #elif defined(MUTEX_LOCKS_AVAILABLE)
+       privoxy_mutex_lock(&gmtime_mutex);
+       gmtime(&now);
+       privoxy_mutex_unlock(&gmtime_mutex);
+ #else
+       gmtime(&now);
+ #endif
+-      if (JB_ERR_OK != parse_header_time(header_time, &last_modified))
++      if (JB_ERR_OK != parse_time_header(*header, &last_modified))
+       {
+-         log_error(LOG_LEVEL_HEADER, "Couldn't parse: %s in %s (crunching!)", header_time, *header);
++         log_error(LOG_LEVEL_HEADER,
++            "Couldn't parse time in %s (crunching!)", *header);
+          freez(*header);
+       }
+       else
+@@ -3384,11 +3384,10 @@
+       }
+       else /* add random value */
+       {
+-         const char *header_time = *header + sizeof("If-Modified-Since:");
+-
+-         if (JB_ERR_OK != parse_header_time(header_time, &tm))
++         if (JB_ERR_OK != parse_time_header(*header, &tm))
+          {
+-            log_error(LOG_LEVEL_HEADER, "Couldn't parse: %s in %s (crunching!)", header_time, *header);
++            log_error(LOG_LEVEL_HEADER,
++               "Couldn't parse time in %s (crunching!)", *header);
+             freez(*header);
+          }
+          else
+@@ -4372,6 +4371,44 @@
+ 
+ }
+ 
++/*********************************************************************
++ *
++ * Function    :  parse_time_header
++ *
++ * Description :  Parses the time in an HTTP time header to get
++ *                the numerical respresentation.
++ *
++ * Parameters  :
++ *          1  :  header = HTTP header with a time value
++ *          2  :  result = storage for header_time in seconds
++ *
++ * Returns     :  JB_ERR_OK if the time format was recognized, or
++ *                JB_ERR_PARSE otherwise.
++ *
++ *********************************************************************/
++static jb_err parse_time_header(const char *header, time_t *result)
++{
++   const char *header_time;
++
++   header_time = strchr(header, ':');
++
++   /*
++    * Currently this can't happen as all callers are called
++    * through sed() which requires a header name followed by
++    * a colon.
++    */
++   assert(header_time != NULL);
++
++   header_time++;
++   if (*header_time == ' ')
++   {
++      header_time++;
++   }
++
++   return parse_header_time(header_time, result);
++
++}
++
+ 
+ /*********************************************************************
+  *
--- privoxy-3.0.16.orig/debian/patches/32_bind_fixup.dpatch
+++ privoxy-3.0.16/debian/patches/32_bind_fixup.dpatch
@@ -0,0 +1,32 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 32_bind_fixup.dpatch by  <roland@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Work around bind problems on startup (Closes: #534735)
+
+@DPATCH@
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' privoxy-3.0.16~/jbsockets.c privoxy-3.0.16/jbsockets.c
+--- privoxy-3.0.16~/jbsockets.c	2010-02-15 16:14:10.000000000 +0100
++++ privoxy-3.0.16/jbsockets.c	2010-05-18 11:47:52.000000000 +0200
+@@ -692,20 +692,7 @@
+    }
+ 
+    memset(&hints, 0, sizeof(struct addrinfo));
+-   if (hostnam == NULL)
+-   {
+-      /*
+-       * XXX: This is a hack. The right thing to do
+-       * would be to bind to both AF_INET and AF_INET6.
+-       * This will also fail if there is no AF_INET
+-       * version available.
+-       */
+-      hints.ai_family = AF_INET;
+-   }
+-   else
+-   {
+-      hints.ai_family = AF_UNSPEC;
+-   }
++   hints.ai_family = AF_UNSPEC;
+    hints.ai_socktype = SOCK_STREAM;
+    hints.ai_flags = AI_PASSIVE;
+ #ifdef AI_ADDRCONFIG
--- privoxy-3.0.16.orig/debian/patches/11_backup_autotools.dpatch
+++ privoxy-3.0.16/debian/patches/11_backup_autotools.dpatch
@@ -0,0 +1,25 @@
+#! /bin/sh -e
+## 11_backup_autotools.dpatch by Ralf Treinen <treinen@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: replace all config.{guess,sub} by the vesion installed in
+## DP: /usr/share/misc
+
+dpatch_patch ()
+{
+	find . -name config.guess -o -name config.sub \
+	 	| tar cf debian/patched/config.guess+sub.tar -T -
+	find . -name config.guess \
+		-exec ln -sf /usr/share/misc/config.guess '{}' \;
+	find . -name config.sub \
+		-exec ln -sf /usr/share/misc/config.sub '{}' \;
+}
+
+dpatch_unpatch ()
+{
+	tar xf debian/patched/config.guess+sub.tar
+}
+
+DPATCH_LIB_NO_DEFAULT=1
+
+. /usr/share/dpatch/dpatch.lib.sh
--- privoxy-3.0.16.orig/debian/patches/10_backup_doc.dpatch
+++ privoxy-3.0.16/debian/patches/10_backup_doc.dpatch
@@ -0,0 +1,27 @@
+#! /bin/sh -e
+## 10_backup_doc.dpatch by Roland Rosenfeld <roland@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Backup the upstream versions of all generated documentation
+
+dpatch_patch ()
+{
+    tar cf debian/patched/doc.bak.tar README
+    for i in doc/source doc/text doc/webserver \
+             INSTALL AUTHORS privoxy.1
+    do
+       if [ -e $i ]
+       then
+	   tar rf debian/patched/doc.bak.tar $i
+       fi
+    done
+}
+
+dpatch_unpatch ()
+{
+    tar xf debian/patched/doc.bak.tar
+}
+
+DPATCH_LIB_NO_DEFAULT=1
+
+. /usr/share/dpatch/dpatch.lib.sh
--- privoxy-3.0.16.orig/debian/patches/27_remove_nsl.dpatch
+++ privoxy-3.0.16/debian/patches/27_remove_nsl.dpatch
@@ -0,0 +1,19 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 27_remove_nsl.dpatch by Roland Rosenfeld <roland@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Remove unnecessary linking against libnsl.
+
+@DPATCH@
+diff -urNad privoxy~/configure.in privoxy/configure.in
+--- privoxy~/configure.in
++++ privoxy/configure.in
+@@ -460,7 +460,7 @@
+ dnl =================================================================
+ 
+ dnl Next line needed to find the gethost*_r functions on Solaris
+-AC_CHECK_LIB(nsl, gethostbyname)
++dnl AC_CHECK_LIB(nsl, gethostbyname)
+ 
+ AC_CHECK_FUNC(gethostbyaddr_r, [
+   AC_MSG_CHECKING([signature of gethostbyaddr_r])
--- privoxy-3.0.16.orig/debian/patches/00list
+++ privoxy-3.0.16/debian/patches/00list
@@ -0,0 +1,16 @@
+05_defaut_action.dpatch
+06_8bit_manual.dpatch
+10_backup_doc.dpatch
+11_backup_autotools.dpatch
+14_config.dpatch
+15_mansection8.dpatch
+17_502_no_such_domain.dpatch
+25_standard_medium.dpatch 
+27_remove_nsl.dpatch
+28_listen_localhost.dpatch
+29_typos.dpatch
+32_bind_fixup.dpatch
+35_CVE-2015-1031-CID66394.patch
+36_CVE-2015-1031-CID66376.patch
+38_CVE-2015-1381.patch
+39_CVE-2015-1382.patch
--- privoxy-3.0.16.orig/debian/patches/29_typos.dpatch
+++ privoxy-3.0.16/debian/patches/29_typos.dpatch
@@ -0,0 +1,126 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 29_typos.dpatch by Roland Rosenfeld <roland@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: fix some common typos: lenght -> length, reenable -> re-enable
+
+@DPATCH@
+diff -urNad privoxy~/cgiedit.c privoxy/cgiedit.c
+--- privoxy~/cgiedit.c
++++ privoxy/cgiedit.c
+@@ -1734,7 +1734,7 @@
+          {
+             log_error(LOG_LEVEL_INFO,
+                "Timestamp mismatch limit reached, turning CGI editor off. "
+-               "Reload the configuration file to reenable it.");
++               "Reload the configuration file to re-enable it.");
+             csp->config->feature_flags &= ~RUNTIME_FEATURE_CGI_EDIT_ACTIONS;
+          }
+       }
+@@ -2882,7 +2882,7 @@
+     * browsers (BR #1570678).
+     *
+     * The config option split-large-forms works around this browser
+-    * bug (HTTP has no URL lenght limitation) by deviding the action
++    * bug (HTTP has no URL length limitation) by deviding the action
+     * list form into multiple smaller ones. It means the URLs are shorter
+     * and work in broken browsers as well, but the user can no longer change
+     * all actions with one submit.
+diff -urNad privoxy~/errlog.c privoxy/errlog.c
+--- privoxy~/errlog.c
++++ privoxy/errlog.c
+@@ -810,7 +810,7 @@
+                    * That's not ok (and even more stupid)
+                    */
+                   assert(ival >= 0);
+-                  format_string = "[counted string lenght < 0]";
++                  format_string = "[counted string length < 0]";
+                }
+             }
+             else if ((size_t)ival >= sizeof(tempbuf))
+diff -urNad privoxy~/jcc.c privoxy/jcc.c
+--- privoxy~/jcc.c
++++ privoxy/jcc.c
+@@ -769,7 +769,7 @@
+  *********************************************************************/
+ static int request_contains_null_bytes(const struct client_state *csp, char *buf, int len)
+ {
+-   size_t c_len; /* Request lenght when treated as C string */
++   size_t c_len; /* Request length when treated as C string */
+ 
+    c_len = strlen(buf);
+ 
+@@ -2453,7 +2453,7 @@
+    if (csp->content_length == 0)
+    {
+       /*
+-       * If Privoxy didn't recalculate the Content-Lenght,
++       * If Privoxy didn't recalculate the Content-Length,
+        * byte_count is still correct.
+        */
+       csp->content_length = byte_count;
+diff -urNad privoxy~/list.c privoxy/list.c
+--- privoxy~/list.c
++++ privoxy/list.c
+@@ -496,7 +496,7 @@
+    assert(list_is_valid(the_list));
+ 
+    /*
+-    * Calculate the lenght of the final text.
++    * Calculate the length of the final text.
+     * '2' because of the '\r\n' at the end of
+     * each string and at the end of the text.
+     */
+diff -urNad privoxy~/loaders.c privoxy/loaders.c
+--- privoxy~/loaders.c
++++ privoxy/loaders.c
+@@ -763,7 +763,7 @@
+       if (strlen(buf2) + 1U > buflen)
+       {
+          log_error(LOG_LEVEL_FATAL,
+-            "Max line limit reached. Linenumber: %u. Lenght: %u. Max lenght: %u.",
++            "Max line limit reached. Linenumber: %u. Length: %u. Max length: %u.",
+             *linenum, strlen(buf2), buflen-1);
+       }
+       strlcpy(buf, buf2, buflen);
+diff -urNad privoxy~/parsers.c privoxy/parsers.c
+--- privoxy~/parsers.c
++++ privoxy/parsers.c
+@@ -4185,7 +4185,7 @@
+    const char *host, const int parameter_conditional_block)
+ {
+    char *referer = strdup(*header);
+-   const size_t hostlenght = strlen(host);
++   const size_t hostlength = strlen(host);
+    const char *referer_url = NULL;
+ 
+    if (NULL == referer)
+@@ -4195,14 +4195,14 @@
+    }
+ 
+    /* referer begins with 'Referer: http[s]://' */
+-   if ((hostlenght+17) < strlen(referer))
++   if ((hostlength+17) < strlen(referer))
+    {
+       /*
+        * Shorten referer to make sure the referer is blocked
+        * if www.example.org/www.example.com-shall-see-the-referer/
+        * links to www.example.com/
+        */
+-      referer[hostlenght+17] = '\0';
++      referer[hostlength+17] = '\0';
+    }
+    referer_url = strstr(referer, "http://");
+    if ((NULL == referer_url) || (NULL == strstr(referer_url, host)))
+diff -urNad privoxy~/project.h privoxy/project.h
+--- privoxy~/project.h
++++ privoxy/project.h
+@@ -749,7 +749,7 @@
+ #define CSP_FLAG_SERVER_CONTENT_LENGTH_SET     0x00002000U
+ 
+ /**
+- * Flag for csp->flags: Set if we know the content lenght,
++ * Flag for csp->flags: Set if we know the content length,
+  * either because the server set it, or we figured it out
+  * on our own.
+  */
--- privoxy-3.0.16.orig/debian/patches/15_mansection8.dpatch
+++ privoxy-3.0.16/debian/patches/15_mansection8.dpatch
@@ -0,0 +1,97 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 15_mansection8.dpatch by Roland Rosenfeld <roland@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Move man page from man section 1 to man section 8.
+
+@DPATCH@
+diff -urNad privoxy~/GNUmakefile.in privoxy/GNUmakefile.in
+--- privoxy~/GNUmakefile.in
++++ privoxy/GNUmakefile.in
+@@ -172,7 +172,7 @@
+ DOC_FILES = AUTHORS LICENSE README ChangeLog INSTALL \
+ 		`find doc/webserver/ -name "*.html" | grep -v "\(webserver\|team\)\/index\.html"` \
+ 		`find doc/webserver/ -name "*.css"` \
+-                privoxy.1
++                privoxy.8
+ 
+ #############################################################################
+ # Filenames and libraries
+@@ -454,7 +454,7 @@
+ 	$(RM) doc/man/* doc/webserver/man-page/*.html
+ ifneq ($(MAN2HTML),false)
+ 	$(ECHO) "<html><head><title>Privoxy Man page</title><link rel=\"stylesheet\" type=\"text/css\" href=\"../p_web.css\"></head><body><H2>NAME</H2>" > doc/webserver/man-page/privoxy-man-page.html
+-	man ./privoxy.1 | $(MAN2HTML) -bare >> doc/webserver/man-page/privoxy-man-page.html
++	man ./privoxy.8 | $(MAN2HTML) -bare >> doc/webserver/man-page/privoxy-man-page.html
+ 	$(ECHO) "</body></html>" >> doc/webserver/man-page/privoxy-man-page.html
+ else
+ 	$(MAKE) groff2html
+@@ -466,19 +466,19 @@
+ man: dok-release
+ 	mkdir -p doc/source/temp && cd doc/source/temp && $(RM) * ;\
+ 	nsgmls ../privoxy-man-page.sgml  | sgmlspl ../../../utils/docbook2man/docbook2man-spec.pl &&\
+-	perl -pi.bak -e 's/ <URL:.*>//; s/\[ /\[/g' privoxy.1 ;\
+-	perl -pi.bak -e "s/\[ /\[/g;s/á/\\\\['a]/g;s/é/\\\\['e]/g" privoxy.1; \
+-	perl -pi.bak -e "s/ö/\\\\[:o]/g" privoxy.1; \
+-	perl -pi.bak -e 's/([ {])-([a-z])/$$1\\-$$2/g' privoxy.1; \
+-	perl -pi.bak -e 's/ --([a-z])/ \\-\\-$$1/g' privoxy.1; \
+-	perl -pi.bak -e 's/\\fB--/\\fB\\-\\-/g' privoxy.1; \
+-	$(DB) ../privoxy-man-page.sgml && $(MV) -f privoxy.1 ../../../privoxy.1
++	perl -pi.bak -e 's/ <URL:.*>//; s/\[ /\[/g' privoxy.8 ;\
++	perl -pi.bak -e "s/\[ /\[/g;s/á/\\\\['a]/g;s/é/\\\\['e]/g" privoxy.8; \
++	perl -pi.bak -e "s/ö/\\\\[:o]/g" privoxy.8; \
++	perl -pi.bak -e 's/([ {])-([a-z])/$$1\\-$$2/g' privoxy.8; \
++	perl -pi.bak -e 's/ --([a-z])/ \\-\\-$$1/g' privoxy.8; \
++	perl -pi.bak -e 's/\\fB--/\\fB\\-\\-/g' privoxy.8; \
++	$(DB) ../privoxy-man-page.sgml && $(MV) -f privoxy.8 ../../../privoxy.8
+ 
+ # For those with man2html ala RH7s.
+ man2html:
+ 	mkdir -p doc/webserver/man-page
+ ifneq ($(MAN2HTML),false)
+-	$(MAN2HTML) privoxy.1 |grep -v "^Content-type" > tmp.html
++	$(MAN2HTML) privoxy.8 |grep -v "^Content-type" > tmp.html
+ 	$(PERL) -pi.bak -e 's/<A .*Contents<\/A>//; s/<A .*man2html<\/A>/man2html/' tmp.html
+ 	$(PERL) -pi.bak -e 's/(<\/HEAD>)/<LINK REL=\"STYLESHEET\" TYPE=\"text\/css\" HREF=\"..\/p_doc.css\"><\/HEAD>/' tmp.html
+ # Twice because my version of man2html is pulling in commas and periods in URLs.
+@@ -494,7 +494,7 @@
+ 
+ # Otherwise we get plain groff conversion.
+ groff2html:
+-	$(G2H_CMD) ./privoxy.1 | $(SED) -e 's@</head>@<link REL="STYLESHEET" TYPE="text/css" HREF="../p_doc.css"></head>@' > doc/webserver/man-page/privoxy-man-page.html
++	$(G2H_CMD) ./privoxy.8 | $(SED) -e 's@</head>@<link REL="STYLESHEET" TYPE="text/css" HREF="../p_doc.css"></head>@' > doc/webserver/man-page/privoxy-man-page.html
+ 
+ 
+ # readme page and INSTALL file
+@@ -837,8 +837,8 @@
+ 		$(INSTALL) $(INSTALL_T) $(DOK_WEB)/p_doc.css $(DESTDIR)$$DOC/user-manual;\
+ 	fi
+ 	@# Not all platforms support gzipped man pages.
+-	@$(ECHO) Installing man page to $(DESTDIR)$(MAN_DEST)/privoxy.1
+-	-$(INSTALL) $(INSTALL_T) privoxy.1  $(DESTDIR)$(MAN_DEST)/privoxy.1
++	@$(ECHO) Installing man page to $(DESTDIR)$(MAN_DEST)/privoxy.8
++	-$(INSTALL) $(INSTALL_T) privoxy.8  $(DESTDIR)$(MAN_DEST)/privoxy.8
+ 
+ 	@# Change the config file default directories according to the configured ones
+ 	@$(ECHO) Rewriting config for this installation
+@@ -986,7 +986,7 @@
+ 
+ 	@# man page and docs
+ 	@$(ECHO) Removing $(PROGRAM) docs
+-	-$(RM) $(DESTDIR)$(MAN_DEST)/privoxy.1*
++	-$(RM) $(DESTDIR)$(MAN_DEST)/privoxy.8*
+ 	-$(RM) -r $(DESTDIR)$(DOC_DEST) || $(RM) -r $(DESTDIR)$(prefix)/doc/privoxy
+ 
+ 	@# Log and pidfile
+diff -urNad privoxy~/doc/source/privoxy-man-page.sgml privoxy/doc/source/privoxy-man-page.sgml
+--- privoxy~/doc/source/privoxy-man-page.sgml
++++ privoxy/doc/source/privoxy-man-page.sgml
+@@ -58,7 +58,7 @@
+ </refentryinfo>
+ <refmeta>
+  <refentrytitle>privoxy</refentrytitle> 
+- <manvolnum>1</manvolnum>
++ <manvolnum>8</manvolnum>
+  <refmiscinfo>
+   Privoxy &p-version;<![%p-not-stable;[ &p-status;]]>
+  </refmiscinfo>
--- privoxy-3.0.16.orig/debian/patches/35_CVE-2015-1031-CID66394.patch
+++ privoxy-3.0.16/debian/patches/35_CVE-2015-1031-CID66394.patch
@@ -0,0 +1,37 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## taken from privoxy 3.0.21-7 by <roland@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Author: Fabian Keil <fk@fabiankeil.de>
+## DP: Description: unmap(): Prevent use-after-free if the map only consists of one
+## DP:  item
+## DP:  CID 66394.
+## DP: Bug-Debian: http://bugs.debian.org/775167
+## DP: Origin: upstream, http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/list.c?r1=1.31&r2=1.32
+
+@DPATCH@
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' privoxy-3.0.16~/list.c privoxy-3.0.16/list.c
+--- privoxy-3.0.16~/list.c
++++ privoxy-3.0.16/list.c
+@@ -1041,7 +1041,7 @@ jb_err unmap(struct map *the_map, const char *name)
+    assert(the_map);
+    assert(name);
+    
+-   last_entry = the_map->first;
++   last_entry = NULL;
+ 
+    for (cur_entry = the_map->first; cur_entry != NULL; cur_entry = cur_entry->next)
+    {
+@@ -1073,7 +1073,11 @@ jb_err unmap(struct map *the_map, const char *name)
+          freez(cur_entry->name);
+          freez(cur_entry->value);
+          freez(cur_entry);
+-
++         if (last_entry == NULL)
++         {
++            /* The map only had a single entry which has just been removed. */
++            break;
++         }
+          cur_entry = last_entry;
+       }
+       else
