Action not permitted
Modal body text goes here.
Modal Title
Modal Body
cve-2012-5643
Vulnerability from cvelistv5
Published
2012-12-20 11:00
Modified
2024-08-06 21:14
Severity ?
EPSS score ?
Summary
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-06T21:14:15.955Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "DSA-2631", tags: [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred", ], url: "http://www.debian.org/security/2013/dsa-2631", }, { name: "RHSA-2013:0505", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://rhn.redhat.com/errata/RHSA-2013-0505.html", }, { name: "MDVSA-2013:129", tags: [ "vendor-advisory", "x_refsource_MANDRIVA", "x_transferred", ], url: "http://www.mandriva.com/security/advisories?name=MDVSA-2013:129", }, { name: "1027890", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://www.securitytracker.com/id?1027890", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch", }, { name: "SUSE-SU-2016:1996", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", }, { name: "openSUSE-SU-2013:1443", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00032.html", }, { name: "[oss-security] 20121217 Re: CVE Request -- SQUID-2012:1 / Squid: DoS (excessive resource consumption) via invalid Content-Length headers or via memory leaks", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "http://openwall.com/lists/oss-security/2012/12/17/4", }, { name: "52024", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/52024", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.squid-cache.org/Advisories/SQUID-2012_1.txt", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=887962", }, { name: "54839", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/54839", }, { name: "SUSE-SU-2016:2089", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", }, { name: "openSUSE-SU-2013:0162", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00052.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://bugs.gentoo.org/show_bug.cgi?id=447596", }, { name: "openSUSE-SU-2013:0186", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00075.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0368", }, { name: "openSUSE-SU-2013:1436", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00025.html", }, { name: "USN-1713-1", tags: [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred", ], url: "http://ubuntu.com/usn/usn-1713-1", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2012-12-17T00:00:00", descriptions: [ { lang: "en", value: "Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2016-11-25T20:57:01", orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", shortName: "redhat", }, references: [ { name: "DSA-2631", tags: [ "vendor-advisory", "x_refsource_DEBIAN", ], url: "http://www.debian.org/security/2013/dsa-2631", }, { name: "RHSA-2013:0505", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://rhn.redhat.com/errata/RHSA-2013-0505.html", }, { name: "MDVSA-2013:129", tags: [ "vendor-advisory", "x_refsource_MANDRIVA", ], url: "http://www.mandriva.com/security/advisories?name=MDVSA-2013:129", }, { name: "1027890", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://www.securitytracker.com/id?1027890", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch", }, { name: "SUSE-SU-2016:1996", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", }, { name: "openSUSE-SU-2013:1443", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00032.html", }, { name: "[oss-security] 20121217 Re: CVE Request -- SQUID-2012:1 / Squid: DoS (excessive resource consumption) via invalid Content-Length headers or via memory leaks", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "http://openwall.com/lists/oss-security/2012/12/17/4", }, { name: "52024", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/52024", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://www.squid-cache.org/Advisories/SQUID-2012_1.txt", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=887962", }, { name: "54839", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/54839", }, { name: "SUSE-SU-2016:2089", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", }, { name: "openSUSE-SU-2013:0162", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00052.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://bugs.gentoo.org/show_bug.cgi?id=447596", }, { name: "openSUSE-SU-2013:0186", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00075.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0368", }, { name: "openSUSE-SU-2013:1436", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00025.html", }, { name: "USN-1713-1", tags: [ "vendor-advisory", "x_refsource_UBUNTU", ], url: "http://ubuntu.com/usn/usn-1713-1", }, ], }, }, cveMetadata: { assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", assignerShortName: "redhat", cveId: "CVE-2012-5643", datePublished: "2012-12-20T11:00:00", dateReserved: "2012-10-24T00:00:00", dateUpdated: "2024-08-06T21:14:15.955Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { nvd: "{\"cve\":{\"id\":\"CVE-2012-5643\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2012-12-20T12:02:19.840\",\"lastModified\":\"2025-04-11T00:51:21.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.\"},{\"lang\":\"es\",\"value\":\"Varias fugas de memoria en tools/cachemgr.cc en cachemgr.cgi en Squid v2.x y v3.x antes de v3.1.22, v3.2.x antes de v3.2.4 y v3.3.x antes de v3.3.0.2 permite a atacantes remotos provocar una denegación de servicio (consumo de memoria) a través de (1) cabeceras Content-Length no válidas, (2) largas peticiones POST, o (3) credenciales de autenticación manipuladas.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B7EB3DBC-313E-4F55-90F3-BED0918A4EFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C3DCC264-510E-43D1-9C13-99CEA54C7940\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED31C038-4142-4C2C-B540-9223C5C199FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"177060A9-6211-4B6D-96BE-48B4BD1FAFEE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7E210DD-8EE6-4182-A78E-F791FCFDEFCF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"50327E36-756E-434D-804D-1E44A4ABAE1F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:2.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3AE100C3-0245-4305-B514-77D0572C2947\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:2.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"35C30CB9-FA3A-408D-A8B0-8805E75657BE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:2.7:stable3:*:*:*:*:*:*\",\"matchCriteriaId\":\"A03692DD-779F-4E3C-861C-29943870A816\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:2.7:stable4:*:*:*:*:*:*\",\"matchCriteriaId\":\"79FF6B3C-A3CE-4AA2-80F9-44D05A6B2F08\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"62B9F669-6217-498A-902E-22EDEEFC565E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0:-:pre1:*:*:*:*:*\",\"matchCriteriaId\":\"ED54A2B3-6D36-4016-9BF1-83FAD500103F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0:-:pre2:*:*:*:*:*\",\"matchCriteriaId\":\"C4F368E3-88A6-463C-AA18-8FA1B9E35A84\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0:-:pre3:*:*:*:*:*\",\"matchCriteriaId\":\"1451771E-F456-4631-89C8-0A49F4C8F03B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0:-:pre4:*:*:*:*:*\",\"matchCriteriaId\":\"FC881283-D0DF-482E-8A06-5CFCF0FA0BB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0:-:pre5:*:*:*:*:*\",\"matchCriteriaId\":\"E746946A-2D07-402B-A071-9B674F6FEA75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0:-:pre6:*:*:*:*:*\",\"matchCriteriaId\":\"6B1A697B-3777-492F-BA53-0BA7A9934C03\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0:-:pre7:*:*:*:*:*\",\"matchCriteriaId\":\"1C579925-591E-4BD7-A888-B8D2B0228D34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"131C4C00-3811-42BF-A84A-EB2E5DA156B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"047EDDD6-02F5-4B53-8FCA-781962392080\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"01AD43AB-40BF-449F-A121-A8587E7AE449\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3942285D-E20C-45C5-9EF8-821F6D782CB8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3FDB45B-4D91-4427-9565-812919086E7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"86C3C8B5-C2A3-4454-9F89-38A860278366\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B37B7B4-2EAC-4C2A-9526-5C62CBA1DB8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"056EDEEE-A09C-47A2-9217-72E4B8387E00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2593CB12-03E2-4F98-9B89-C09D5EADE077\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A44B7A4F-3070-4092-B9AF-3A1CD0897CC7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF79D9A9-9C11-4E6D-81D1-32CA8CA95223\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"042FE60B-7239-45C7-8EE3-A036AC7778F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF5EE89A-720F-456A-BD26-FE46BBA29D9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ADF61A74-9CF9-413E-B997-4FAE5BA28939\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5605B00F-438B-45CC-A55D-E75E57BC4684\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8316B22E-B016-4F0E-9A3F-383E9B1A85A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49A2C5CB-E2F1-4A72-9EA3-912050AFEF7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"574C7DCC-B6E5-42A0-AA44-A0BCD67D1884\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D0DAD04-02C4-4FC4-BE08-3CAA3B85EB0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2B1F1A5-B435-4A5C-86DF-EC3F29D94417\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"113EF7A6-3B8D-4A50-8873-FD36FCBF284C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC97E2DA-7378-486B-9178-3B38FF58589B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F178890-2F7E-43F5-8D6D-5EFCD790E758\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9FA231EB-0F06-4D13-B50D-76FC8393187A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31AB1D33-65EE-46DF-9D29-6B2BFACE7EC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDA4744F-5FB2-4DF8-A7B9-A33EAB004CBA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"72023FB9-F081-4F0A-9E81-2AF0470EB278\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable25:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F7D973B-9D57-4F74-89B1-A18CDA388EF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6A8586AD-E820-4BAE-AAF9-AC7EF2316C06\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"802E3D2B-90B7-4725-854F-4174116BC314\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7501697A-BCFD-4DC3-8D87-CC9A186D9589\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D6C4455-85F4-462D-9FF6-F830ED7D398E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B600BF4C-8169-4086-BFE6-F066BE5F5406\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"46272D1B-1468-48C0-B37A-7D06FAC39C47\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA782B4B-486F-4197-BD5D-ABF791D57211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"558D8641-E097-4D91-9B6E-07433844BB82\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B46F5F1-38FC-4E25-8F04-CA2730561DF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C69B0A4D-9619-4BEA-A846-C4438C2660F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED17FE35-6B2C-41BF-A7C7-2EECBDB5A934\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"78A50750-3A31-482C-B95C-019C8934850E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8FF6AC30-9570-4D4B-835E-CCADEB546F46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FB84E4E-6A0A-41C8-9DDF-3C18F526F155\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E49E5C3-D01F-4DBC-B33A-5495D3EC44F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"79C53B22-9F33-43E7-8D1F-EEB0DEF4B503\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25B60DB2-F50C-42F0-B6C9-B25C34B8F578\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE973F9E-8387-464F-AFA0-25215B340173\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"03D3F0E3-0C50-4A86-87F4-90FC82B312F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE26BEC0-B9C7-43F0-B0FB-E81870170B29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0778579-A193-4C61-BB1A-6D2E733F3958\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE9A3716-8670-4847-A6EB-F601184D369E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0E88EE3-EC00-4F1F-BAEF-4F1F893C5C5F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A330DFA8-BF79-45CC-BF88-6CEA26D7BC9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"679A55F8-34B4-435A-8BCE-8F842F3FB269\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"898674F9-6BF7-469F-A74E-558EAFC2CD27\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F50E718-1CF2-4C8F-A1EA-5F769B203B8A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"290D66F4-D27F-4E86-AC95-05082F3C2E36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8CD6A42-2C79-48EB-8F6C-0A7CE0C6AAAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ABBA9A61-2B05-4527-A49D-425AD5FD863B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E893D7A8-9C39-438C-8EF2-9573EEDC884A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B707451-BF0E-4F79-A348-B1141ABA6EF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"810AAA9D-F4B2-4F0A-89DD-2D9378516481\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6DFAB3BA-BBE9-4CFB-BE6B-BDF3E7772E7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9F523B8-463E-4FB0-ACB6-E36AAAF85CD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5BA593D9-907D-4051-A3F2-0F88F01A7C79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"20D2B364-B98A-4484-A10A-86AF43774096\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B7BF076-0D43-407A-86DC-D1163922A787\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA576F49-A7F5-4013-89DF-F6C91C15B547\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D3F52FE-FFB3-4221-8DC7-3F5680A07429\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"604FEF42-ABA7-42C1-8A5F-C3AECFD68481\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC2568C1-89CB-41C1-9126-A8665614D0B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C18B5392-3FDB-49E6-89DB-7945D337FBFB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BA9E0E7F-E93C-4DE9-8D91-5EE50BCFAC2A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0BFF9D8B-343B-415D-8AF8-B07AF94CC48B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16F5794B-BBFB-4B12-9A0B-88A0334681C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"17D0083E-8D50-4DC6-979F-685D5CB588AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"138FAD73-1D25-4F46-B9EA-599FF0EDA1AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2CE34DC1-F654-474E-B6A3-D81B9BF4D6CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A4BF7AC-7D9F-40D8-A5AA-BE1EBF37CF96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"643E8B9B-C3F4-4171-BF67-D9359BDCE5CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A73CBC60-1EF1-4730-9350-EB51F269695B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2721E403-A553-492F-897F-1CD1E2685139\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"85B091C4-8104-4A1E-A09D-EBCD114DC829\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA2EDF9C-45AD-4980-8DEF-C7F473B22CAF\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.3.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7A83183-74B1-4041-A961-D9F382AAC7E5\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2013-01/msg00052.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2013-01/msg00075.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2013-09/msg00025.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2013-09/msg00032.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://openwall.com/lists/oss-security/2012/12/17/4\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0505.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/52024\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/54839\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://ubuntu.com/usn/usn-1713-1\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.debian.org/security/2013/dsa-2631\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2013:129\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securitytracker.com/id?1027890\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.squid-cache.org/Advisories/SQUID-2012_1.txt\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://bugs.gentoo.org/show_bug.cgi?id=447596\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=887962\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0368\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2013-01/msg00052.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2013-01/msg00075.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2013-09/msg00025.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2013-09/msg00032.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://openwall.com/lists/oss-security/2012/12/17/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0505.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/52024\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/54839\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://ubuntu.com/usn/usn-1713-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2013/dsa-2631\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2013:129\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id?1027890\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.squid-cache.org/Advisories/SQUID-2012_1.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://bugs.gentoo.org/show_bug.cgi?id=447596\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=887962\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0368\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}", }, }
opensuse-su-2024:10307-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
squid-3.5.22-1.1 on GA media
Notes
Title of the patch
squid-3.5.22-1.1 on GA media
Description of the patch
These are all security issues fixed in the squid-3.5.22-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-10307
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "squid-3.5.22-1.1 on GA media", title: "Title of the patch", }, { category: "description", text: "These are all security issues fixed in the squid-3.5.22-1.1 package on the GA media of openSUSE Tumbleweed.", title: "Description of the patch", }, { category: "details", text: "openSUSE-Tumbleweed-2024-10307", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10307-1.json", }, { category: "self", summary: "SUSE CVE CVE-2012-5643 page", url: "https://www.suse.com/security/cve/CVE-2012-5643/", }, { category: "self", summary: "SUSE CVE CVE-2014-7141 page", url: "https://www.suse.com/security/cve/CVE-2014-7141/", }, { category: "self", summary: "SUSE CVE CVE-2014-7142 page", url: "https://www.suse.com/security/cve/CVE-2014-7142/", }, { category: "self", summary: "SUSE CVE CVE-2015-5400 page", url: "https://www.suse.com/security/cve/CVE-2015-5400/", }, ], title: "squid-3.5.22-1.1 on GA media", tracking: { current_release_date: "2024-06-15T00:00:00Z", generator: { date: "2024-06-15T00:00:00Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "openSUSE-SU-2024:10307-1", initial_release_date: "2024-06-15T00:00:00Z", revision_history: [ { date: "2024-06-15T00:00:00Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "squid-3.5.22-1.1.aarch64", product: { name: "squid-3.5.22-1.1.aarch64", product_id: "squid-3.5.22-1.1.aarch64", }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "squid-3.5.22-1.1.ppc64le", product: { name: "squid-3.5.22-1.1.ppc64le", product_id: "squid-3.5.22-1.1.ppc64le", }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "squid-3.5.22-1.1.s390x", product: { name: "squid-3.5.22-1.1.s390x", product_id: "squid-3.5.22-1.1.s390x", }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "squid-3.5.22-1.1.x86_64", product: { name: "squid-3.5.22-1.1.x86_64", product_id: "squid-3.5.22-1.1.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "openSUSE Tumbleweed", product: { name: "openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed", product_identification_helper: { cpe: "cpe:/o:opensuse:tumbleweed", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "squid-3.5.22-1.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:squid-3.5.22-1.1.aarch64", }, product_reference: "squid-3.5.22-1.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "squid-3.5.22-1.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:squid-3.5.22-1.1.ppc64le", }, product_reference: "squid-3.5.22-1.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "squid-3.5.22-1.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:squid-3.5.22-1.1.s390x", }, product_reference: "squid-3.5.22-1.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "squid-3.5.22-1.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:squid-3.5.22-1.1.x86_64", }, product_reference: "squid-3.5.22-1.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, ], }, vulnerabilities: [ { cve: "CVE-2012-5643", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2012-5643", }, ], notes: [ { category: "general", text: "Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:squid-3.5.22-1.1.aarch64", "openSUSE Tumbleweed:squid-3.5.22-1.1.ppc64le", "openSUSE Tumbleweed:squid-3.5.22-1.1.s390x", "openSUSE Tumbleweed:squid-3.5.22-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2012-5643", url: "https://www.suse.com/security/cve/CVE-2012-5643", }, { category: "external", summary: "SUSE Bug 794954 for CVE-2012-5643", url: "https://bugzilla.suse.com/794954", }, { category: "external", summary: "SUSE Bug 796999 for CVE-2012-5643", url: "https://bugzilla.suse.com/796999", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:squid-3.5.22-1.1.aarch64", "openSUSE Tumbleweed:squid-3.5.22-1.1.ppc64le", "openSUSE Tumbleweed:squid-3.5.22-1.1.s390x", "openSUSE Tumbleweed:squid-3.5.22-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2012-5643", }, { cve: "CVE-2014-7141", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2014-7141", }, ], notes: [ { category: "general", text: "The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:squid-3.5.22-1.1.aarch64", "openSUSE Tumbleweed:squid-3.5.22-1.1.ppc64le", "openSUSE Tumbleweed:squid-3.5.22-1.1.s390x", "openSUSE Tumbleweed:squid-3.5.22-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2014-7141", url: "https://www.suse.com/security/cve/CVE-2014-7141", }, { category: "external", summary: "SUSE Bug 1040640 for CVE-2014-7141", url: "https://bugzilla.suse.com/1040640", }, { category: "external", summary: "SUSE Bug 891268 for CVE-2014-7141", url: "https://bugzilla.suse.com/891268", }, { category: "external", summary: "SUSE Bug 895773 for CVE-2014-7141", url: "https://bugzilla.suse.com/895773", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:squid-3.5.22-1.1.aarch64", "openSUSE Tumbleweed:squid-3.5.22-1.1.ppc64le", "openSUSE Tumbleweed:squid-3.5.22-1.1.s390x", "openSUSE Tumbleweed:squid-3.5.22-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2014-7141", }, { cve: "CVE-2014-7142", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2014-7142", }, ], notes: [ { category: "general", text: "The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:squid-3.5.22-1.1.aarch64", "openSUSE Tumbleweed:squid-3.5.22-1.1.ppc64le", "openSUSE Tumbleweed:squid-3.5.22-1.1.s390x", "openSUSE Tumbleweed:squid-3.5.22-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2014-7142", url: "https://www.suse.com/security/cve/CVE-2014-7142", }, { category: "external", summary: "SUSE Bug 895773 for CVE-2014-7142", url: "https://bugzilla.suse.com/895773", }, { category: "external", summary: "SUSE Bug 973782 for CVE-2014-7142", url: "https://bugzilla.suse.com/973782", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:squid-3.5.22-1.1.aarch64", "openSUSE Tumbleweed:squid-3.5.22-1.1.ppc64le", "openSUSE Tumbleweed:squid-3.5.22-1.1.s390x", "openSUSE Tumbleweed:squid-3.5.22-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2014-7142", }, { cve: "CVE-2015-5400", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-5400", }, ], notes: [ { category: "general", text: "Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:squid-3.5.22-1.1.aarch64", "openSUSE Tumbleweed:squid-3.5.22-1.1.ppc64le", "openSUSE Tumbleweed:squid-3.5.22-1.1.s390x", "openSUSE Tumbleweed:squid-3.5.22-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-5400", url: "https://www.suse.com/security/cve/CVE-2015-5400", }, { category: "external", summary: "SUSE Bug 938715 for CVE-2015-5400", url: "https://bugzilla.suse.com/938715", }, { category: "external", summary: "SUSE Bug 967073 for CVE-2015-5400", url: "https://bugzilla.suse.com/967073", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:squid-3.5.22-1.1.aarch64", "openSUSE Tumbleweed:squid-3.5.22-1.1.ppc64le", "openSUSE Tumbleweed:squid-3.5.22-1.1.s390x", "openSUSE Tumbleweed:squid-3.5.22-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2015-5400", }, ], }
gsd-2012-5643
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
Aliases
Aliases
{ GSD: { alias: "CVE-2012-5643", description: "Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.", id: "GSD-2012-5643", references: [ "https://www.suse.com/security/cve/CVE-2012-5643.html", "https://www.debian.org/security/2013/dsa-2631", "https://access.redhat.com/errata/RHSA-2013:0505", "https://linux.oracle.com/cve/CVE-2012-5643.html", ], }, gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { aliases: [ "CVE-2012-5643", ], details: "Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.", id: "GSD-2012-5643", modified: "2023-12-13T01:20:19.937240Z", schema_version: "1.4.0", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "secalert@redhat.com", ID: "CVE-2012-5643", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_affected: "=", version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", refsource: "MISC", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", }, { name: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", refsource: "MISC", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", }, { name: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00052.html", refsource: "MISC", url: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00052.html", }, { name: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00075.html", refsource: "MISC", url: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00075.html", }, { name: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00025.html", refsource: "MISC", url: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00025.html", }, { name: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00032.html", refsource: "MISC", url: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00032.html", }, { name: "http://openwall.com/lists/oss-security/2012/12/17/4", refsource: "MISC", url: "http://openwall.com/lists/oss-security/2012/12/17/4", }, { name: "http://rhn.redhat.com/errata/RHSA-2013-0505.html", refsource: "MISC", url: "http://rhn.redhat.com/errata/RHSA-2013-0505.html", }, { name: "http://secunia.com/advisories/52024", refsource: "MISC", url: "http://secunia.com/advisories/52024", }, { name: "http://secunia.com/advisories/54839", refsource: "MISC", url: "http://secunia.com/advisories/54839", }, { name: "http://ubuntu.com/usn/usn-1713-1", refsource: "MISC", url: "http://ubuntu.com/usn/usn-1713-1", }, { name: "http://www.debian.org/security/2013/dsa-2631", refsource: "MISC", url: "http://www.debian.org/security/2013/dsa-2631", }, { name: "http://www.mandriva.com/security/advisories?name=MDVSA-2013:129", refsource: "MISC", url: "http://www.mandriva.com/security/advisories?name=MDVSA-2013:129", }, { name: "http://www.securitytracker.com/id?1027890", refsource: "MISC", url: "http://www.securitytracker.com/id?1027890", }, { name: "http://www.squid-cache.org/Advisories/SQUID-2012_1.txt", refsource: "MISC", url: "http://www.squid-cache.org/Advisories/SQUID-2012_1.txt", }, { name: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch", refsource: "MISC", url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch", }, { name: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch", refsource: "MISC", url: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch", }, { name: "https://bugs.gentoo.org/show_bug.cgi?id=447596", refsource: "MISC", url: "https://bugs.gentoo.org/show_bug.cgi?id=447596", }, { name: "https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0368", refsource: "MISC", url: "https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0368", }, { name: "https://bugzilla.redhat.com/show_bug.cgi?id=887962", refsource: "MISC", url: "https://bugzilla.redhat.com/show_bug.cgi?id=887962", }, ], }, }, "nvd.nist.gov": { configurations: { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:squid-cache:squid:2.6:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:2.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:2.7:stable3:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:2.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:2.3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:2.7:stable4:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:2.5:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:2.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:2.4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:2.7:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.18:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable13:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.21:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0:rc4:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable9:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.13:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable20:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable14:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.17:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.7:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.14:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.12:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable24:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0:-:pre2:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0:-:pre4:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable16:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable16:rc1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.18:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.14:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable11:rc1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable18:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0:-:pre6:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.9:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.15:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0:-:pre7:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.15:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable6:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0:-:pre5:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0:-:pre1:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.13:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.12:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable15:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.10:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable5:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable21:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.6:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable17:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.16:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable11:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.11:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.8:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable10:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable8:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.20:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.5:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.10:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable12:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable25:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable23:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.19:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0:-:pre3:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable22:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.11:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable7:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.17:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable19:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.16:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.18:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.9:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.6:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.15:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.19:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.13:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.16:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.10:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.7:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.11:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.12:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.8:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.5:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.14:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.17:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.3.0.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, cve: { CVE_data_meta: { ASSIGNER: "secalert@redhat.com", ID: "CVE-2012-5643", }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "en", value: "Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "en", value: "CWE-20", }, ], }, ], }, references: { reference_data: [ { name: "https://bugs.gentoo.org/show_bug.cgi?id=447596", refsource: "CONFIRM", tags: [], url: "https://bugs.gentoo.org/show_bug.cgi?id=447596", }, { name: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch", refsource: "CONFIRM", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch", }, { name: "https://bugzilla.redhat.com/show_bug.cgi?id=887962", refsource: "CONFIRM", tags: [], url: "https://bugzilla.redhat.com/show_bug.cgi?id=887962", }, { name: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch", refsource: "CONFIRM", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch", }, { name: "http://www.squid-cache.org/Advisories/SQUID-2012_1.txt", refsource: "CONFIRM", tags: [ "Patch", "Vendor Advisory", ], url: "http://www.squid-cache.org/Advisories/SQUID-2012_1.txt", }, { name: "[oss-security] 20121217 Re: CVE Request -- SQUID-2012:1 / Squid: DoS (excessive resource consumption) via invalid Content-Length headers or via memory leaks", refsource: "MLIST", tags: [], url: "http://openwall.com/lists/oss-security/2012/12/17/4", }, { name: "openSUSE-SU-2013:0186", refsource: "SUSE", tags: [], url: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00075.html", }, { name: "openSUSE-SU-2013:0162", refsource: "SUSE", tags: [], url: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00052.html", }, { name: "52024", refsource: "SECUNIA", tags: [], url: "http://secunia.com/advisories/52024", }, { name: "USN-1713-1", refsource: "UBUNTU", tags: [], url: "http://ubuntu.com/usn/usn-1713-1", }, { name: "RHSA-2013:0505", refsource: "REDHAT", tags: [], url: "http://rhn.redhat.com/errata/RHSA-2013-0505.html", }, { name: "DSA-2631", refsource: "DEBIAN", tags: [], url: "http://www.debian.org/security/2013/dsa-2631", }, { name: "1027890", refsource: "SECTRACK", tags: [], url: "http://www.securitytracker.com/id?1027890", }, { name: "openSUSE-SU-2013:1436", refsource: "SUSE", tags: [], url: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00025.html", }, { name: "54839", refsource: "SECUNIA", tags: [], url: "http://secunia.com/advisories/54839", }, { name: "openSUSE-SU-2013:1443", refsource: "SUSE", tags: [], url: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00032.html", }, { name: "https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0368", refsource: "CONFIRM", tags: [], url: "https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0368", }, { name: "MDVSA-2013:129", refsource: "MANDRIVA", tags: [], url: "http://www.mandriva.com/security/advisories?name=MDVSA-2013:129", }, { name: "SUSE-SU-2016:2089", refsource: "SUSE", tags: [], url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", }, { name: "SUSE-SU-2016:1996", refsource: "SUSE", tags: [], url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", }, ], }, }, impact: { baseMetricV2: { acInsufInfo: false, cvssV2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "MEDIUM", userInteractionRequired: false, }, }, lastModifiedDate: "2023-02-13T00:27Z", publishedDate: "2012-12-20T12:02Z", }, }, }
RHSA-2013:0505
Vulnerability from csaf_redhat
Published
2013-02-20 16:19
Modified
2024-11-22 05:48
Summary
Red Hat Security Advisory: squid security and bug fix update
Notes
Topic
Updated squid packages that fix one security issue and several bugs are now
available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
Details
Squid is a high-performance proxy caching server for web clients that
supports FTP, Gopher, and HTTP data objects.
A denial of service flaw was found in the way the Squid Cache Manager
processed certain requests. A remote attacker who is able to access the
Cache Manager CGI could use this flaw to cause Squid to consume an
excessive amount of memory. (CVE-2012-5643)
This update also fixes the following bugs:
* Due to a bug in the ConnStateData::noteMoreBodySpaceAvailable() function,
child processes of Squid terminated upon encountering a failed assertion.
An upstream patch has been provided and Squid child processes no longer
terminate. (BZ#805879)
* Due to an upstream patch, which renamed the HTTP header controlling
persistent connections from "Proxy-Connection" to "Connection", the NTLM
pass-through authentication does not work, thus preventing login. This
update adds the new "http10" option to the squid.conf file, which can be
used to enable the change in the patch. This option is set to "off" by
default. When set to "on", the NTLM pass-through authentication works
properly, thus allowing login attempts to succeed. (BZ#844723)
* When the IPv6 protocol was disabled and Squid tried to handle an HTTP GET
request containing an IPv6 address, the Squid child process terminated due
to signal 6. This bug has been fixed and such requests are now handled as
expected. (BZ#832484)
* The old "stale if hit" logic did not account for cases where the stored
stale response became fresh due to a successful re-validation with the
origin server. Consequently, incorrect warning messages were returned. Now,
Squid no longer marks elements as stale in the described scenario.
(BZ#847056)
* When squid packages were installed before samba-winbind, the wbpriv group
did not include Squid. Consequently, NTLM authentication calls failed. Now,
Squid correctly adds itself into the wbpriv group if samba-winbind is
installed before Squid, thus fixing this bug. (BZ#797571)
* In FIPS mode, Squid was using private MD5 hash functions for user
authentication and network access. As MD5 is incompatible with FIPS mode,
Squid could fail to start. This update limits the use of the private MD5
functions to local disk file hash identifiers, thus allowing Squid to work
in FIPS mode. (BZ#833086)
* Under high system load, the squid process could terminate unexpectedly
with a segmentation fault during reboot. This update provides better memory
handling during reboot, thus fixing this bug. (BZ#782732)
* Squid incorrectly set the timeout limit for client HTTP connections with
the value for server-side connections, which is much higher, thus creating
unnecessary delays. With this update, Squid uses a proper value for the
client timeout limit. (BZ#798090)
* Squid did not properly release allocated memory when generating error
page contents, which caused memory leaks. Consequently, the Squid proxy
server consumed a lot of memory within a short time period. This update
fixes this memory leak. (BZ#758861)
* Squid did not pass the ident value to a URL rewriter that was configured
using the "url_rewrite_program" directive. Consequently, the URL rewriter
received the dash character ("–") as the user value instead of the correct
user name. Now, the URL rewriter receives the correct user name in the
described scenario. (BZ#797884)
* Squid, used as a transparent proxy, can only handle the HTTP protocol.
Previously, it was possible to define a URL in which the access protocol
contained the asterisk character (*) or an unknown protocol namespace URI.
Consequently, an "Invalid URL" error message was logged to access.log
during reload. This update ensures that "http://" is always used in
transparent proxy URLs, and the error message is no longer logged in this
scenario. (BZ#720504)
All users of squid are advised to upgrade to these updated packages, which
fix these issues. After installing this update, the squid service will be
restarted automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated squid packages that fix one security issue and several bugs are now\navailable for Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.", title: "Topic", }, { category: "general", text: "Squid is a high-performance proxy caching server for web clients that\nsupports FTP, Gopher, and HTTP data objects.\n\nA denial of service flaw was found in the way the Squid Cache Manager\nprocessed certain requests. A remote attacker who is able to access the\nCache Manager CGI could use this flaw to cause Squid to consume an\nexcessive amount of memory. (CVE-2012-5643)\n\nThis update also fixes the following bugs:\n\n* Due to a bug in the ConnStateData::noteMoreBodySpaceAvailable() function,\nchild processes of Squid terminated upon encountering a failed assertion.\nAn upstream patch has been provided and Squid child processes no longer\nterminate. (BZ#805879)\n\n* Due to an upstream patch, which renamed the HTTP header controlling\npersistent connections from \"Proxy-Connection\" to \"Connection\", the NTLM\npass-through authentication does not work, thus preventing login. This\nupdate adds the new \"http10\" option to the squid.conf file, which can be\nused to enable the change in the patch. This option is set to \"off\" by\ndefault. When set to \"on\", the NTLM pass-through authentication works\nproperly, thus allowing login attempts to succeed. (BZ#844723)\n\n* When the IPv6 protocol was disabled and Squid tried to handle an HTTP GET\nrequest containing an IPv6 address, the Squid child process terminated due\nto signal 6. This bug has been fixed and such requests are now handled as\nexpected. (BZ#832484)\n\n* The old \"stale if hit\" logic did not account for cases where the stored\nstale response became fresh due to a successful re-validation with the\norigin server. Consequently, incorrect warning messages were returned. Now,\nSquid no longer marks elements as stale in the described scenario.\n(BZ#847056)\n\n* When squid packages were installed before samba-winbind, the wbpriv group\ndid not include Squid. Consequently, NTLM authentication calls failed. Now,\nSquid correctly adds itself into the wbpriv group if samba-winbind is\ninstalled before Squid, thus fixing this bug. (BZ#797571)\n\n* In FIPS mode, Squid was using private MD5 hash functions for user\nauthentication and network access. As MD5 is incompatible with FIPS mode,\nSquid could fail to start. This update limits the use of the private MD5\nfunctions to local disk file hash identifiers, thus allowing Squid to work\nin FIPS mode. (BZ#833086)\n\n* Under high system load, the squid process could terminate unexpectedly\nwith a segmentation fault during reboot. This update provides better memory\nhandling during reboot, thus fixing this bug. (BZ#782732)\n\n* Squid incorrectly set the timeout limit for client HTTP connections with\nthe value for server-side connections, which is much higher, thus creating\nunnecessary delays. With this update, Squid uses a proper value for the\nclient timeout limit. (BZ#798090)\n\n* Squid did not properly release allocated memory when generating error\npage contents, which caused memory leaks. Consequently, the Squid proxy\nserver consumed a lot of memory within a short time period. This update\nfixes this memory leak. (BZ#758861)\n\n* Squid did not pass the ident value to a URL rewriter that was configured\nusing the \"url_rewrite_program\" directive. Consequently, the URL rewriter\nreceived the dash character (\"–\") as the user value instead of the correct\nuser name. Now, the URL rewriter receives the correct user name in the\ndescribed scenario. (BZ#797884)\n\n* Squid, used as a transparent proxy, can only handle the HTTP protocol.\nPreviously, it was possible to define a URL in which the access protocol\ncontained the asterisk character (*) or an unknown protocol namespace URI.\nConsequently, an \"Invalid URL\" error message was logged to access.log\nduring reload. This update ensures that \"http://\" is always used in\ntransparent proxy URLs, and the error message is no longer logged in this\nscenario. (BZ#720504)\n\nAll users of squid are advised to upgrade to these updated packages, which\nfix these issues. After installing this update, the squid service will be\nrestarted automatically.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2013:0505", url: "https://access.redhat.com/errata/RHSA-2013:0505", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.4_Technical_Notes/squid.html", url: "https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.4_Technical_Notes/squid.html", }, { category: "external", summary: "797571", url: "https://bugzilla.redhat.com/show_bug.cgi?id=797571", }, { category: "external", summary: "798090", url: "https://bugzilla.redhat.com/show_bug.cgi?id=798090", }, { category: "external", summary: "832484", url: "https://bugzilla.redhat.com/show_bug.cgi?id=832484", }, { category: "external", summary: "833086", url: "https://bugzilla.redhat.com/show_bug.cgi?id=833086", }, { category: "external", summary: "844723", url: "https://bugzilla.redhat.com/show_bug.cgi?id=844723", }, { category: "external", summary: "847056", url: "https://bugzilla.redhat.com/show_bug.cgi?id=847056", }, { category: "external", summary: "887962", url: "https://bugzilla.redhat.com/show_bug.cgi?id=887962", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0505.json", }, ], title: "Red Hat Security Advisory: squid security and bug fix update", tracking: { current_release_date: "2024-11-22T05:48:01+00:00", generator: { date: "2024-11-22T05:48:01+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2013:0505", initial_release_date: "2013-02-20T16:19:00+00:00", revision_history: [ { date: "2013-02-20T16:19:00+00:00", number: "1", summary: "Initial version", }, { date: "2013-02-20T16:30:33+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T05:48:01+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux Server (v. 6)", product: { name: "Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:6::server", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Workstation (v. 6)", product: { name: "Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:6::workstation", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-16.el6.src", product: { name: "squid-7:3.1.10-16.el6.src", product_id: "squid-7:3.1.10-16.el6.src", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=src&epoch=7", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-16.el6.x86_64", product: { name: "squid-7:3.1.10-16.el6.x86_64", product_id: "squid-7:3.1.10-16.el6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=x86_64&epoch=7", }, }, }, { category: "product_version", name: "squid-debuginfo-7:3.1.10-16.el6.x86_64", product: { name: "squid-debuginfo-7:3.1.10-16.el6.x86_64", product_id: "squid-debuginfo-7:3.1.10-16.el6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=x86_64&epoch=7", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-16.el6.i686", product: { name: "squid-7:3.1.10-16.el6.i686", product_id: "squid-7:3.1.10-16.el6.i686", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=i686&epoch=7", }, }, }, { category: "product_version", name: "squid-debuginfo-7:3.1.10-16.el6.i686", product: { name: "squid-debuginfo-7:3.1.10-16.el6.i686", product_id: "squid-debuginfo-7:3.1.10-16.el6.i686", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=i686&epoch=7", }, }, }, ], category: "architecture", name: "i686", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-16.el6.s390x", product: { name: "squid-7:3.1.10-16.el6.s390x", product_id: "squid-7:3.1.10-16.el6.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=s390x&epoch=7", }, }, }, { category: "product_version", name: "squid-debuginfo-7:3.1.10-16.el6.s390x", product: { name: "squid-debuginfo-7:3.1.10-16.el6.s390x", product_id: "squid-debuginfo-7:3.1.10-16.el6.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=s390x&epoch=7", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-16.el6.ppc64", product: { name: "squid-7:3.1.10-16.el6.ppc64", product_id: "squid-7:3.1.10-16.el6.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=ppc64&epoch=7", }, }, }, { category: "product_version", name: "squid-debuginfo-7:3.1.10-16.el6.ppc64", product: { name: "squid-debuginfo-7:3.1.10-16.el6.ppc64", product_id: "squid-debuginfo-7:3.1.10-16.el6.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=ppc64&epoch=7", }, }, }, ], category: "architecture", name: "ppc64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-7:3.1.10-16.el6.i686", }, product_reference: "squid-7:3.1.10-16.el6.i686", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-7:3.1.10-16.el6.ppc64", }, product_reference: "squid-7:3.1.10-16.el6.ppc64", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-7:3.1.10-16.el6.s390x", }, product_reference: "squid-7:3.1.10-16.el6.s390x", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.src as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-7:3.1.10-16.el6.src", }, product_reference: "squid-7:3.1.10-16.el6.src", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-7:3.1.10-16.el6.x86_64", }, product_reference: "squid-7:3.1.10-16.el6.x86_64", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-debuginfo-7:3.1.10-16.el6.i686", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.i686", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.ppc64", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.s390x", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.x86_64", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-7:3.1.10-16.el6.i686", }, product_reference: "squid-7:3.1.10-16.el6.i686", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-7:3.1.10-16.el6.ppc64", }, product_reference: "squid-7:3.1.10-16.el6.ppc64", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-7:3.1.10-16.el6.s390x", }, product_reference: "squid-7:3.1.10-16.el6.s390x", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-7:3.1.10-16.el6.src", }, product_reference: "squid-7:3.1.10-16.el6.src", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-7:3.1.10-16.el6.x86_64", }, product_reference: "squid-7:3.1.10-16.el6.x86_64", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.i686", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.ppc64", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.s390x", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.x86_64", relates_to_product_reference: "6Workstation", }, ], }, vulnerabilities: [ { cve: "CVE-2012-5643", cwe: { id: "CWE-401", name: "Missing Release of Memory after Effective Lifetime", }, discovery_date: "2012-12-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "887962", }, ], notes: [ { category: "description", text: "Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.", title: "Vulnerability description", }, { category: "summary", text: "squid: cachemgr.cgi memory usage DoS and memory leaks", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server:squid-7:3.1.10-16.el6.i686", "6Server:squid-7:3.1.10-16.el6.ppc64", "6Server:squid-7:3.1.10-16.el6.s390x", "6Server:squid-7:3.1.10-16.el6.src", "6Server:squid-7:3.1.10-16.el6.x86_64", "6Server:squid-debuginfo-7:3.1.10-16.el6.i686", "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64", "6Workstation:squid-7:3.1.10-16.el6.i686", "6Workstation:squid-7:3.1.10-16.el6.ppc64", "6Workstation:squid-7:3.1.10-16.el6.s390x", "6Workstation:squid-7:3.1.10-16.el6.src", "6Workstation:squid-7:3.1.10-16.el6.x86_64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2012-5643", }, { category: "external", summary: "RHBZ#887962", url: "https://bugzilla.redhat.com/show_bug.cgi?id=887962", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2012-5643", url: "https://www.cve.org/CVERecord?id=CVE-2012-5643", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2012-5643", url: "https://nvd.nist.gov/vuln/detail/CVE-2012-5643", }, ], release_date: "2012-12-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2013-02-20T16:19:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", product_ids: [ "6Server:squid-7:3.1.10-16.el6.i686", "6Server:squid-7:3.1.10-16.el6.ppc64", "6Server:squid-7:3.1.10-16.el6.s390x", "6Server:squid-7:3.1.10-16.el6.src", "6Server:squid-7:3.1.10-16.el6.x86_64", "6Server:squid-debuginfo-7:3.1.10-16.el6.i686", "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64", "6Workstation:squid-7:3.1.10-16.el6.i686", "6Workstation:squid-7:3.1.10-16.el6.ppc64", "6Workstation:squid-7:3.1.10-16.el6.s390x", "6Workstation:squid-7:3.1.10-16.el6.src", "6Workstation:squid-7:3.1.10-16.el6.x86_64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2013:0505", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, products: [ "6Server:squid-7:3.1.10-16.el6.i686", "6Server:squid-7:3.1.10-16.el6.ppc64", "6Server:squid-7:3.1.10-16.el6.s390x", "6Server:squid-7:3.1.10-16.el6.src", "6Server:squid-7:3.1.10-16.el6.x86_64", "6Server:squid-debuginfo-7:3.1.10-16.el6.i686", "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64", "6Workstation:squid-7:3.1.10-16.el6.i686", "6Workstation:squid-7:3.1.10-16.el6.ppc64", "6Workstation:squid-7:3.1.10-16.el6.s390x", "6Workstation:squid-7:3.1.10-16.el6.src", "6Workstation:squid-7:3.1.10-16.el6.x86_64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "squid: cachemgr.cgi memory usage DoS and memory leaks", }, ], }
rhsa-2013:0505
Vulnerability from csaf_redhat
Published
2013-02-20 16:19
Modified
2024-11-22 05:48
Summary
Red Hat Security Advisory: squid security and bug fix update
Notes
Topic
Updated squid packages that fix one security issue and several bugs are now
available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
Details
Squid is a high-performance proxy caching server for web clients that
supports FTP, Gopher, and HTTP data objects.
A denial of service flaw was found in the way the Squid Cache Manager
processed certain requests. A remote attacker who is able to access the
Cache Manager CGI could use this flaw to cause Squid to consume an
excessive amount of memory. (CVE-2012-5643)
This update also fixes the following bugs:
* Due to a bug in the ConnStateData::noteMoreBodySpaceAvailable() function,
child processes of Squid terminated upon encountering a failed assertion.
An upstream patch has been provided and Squid child processes no longer
terminate. (BZ#805879)
* Due to an upstream patch, which renamed the HTTP header controlling
persistent connections from "Proxy-Connection" to "Connection", the NTLM
pass-through authentication does not work, thus preventing login. This
update adds the new "http10" option to the squid.conf file, which can be
used to enable the change in the patch. This option is set to "off" by
default. When set to "on", the NTLM pass-through authentication works
properly, thus allowing login attempts to succeed. (BZ#844723)
* When the IPv6 protocol was disabled and Squid tried to handle an HTTP GET
request containing an IPv6 address, the Squid child process terminated due
to signal 6. This bug has been fixed and such requests are now handled as
expected. (BZ#832484)
* The old "stale if hit" logic did not account for cases where the stored
stale response became fresh due to a successful re-validation with the
origin server. Consequently, incorrect warning messages were returned. Now,
Squid no longer marks elements as stale in the described scenario.
(BZ#847056)
* When squid packages were installed before samba-winbind, the wbpriv group
did not include Squid. Consequently, NTLM authentication calls failed. Now,
Squid correctly adds itself into the wbpriv group if samba-winbind is
installed before Squid, thus fixing this bug. (BZ#797571)
* In FIPS mode, Squid was using private MD5 hash functions for user
authentication and network access. As MD5 is incompatible with FIPS mode,
Squid could fail to start. This update limits the use of the private MD5
functions to local disk file hash identifiers, thus allowing Squid to work
in FIPS mode. (BZ#833086)
* Under high system load, the squid process could terminate unexpectedly
with a segmentation fault during reboot. This update provides better memory
handling during reboot, thus fixing this bug. (BZ#782732)
* Squid incorrectly set the timeout limit for client HTTP connections with
the value for server-side connections, which is much higher, thus creating
unnecessary delays. With this update, Squid uses a proper value for the
client timeout limit. (BZ#798090)
* Squid did not properly release allocated memory when generating error
page contents, which caused memory leaks. Consequently, the Squid proxy
server consumed a lot of memory within a short time period. This update
fixes this memory leak. (BZ#758861)
* Squid did not pass the ident value to a URL rewriter that was configured
using the "url_rewrite_program" directive. Consequently, the URL rewriter
received the dash character ("–") as the user value instead of the correct
user name. Now, the URL rewriter receives the correct user name in the
described scenario. (BZ#797884)
* Squid, used as a transparent proxy, can only handle the HTTP protocol.
Previously, it was possible to define a URL in which the access protocol
contained the asterisk character (*) or an unknown protocol namespace URI.
Consequently, an "Invalid URL" error message was logged to access.log
during reload. This update ensures that "http://" is always used in
transparent proxy URLs, and the error message is no longer logged in this
scenario. (BZ#720504)
All users of squid are advised to upgrade to these updated packages, which
fix these issues. After installing this update, the squid service will be
restarted automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated squid packages that fix one security issue and several bugs are now\navailable for Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.", title: "Topic", }, { category: "general", text: "Squid is a high-performance proxy caching server for web clients that\nsupports FTP, Gopher, and HTTP data objects.\n\nA denial of service flaw was found in the way the Squid Cache Manager\nprocessed certain requests. A remote attacker who is able to access the\nCache Manager CGI could use this flaw to cause Squid to consume an\nexcessive amount of memory. (CVE-2012-5643)\n\nThis update also fixes the following bugs:\n\n* Due to a bug in the ConnStateData::noteMoreBodySpaceAvailable() function,\nchild processes of Squid terminated upon encountering a failed assertion.\nAn upstream patch has been provided and Squid child processes no longer\nterminate. (BZ#805879)\n\n* Due to an upstream patch, which renamed the HTTP header controlling\npersistent connections from \"Proxy-Connection\" to \"Connection\", the NTLM\npass-through authentication does not work, thus preventing login. This\nupdate adds the new \"http10\" option to the squid.conf file, which can be\nused to enable the change in the patch. This option is set to \"off\" by\ndefault. When set to \"on\", the NTLM pass-through authentication works\nproperly, thus allowing login attempts to succeed. (BZ#844723)\n\n* When the IPv6 protocol was disabled and Squid tried to handle an HTTP GET\nrequest containing an IPv6 address, the Squid child process terminated due\nto signal 6. This bug has been fixed and such requests are now handled as\nexpected. (BZ#832484)\n\n* The old \"stale if hit\" logic did not account for cases where the stored\nstale response became fresh due to a successful re-validation with the\norigin server. Consequently, incorrect warning messages were returned. Now,\nSquid no longer marks elements as stale in the described scenario.\n(BZ#847056)\n\n* When squid packages were installed before samba-winbind, the wbpriv group\ndid not include Squid. Consequently, NTLM authentication calls failed. Now,\nSquid correctly adds itself into the wbpriv group if samba-winbind is\ninstalled before Squid, thus fixing this bug. (BZ#797571)\n\n* In FIPS mode, Squid was using private MD5 hash functions for user\nauthentication and network access. As MD5 is incompatible with FIPS mode,\nSquid could fail to start. This update limits the use of the private MD5\nfunctions to local disk file hash identifiers, thus allowing Squid to work\nin FIPS mode. (BZ#833086)\n\n* Under high system load, the squid process could terminate unexpectedly\nwith a segmentation fault during reboot. This update provides better memory\nhandling during reboot, thus fixing this bug. (BZ#782732)\n\n* Squid incorrectly set the timeout limit for client HTTP connections with\nthe value for server-side connections, which is much higher, thus creating\nunnecessary delays. With this update, Squid uses a proper value for the\nclient timeout limit. (BZ#798090)\n\n* Squid did not properly release allocated memory when generating error\npage contents, which caused memory leaks. Consequently, the Squid proxy\nserver consumed a lot of memory within a short time period. This update\nfixes this memory leak. (BZ#758861)\n\n* Squid did not pass the ident value to a URL rewriter that was configured\nusing the \"url_rewrite_program\" directive. Consequently, the URL rewriter\nreceived the dash character (\"–\") as the user value instead of the correct\nuser name. Now, the URL rewriter receives the correct user name in the\ndescribed scenario. (BZ#797884)\n\n* Squid, used as a transparent proxy, can only handle the HTTP protocol.\nPreviously, it was possible to define a URL in which the access protocol\ncontained the asterisk character (*) or an unknown protocol namespace URI.\nConsequently, an \"Invalid URL\" error message was logged to access.log\nduring reload. This update ensures that \"http://\" is always used in\ntransparent proxy URLs, and the error message is no longer logged in this\nscenario. (BZ#720504)\n\nAll users of squid are advised to upgrade to these updated packages, which\nfix these issues. After installing this update, the squid service will be\nrestarted automatically.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2013:0505", url: "https://access.redhat.com/errata/RHSA-2013:0505", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.4_Technical_Notes/squid.html", url: "https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.4_Technical_Notes/squid.html", }, { category: "external", summary: "797571", url: "https://bugzilla.redhat.com/show_bug.cgi?id=797571", }, { category: "external", summary: "798090", url: "https://bugzilla.redhat.com/show_bug.cgi?id=798090", }, { category: "external", summary: "832484", url: "https://bugzilla.redhat.com/show_bug.cgi?id=832484", }, { category: "external", summary: "833086", url: "https://bugzilla.redhat.com/show_bug.cgi?id=833086", }, { category: "external", summary: "844723", url: "https://bugzilla.redhat.com/show_bug.cgi?id=844723", }, { category: "external", summary: "847056", url: "https://bugzilla.redhat.com/show_bug.cgi?id=847056", }, { category: "external", summary: "887962", url: "https://bugzilla.redhat.com/show_bug.cgi?id=887962", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0505.json", }, ], title: "Red Hat Security Advisory: squid security and bug fix update", tracking: { current_release_date: "2024-11-22T05:48:01+00:00", generator: { date: "2024-11-22T05:48:01+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2013:0505", initial_release_date: "2013-02-20T16:19:00+00:00", revision_history: [ { date: "2013-02-20T16:19:00+00:00", number: "1", summary: "Initial version", }, { date: "2013-02-20T16:30:33+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T05:48:01+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux Server (v. 6)", product: { name: "Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:6::server", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Workstation (v. 6)", product: { name: "Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:6::workstation", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-16.el6.src", product: { name: "squid-7:3.1.10-16.el6.src", product_id: "squid-7:3.1.10-16.el6.src", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=src&epoch=7", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-16.el6.x86_64", product: { name: "squid-7:3.1.10-16.el6.x86_64", product_id: "squid-7:3.1.10-16.el6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=x86_64&epoch=7", }, }, }, { category: "product_version", name: "squid-debuginfo-7:3.1.10-16.el6.x86_64", product: { name: "squid-debuginfo-7:3.1.10-16.el6.x86_64", product_id: "squid-debuginfo-7:3.1.10-16.el6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=x86_64&epoch=7", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-16.el6.i686", product: { name: "squid-7:3.1.10-16.el6.i686", product_id: "squid-7:3.1.10-16.el6.i686", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=i686&epoch=7", }, }, }, { category: "product_version", name: "squid-debuginfo-7:3.1.10-16.el6.i686", product: { name: "squid-debuginfo-7:3.1.10-16.el6.i686", product_id: "squid-debuginfo-7:3.1.10-16.el6.i686", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=i686&epoch=7", }, }, }, ], category: "architecture", name: "i686", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-16.el6.s390x", product: { name: "squid-7:3.1.10-16.el6.s390x", product_id: "squid-7:3.1.10-16.el6.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=s390x&epoch=7", }, }, }, { category: "product_version", name: "squid-debuginfo-7:3.1.10-16.el6.s390x", product: { name: "squid-debuginfo-7:3.1.10-16.el6.s390x", product_id: "squid-debuginfo-7:3.1.10-16.el6.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=s390x&epoch=7", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-16.el6.ppc64", product: { name: "squid-7:3.1.10-16.el6.ppc64", product_id: "squid-7:3.1.10-16.el6.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=ppc64&epoch=7", }, }, }, { category: "product_version", name: "squid-debuginfo-7:3.1.10-16.el6.ppc64", product: { name: "squid-debuginfo-7:3.1.10-16.el6.ppc64", product_id: "squid-debuginfo-7:3.1.10-16.el6.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=ppc64&epoch=7", }, }, }, ], category: "architecture", name: "ppc64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-7:3.1.10-16.el6.i686", }, product_reference: "squid-7:3.1.10-16.el6.i686", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-7:3.1.10-16.el6.ppc64", }, product_reference: "squid-7:3.1.10-16.el6.ppc64", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-7:3.1.10-16.el6.s390x", }, product_reference: "squid-7:3.1.10-16.el6.s390x", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.src as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-7:3.1.10-16.el6.src", }, product_reference: "squid-7:3.1.10-16.el6.src", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-7:3.1.10-16.el6.x86_64", }, product_reference: "squid-7:3.1.10-16.el6.x86_64", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-debuginfo-7:3.1.10-16.el6.i686", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.i686", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.ppc64", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.s390x", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.x86_64", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-7:3.1.10-16.el6.i686", }, product_reference: "squid-7:3.1.10-16.el6.i686", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-7:3.1.10-16.el6.ppc64", }, product_reference: "squid-7:3.1.10-16.el6.ppc64", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-7:3.1.10-16.el6.s390x", }, product_reference: "squid-7:3.1.10-16.el6.s390x", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-7:3.1.10-16.el6.src", }, product_reference: "squid-7:3.1.10-16.el6.src", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-7:3.1.10-16.el6.x86_64", }, product_reference: "squid-7:3.1.10-16.el6.x86_64", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.i686", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.ppc64", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.s390x", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.x86_64", relates_to_product_reference: "6Workstation", }, ], }, vulnerabilities: [ { cve: "CVE-2012-5643", cwe: { id: "CWE-401", name: "Missing Release of Memory after Effective Lifetime", }, discovery_date: "2012-12-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "887962", }, ], notes: [ { category: "description", text: "Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.", title: "Vulnerability description", }, { category: "summary", text: "squid: cachemgr.cgi memory usage DoS and memory leaks", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server:squid-7:3.1.10-16.el6.i686", "6Server:squid-7:3.1.10-16.el6.ppc64", "6Server:squid-7:3.1.10-16.el6.s390x", "6Server:squid-7:3.1.10-16.el6.src", "6Server:squid-7:3.1.10-16.el6.x86_64", "6Server:squid-debuginfo-7:3.1.10-16.el6.i686", "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64", "6Workstation:squid-7:3.1.10-16.el6.i686", "6Workstation:squid-7:3.1.10-16.el6.ppc64", "6Workstation:squid-7:3.1.10-16.el6.s390x", "6Workstation:squid-7:3.1.10-16.el6.src", "6Workstation:squid-7:3.1.10-16.el6.x86_64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2012-5643", }, { category: "external", summary: "RHBZ#887962", url: "https://bugzilla.redhat.com/show_bug.cgi?id=887962", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2012-5643", url: "https://www.cve.org/CVERecord?id=CVE-2012-5643", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2012-5643", url: "https://nvd.nist.gov/vuln/detail/CVE-2012-5643", }, ], release_date: "2012-12-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2013-02-20T16:19:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", product_ids: [ "6Server:squid-7:3.1.10-16.el6.i686", "6Server:squid-7:3.1.10-16.el6.ppc64", "6Server:squid-7:3.1.10-16.el6.s390x", "6Server:squid-7:3.1.10-16.el6.src", "6Server:squid-7:3.1.10-16.el6.x86_64", "6Server:squid-debuginfo-7:3.1.10-16.el6.i686", "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64", "6Workstation:squid-7:3.1.10-16.el6.i686", "6Workstation:squid-7:3.1.10-16.el6.ppc64", "6Workstation:squid-7:3.1.10-16.el6.s390x", "6Workstation:squid-7:3.1.10-16.el6.src", "6Workstation:squid-7:3.1.10-16.el6.x86_64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2013:0505", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, products: [ "6Server:squid-7:3.1.10-16.el6.i686", "6Server:squid-7:3.1.10-16.el6.ppc64", "6Server:squid-7:3.1.10-16.el6.s390x", "6Server:squid-7:3.1.10-16.el6.src", "6Server:squid-7:3.1.10-16.el6.x86_64", "6Server:squid-debuginfo-7:3.1.10-16.el6.i686", "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64", "6Workstation:squid-7:3.1.10-16.el6.i686", "6Workstation:squid-7:3.1.10-16.el6.ppc64", "6Workstation:squid-7:3.1.10-16.el6.s390x", "6Workstation:squid-7:3.1.10-16.el6.src", "6Workstation:squid-7:3.1.10-16.el6.x86_64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "squid: cachemgr.cgi memory usage DoS and memory leaks", }, ], }
rhsa-2013_0505
Vulnerability from csaf_redhat
Published
2013-02-20 16:19
Modified
2024-11-22 05:48
Summary
Red Hat Security Advisory: squid security and bug fix update
Notes
Topic
Updated squid packages that fix one security issue and several bugs are now
available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
Details
Squid is a high-performance proxy caching server for web clients that
supports FTP, Gopher, and HTTP data objects.
A denial of service flaw was found in the way the Squid Cache Manager
processed certain requests. A remote attacker who is able to access the
Cache Manager CGI could use this flaw to cause Squid to consume an
excessive amount of memory. (CVE-2012-5643)
This update also fixes the following bugs:
* Due to a bug in the ConnStateData::noteMoreBodySpaceAvailable() function,
child processes of Squid terminated upon encountering a failed assertion.
An upstream patch has been provided and Squid child processes no longer
terminate. (BZ#805879)
* Due to an upstream patch, which renamed the HTTP header controlling
persistent connections from "Proxy-Connection" to "Connection", the NTLM
pass-through authentication does not work, thus preventing login. This
update adds the new "http10" option to the squid.conf file, which can be
used to enable the change in the patch. This option is set to "off" by
default. When set to "on", the NTLM pass-through authentication works
properly, thus allowing login attempts to succeed. (BZ#844723)
* When the IPv6 protocol was disabled and Squid tried to handle an HTTP GET
request containing an IPv6 address, the Squid child process terminated due
to signal 6. This bug has been fixed and such requests are now handled as
expected. (BZ#832484)
* The old "stale if hit" logic did not account for cases where the stored
stale response became fresh due to a successful re-validation with the
origin server. Consequently, incorrect warning messages were returned. Now,
Squid no longer marks elements as stale in the described scenario.
(BZ#847056)
* When squid packages were installed before samba-winbind, the wbpriv group
did not include Squid. Consequently, NTLM authentication calls failed. Now,
Squid correctly adds itself into the wbpriv group if samba-winbind is
installed before Squid, thus fixing this bug. (BZ#797571)
* In FIPS mode, Squid was using private MD5 hash functions for user
authentication and network access. As MD5 is incompatible with FIPS mode,
Squid could fail to start. This update limits the use of the private MD5
functions to local disk file hash identifiers, thus allowing Squid to work
in FIPS mode. (BZ#833086)
* Under high system load, the squid process could terminate unexpectedly
with a segmentation fault during reboot. This update provides better memory
handling during reboot, thus fixing this bug. (BZ#782732)
* Squid incorrectly set the timeout limit for client HTTP connections with
the value for server-side connections, which is much higher, thus creating
unnecessary delays. With this update, Squid uses a proper value for the
client timeout limit. (BZ#798090)
* Squid did not properly release allocated memory when generating error
page contents, which caused memory leaks. Consequently, the Squid proxy
server consumed a lot of memory within a short time period. This update
fixes this memory leak. (BZ#758861)
* Squid did not pass the ident value to a URL rewriter that was configured
using the "url_rewrite_program" directive. Consequently, the URL rewriter
received the dash character ("–") as the user value instead of the correct
user name. Now, the URL rewriter receives the correct user name in the
described scenario. (BZ#797884)
* Squid, used as a transparent proxy, can only handle the HTTP protocol.
Previously, it was possible to define a URL in which the access protocol
contained the asterisk character (*) or an unknown protocol namespace URI.
Consequently, an "Invalid URL" error message was logged to access.log
during reload. This update ensures that "http://" is always used in
transparent proxy URLs, and the error message is no longer logged in this
scenario. (BZ#720504)
All users of squid are advised to upgrade to these updated packages, which
fix these issues. After installing this update, the squid service will be
restarted automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated squid packages that fix one security issue and several bugs are now\navailable for Red Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.", title: "Topic", }, { category: "general", text: "Squid is a high-performance proxy caching server for web clients that\nsupports FTP, Gopher, and HTTP data objects.\n\nA denial of service flaw was found in the way the Squid Cache Manager\nprocessed certain requests. A remote attacker who is able to access the\nCache Manager CGI could use this flaw to cause Squid to consume an\nexcessive amount of memory. (CVE-2012-5643)\n\nThis update also fixes the following bugs:\n\n* Due to a bug in the ConnStateData::noteMoreBodySpaceAvailable() function,\nchild processes of Squid terminated upon encountering a failed assertion.\nAn upstream patch has been provided and Squid child processes no longer\nterminate. (BZ#805879)\n\n* Due to an upstream patch, which renamed the HTTP header controlling\npersistent connections from \"Proxy-Connection\" to \"Connection\", the NTLM\npass-through authentication does not work, thus preventing login. This\nupdate adds the new \"http10\" option to the squid.conf file, which can be\nused to enable the change in the patch. This option is set to \"off\" by\ndefault. When set to \"on\", the NTLM pass-through authentication works\nproperly, thus allowing login attempts to succeed. (BZ#844723)\n\n* When the IPv6 protocol was disabled and Squid tried to handle an HTTP GET\nrequest containing an IPv6 address, the Squid child process terminated due\nto signal 6. This bug has been fixed and such requests are now handled as\nexpected. (BZ#832484)\n\n* The old \"stale if hit\" logic did not account for cases where the stored\nstale response became fresh due to a successful re-validation with the\norigin server. Consequently, incorrect warning messages were returned. Now,\nSquid no longer marks elements as stale in the described scenario.\n(BZ#847056)\n\n* When squid packages were installed before samba-winbind, the wbpriv group\ndid not include Squid. Consequently, NTLM authentication calls failed. Now,\nSquid correctly adds itself into the wbpriv group if samba-winbind is\ninstalled before Squid, thus fixing this bug. (BZ#797571)\n\n* In FIPS mode, Squid was using private MD5 hash functions for user\nauthentication and network access. As MD5 is incompatible with FIPS mode,\nSquid could fail to start. This update limits the use of the private MD5\nfunctions to local disk file hash identifiers, thus allowing Squid to work\nin FIPS mode. (BZ#833086)\n\n* Under high system load, the squid process could terminate unexpectedly\nwith a segmentation fault during reboot. This update provides better memory\nhandling during reboot, thus fixing this bug. (BZ#782732)\n\n* Squid incorrectly set the timeout limit for client HTTP connections with\nthe value for server-side connections, which is much higher, thus creating\nunnecessary delays. With this update, Squid uses a proper value for the\nclient timeout limit. (BZ#798090)\n\n* Squid did not properly release allocated memory when generating error\npage contents, which caused memory leaks. Consequently, the Squid proxy\nserver consumed a lot of memory within a short time period. This update\nfixes this memory leak. (BZ#758861)\n\n* Squid did not pass the ident value to a URL rewriter that was configured\nusing the \"url_rewrite_program\" directive. Consequently, the URL rewriter\nreceived the dash character (\"–\") as the user value instead of the correct\nuser name. Now, the URL rewriter receives the correct user name in the\ndescribed scenario. (BZ#797884)\n\n* Squid, used as a transparent proxy, can only handle the HTTP protocol.\nPreviously, it was possible to define a URL in which the access protocol\ncontained the asterisk character (*) or an unknown protocol namespace URI.\nConsequently, an \"Invalid URL\" error message was logged to access.log\nduring reload. This update ensures that \"http://\" is always used in\ntransparent proxy URLs, and the error message is no longer logged in this\nscenario. (BZ#720504)\n\nAll users of squid are advised to upgrade to these updated packages, which\nfix these issues. After installing this update, the squid service will be\nrestarted automatically.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2013:0505", url: "https://access.redhat.com/errata/RHSA-2013:0505", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.4_Technical_Notes/squid.html", url: "https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.4_Technical_Notes/squid.html", }, { category: "external", summary: "797571", url: "https://bugzilla.redhat.com/show_bug.cgi?id=797571", }, { category: "external", summary: "798090", url: "https://bugzilla.redhat.com/show_bug.cgi?id=798090", }, { category: "external", summary: "832484", url: "https://bugzilla.redhat.com/show_bug.cgi?id=832484", }, { category: "external", summary: "833086", url: "https://bugzilla.redhat.com/show_bug.cgi?id=833086", }, { category: "external", summary: "844723", url: "https://bugzilla.redhat.com/show_bug.cgi?id=844723", }, { category: "external", summary: "847056", url: "https://bugzilla.redhat.com/show_bug.cgi?id=847056", }, { category: "external", summary: "887962", url: "https://bugzilla.redhat.com/show_bug.cgi?id=887962", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0505.json", }, ], title: "Red Hat Security Advisory: squid security and bug fix update", tracking: { current_release_date: "2024-11-22T05:48:01+00:00", generator: { date: "2024-11-22T05:48:01+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2013:0505", initial_release_date: "2013-02-20T16:19:00+00:00", revision_history: [ { date: "2013-02-20T16:19:00+00:00", number: "1", summary: "Initial version", }, { date: "2013-02-20T16:30:33+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T05:48:01+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux Server (v. 6)", product: { name: "Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:6::server", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Workstation (v. 6)", product: { name: "Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:6::workstation", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-16.el6.src", product: { name: "squid-7:3.1.10-16.el6.src", product_id: "squid-7:3.1.10-16.el6.src", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=src&epoch=7", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-16.el6.x86_64", product: { name: "squid-7:3.1.10-16.el6.x86_64", product_id: "squid-7:3.1.10-16.el6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=x86_64&epoch=7", }, }, }, { category: "product_version", name: "squid-debuginfo-7:3.1.10-16.el6.x86_64", product: { name: "squid-debuginfo-7:3.1.10-16.el6.x86_64", product_id: "squid-debuginfo-7:3.1.10-16.el6.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=x86_64&epoch=7", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-16.el6.i686", product: { name: "squid-7:3.1.10-16.el6.i686", product_id: "squid-7:3.1.10-16.el6.i686", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=i686&epoch=7", }, }, }, { category: "product_version", name: "squid-debuginfo-7:3.1.10-16.el6.i686", product: { name: "squid-debuginfo-7:3.1.10-16.el6.i686", product_id: "squid-debuginfo-7:3.1.10-16.el6.i686", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=i686&epoch=7", }, }, }, ], category: "architecture", name: "i686", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-16.el6.s390x", product: { name: "squid-7:3.1.10-16.el6.s390x", product_id: "squid-7:3.1.10-16.el6.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=s390x&epoch=7", }, }, }, { category: "product_version", name: "squid-debuginfo-7:3.1.10-16.el6.s390x", product: { name: "squid-debuginfo-7:3.1.10-16.el6.s390x", product_id: "squid-debuginfo-7:3.1.10-16.el6.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=s390x&epoch=7", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-16.el6.ppc64", product: { name: "squid-7:3.1.10-16.el6.ppc64", product_id: "squid-7:3.1.10-16.el6.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-16.el6?arch=ppc64&epoch=7", }, }, }, { category: "product_version", name: "squid-debuginfo-7:3.1.10-16.el6.ppc64", product: { name: "squid-debuginfo-7:3.1.10-16.el6.ppc64", product_id: "squid-debuginfo-7:3.1.10-16.el6.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-16.el6?arch=ppc64&epoch=7", }, }, }, ], category: "architecture", name: "ppc64", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-7:3.1.10-16.el6.i686", }, product_reference: "squid-7:3.1.10-16.el6.i686", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-7:3.1.10-16.el6.ppc64", }, product_reference: "squid-7:3.1.10-16.el6.ppc64", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-7:3.1.10-16.el6.s390x", }, product_reference: "squid-7:3.1.10-16.el6.s390x", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.src as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-7:3.1.10-16.el6.src", }, product_reference: "squid-7:3.1.10-16.el6.src", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-7:3.1.10-16.el6.x86_64", }, product_reference: "squid-7:3.1.10-16.el6.x86_64", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-debuginfo-7:3.1.10-16.el6.i686", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.i686", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.ppc64", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.s390x", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.x86_64", relates_to_product_reference: "6Server", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-7:3.1.10-16.el6.i686", }, product_reference: "squid-7:3.1.10-16.el6.i686", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-7:3.1.10-16.el6.ppc64", }, product_reference: "squid-7:3.1.10-16.el6.ppc64", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-7:3.1.10-16.el6.s390x", }, product_reference: "squid-7:3.1.10-16.el6.s390x", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-7:3.1.10-16.el6.src", }, product_reference: "squid-7:3.1.10-16.el6.src", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-7:3.1.10-16.el6.x86_64", }, product_reference: "squid-7:3.1.10-16.el6.x86_64", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.i686", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.ppc64", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.s390x", relates_to_product_reference: "6Workstation", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-16.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", product_id: "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64", }, product_reference: "squid-debuginfo-7:3.1.10-16.el6.x86_64", relates_to_product_reference: "6Workstation", }, ], }, vulnerabilities: [ { cve: "CVE-2012-5643", cwe: { id: "CWE-401", name: "Missing Release of Memory after Effective Lifetime", }, discovery_date: "2012-12-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "887962", }, ], notes: [ { category: "description", text: "Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.", title: "Vulnerability description", }, { category: "summary", text: "squid: cachemgr.cgi memory usage DoS and memory leaks", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server:squid-7:3.1.10-16.el6.i686", "6Server:squid-7:3.1.10-16.el6.ppc64", "6Server:squid-7:3.1.10-16.el6.s390x", "6Server:squid-7:3.1.10-16.el6.src", "6Server:squid-7:3.1.10-16.el6.x86_64", "6Server:squid-debuginfo-7:3.1.10-16.el6.i686", "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64", "6Workstation:squid-7:3.1.10-16.el6.i686", "6Workstation:squid-7:3.1.10-16.el6.ppc64", "6Workstation:squid-7:3.1.10-16.el6.s390x", "6Workstation:squid-7:3.1.10-16.el6.src", "6Workstation:squid-7:3.1.10-16.el6.x86_64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2012-5643", }, { category: "external", summary: "RHBZ#887962", url: "https://bugzilla.redhat.com/show_bug.cgi?id=887962", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2012-5643", url: "https://www.cve.org/CVERecord?id=CVE-2012-5643", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2012-5643", url: "https://nvd.nist.gov/vuln/detail/CVE-2012-5643", }, ], release_date: "2012-12-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2013-02-20T16:19:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", product_ids: [ "6Server:squid-7:3.1.10-16.el6.i686", "6Server:squid-7:3.1.10-16.el6.ppc64", "6Server:squid-7:3.1.10-16.el6.s390x", "6Server:squid-7:3.1.10-16.el6.src", "6Server:squid-7:3.1.10-16.el6.x86_64", "6Server:squid-debuginfo-7:3.1.10-16.el6.i686", "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64", "6Workstation:squid-7:3.1.10-16.el6.i686", "6Workstation:squid-7:3.1.10-16.el6.ppc64", "6Workstation:squid-7:3.1.10-16.el6.s390x", "6Workstation:squid-7:3.1.10-16.el6.src", "6Workstation:squid-7:3.1.10-16.el6.x86_64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2013:0505", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, products: [ "6Server:squid-7:3.1.10-16.el6.i686", "6Server:squid-7:3.1.10-16.el6.ppc64", "6Server:squid-7:3.1.10-16.el6.s390x", "6Server:squid-7:3.1.10-16.el6.src", "6Server:squid-7:3.1.10-16.el6.x86_64", "6Server:squid-debuginfo-7:3.1.10-16.el6.i686", "6Server:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Server:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Server:squid-debuginfo-7:3.1.10-16.el6.x86_64", "6Workstation:squid-7:3.1.10-16.el6.i686", "6Workstation:squid-7:3.1.10-16.el6.ppc64", "6Workstation:squid-7:3.1.10-16.el6.s390x", "6Workstation:squid-7:3.1.10-16.el6.src", "6Workstation:squid-7:3.1.10-16.el6.x86_64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.i686", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.ppc64", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.s390x", "6Workstation:squid-debuginfo-7:3.1.10-16.el6.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "squid: cachemgr.cgi memory usage DoS and memory leaks", }, ], }
suse-su-2016:2089-1
Vulnerability from csaf_suse
Published
2016-08-16 12:56
Modified
2016-08-16 12:56
Summary
Security update for squid3
Notes
Title of the patch
Security update for squid3
Description of the patch
This update for squid3 fixes the following issues:
- Multiple issues in pinger ICMP processing. (CVE-2014-7141, CVE-2014-7142)
- CVE-2016-3947: Buffer overrun issue in pinger
ICMPv6 processing. (bsc#973782)
- CVE-2016-4554: fix header smuggling issue in HTTP Request processing (bsc#979010)
- Fix multiple Denial of Service issues in HTTP Response processing.
(CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572,
bsc#968392, bsc#968393, bsc#968394, bsc#968395)
- Regression caused by the DoS fixes above (bsc#993299)
- CVE-2016-3948: Fix denial of service in HTTP Response processing (bsc#973783)
- CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553)
- CVE-2016-4052, CVE-2016-4053, CVE-2016-4054:
* fixes multiple issues in ESI processing (bsc#976556)
- CVE-2016-4556: fixes double free vulnerability in Esi.cc (bsc#979008)
- CVE-2015-5400: Improper Protection of Alternate Path (bsc#938715)
- CVE-2014-6270: fix off-by-one in snmp subsystem (bsc#895773)
- Memory leak in squid3 when using external_acl (bsc#976708)
Patchnames
slessp4-squid3-12701
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for squid3", title: "Title of the patch", }, { category: "description", text: "\n\nThis update for squid3 fixes the following issues:\n\n- Multiple issues in pinger ICMP processing. (CVE-2014-7141, CVE-2014-7142) \n\n- CVE-2016-3947: Buffer overrun issue in pinger\n ICMPv6 processing. (bsc#973782)\n\n- CVE-2016-4554: fix header smuggling issue in HTTP Request processing (bsc#979010)\n\n- Fix multiple Denial of Service issues in HTTP Response processing.\n (CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572,\n bsc#968392, bsc#968393, bsc#968394, bsc#968395)\n- Regression caused by the DoS fixes above (bsc#993299)\n\n- CVE-2016-3948: Fix denial of service in HTTP Response processing (bsc#973783)\n\n- CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553)\n\n- CVE-2016-4052, CVE-2016-4053, CVE-2016-4054:\n * fixes multiple issues in ESI processing (bsc#976556)\n\n- CVE-2016-4556: fixes double free vulnerability in Esi.cc (bsc#979008)\n\n- CVE-2015-5400: Improper Protection of Alternate Path (bsc#938715)\n\n- CVE-2014-6270: fix off-by-one in snmp subsystem (bsc#895773)\n\n- Memory leak in squid3 when using external_acl (bsc#976708)\n", title: "Description of the patch", }, { category: "details", text: "slessp4-squid3-12701", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_2089-1.json", }, { category: "self", summary: "URL for SUSE-SU-2016:2089-1", url: "https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/", }, { category: "self", summary: "E-Mail link for SUSE-SU-2016:2089-1", url: "https://lists.suse.com/pipermail/sle-security-updates/2016-August/002212.html", }, { category: "self", summary: "SUSE Bug 895773", url: "https://bugzilla.suse.com/895773", }, { category: "self", summary: "SUSE Bug 902197", url: "https://bugzilla.suse.com/902197", }, { category: "self", summary: "SUSE Bug 938715", url: "https://bugzilla.suse.com/938715", }, { category: "self", summary: "SUSE Bug 963539", url: "https://bugzilla.suse.com/963539", }, { category: "self", summary: "SUSE Bug 967011", url: "https://bugzilla.suse.com/967011", }, { category: "self", summary: "SUSE Bug 968392", url: "https://bugzilla.suse.com/968392", }, { category: "self", summary: "SUSE Bug 968393", url: "https://bugzilla.suse.com/968393", }, { category: "self", summary: "SUSE Bug 968394", url: "https://bugzilla.suse.com/968394", }, { category: "self", summary: "SUSE Bug 968395", url: "https://bugzilla.suse.com/968395", }, { category: "self", summary: "SUSE Bug 973782", url: "https://bugzilla.suse.com/973782", }, { category: "self", summary: "SUSE Bug 973783", url: "https://bugzilla.suse.com/973783", }, { category: "self", summary: "SUSE Bug 976553", url: "https://bugzilla.suse.com/976553", }, { category: "self", summary: "SUSE Bug 976556", url: "https://bugzilla.suse.com/976556", }, { category: "self", summary: "SUSE Bug 976708", url: "https://bugzilla.suse.com/976708", }, { category: "self", summary: "SUSE Bug 979008", url: "https://bugzilla.suse.com/979008", }, { category: "self", summary: "SUSE Bug 979009", url: "https://bugzilla.suse.com/979009", }, { category: "self", summary: "SUSE Bug 979010", url: "https://bugzilla.suse.com/979010", }, { category: "self", summary: "SUSE Bug 979011", url: "https://bugzilla.suse.com/979011", }, { category: "self", summary: "SUSE Bug 993299", url: "https://bugzilla.suse.com/993299", }, { category: "self", summary: "SUSE CVE CVE-2011-3205 page", url: "https://www.suse.com/security/cve/CVE-2011-3205/", }, { category: "self", summary: "SUSE CVE CVE-2011-4096 page", url: "https://www.suse.com/security/cve/CVE-2011-4096/", }, { category: "self", summary: "SUSE CVE CVE-2012-5643 page", url: "https://www.suse.com/security/cve/CVE-2012-5643/", }, { category: "self", summary: "SUSE CVE CVE-2013-0188 page", url: "https://www.suse.com/security/cve/CVE-2013-0188/", }, { category: "self", summary: "SUSE CVE CVE-2013-4115 page", url: "https://www.suse.com/security/cve/CVE-2013-4115/", }, { category: "self", summary: "SUSE CVE CVE-2014-0128 page", url: "https://www.suse.com/security/cve/CVE-2014-0128/", }, { category: "self", summary: "SUSE CVE CVE-2014-6270 page", url: "https://www.suse.com/security/cve/CVE-2014-6270/", }, { category: "self", summary: "SUSE CVE CVE-2014-7141 page", url: "https://www.suse.com/security/cve/CVE-2014-7141/", }, { category: "self", summary: "SUSE CVE CVE-2014-7142 page", url: "https://www.suse.com/security/cve/CVE-2014-7142/", }, { category: "self", summary: "SUSE CVE CVE-2015-5400 page", url: "https://www.suse.com/security/cve/CVE-2015-5400/", }, { category: "self", summary: "SUSE CVE CVE-2016-2390 page", url: "https://www.suse.com/security/cve/CVE-2016-2390/", }, { category: "self", summary: "SUSE CVE CVE-2016-2569 page", url: "https://www.suse.com/security/cve/CVE-2016-2569/", }, { category: "self", summary: "SUSE CVE CVE-2016-2570 page", url: "https://www.suse.com/security/cve/CVE-2016-2570/", }, { category: "self", summary: "SUSE CVE CVE-2016-2571 page", url: "https://www.suse.com/security/cve/CVE-2016-2571/", }, { category: "self", summary: "SUSE CVE CVE-2016-2572 page", url: "https://www.suse.com/security/cve/CVE-2016-2572/", }, { category: "self", summary: "SUSE CVE CVE-2016-3947 page", url: "https://www.suse.com/security/cve/CVE-2016-3947/", }, { category: "self", summary: "SUSE CVE CVE-2016-3948 page", url: "https://www.suse.com/security/cve/CVE-2016-3948/", }, { category: "self", summary: "SUSE CVE CVE-2016-4051 page", url: "https://www.suse.com/security/cve/CVE-2016-4051/", }, { category: "self", summary: "SUSE CVE CVE-2016-4052 page", url: "https://www.suse.com/security/cve/CVE-2016-4052/", }, { category: "self", summary: "SUSE CVE CVE-2016-4053 page", url: "https://www.suse.com/security/cve/CVE-2016-4053/", }, { category: "self", summary: "SUSE CVE CVE-2016-4054 page", url: "https://www.suse.com/security/cve/CVE-2016-4054/", }, { category: "self", summary: "SUSE CVE CVE-2016-4553 page", url: "https://www.suse.com/security/cve/CVE-2016-4553/", }, { category: "self", summary: "SUSE CVE CVE-2016-4554 page", url: "https://www.suse.com/security/cve/CVE-2016-4554/", }, { category: "self", summary: "SUSE CVE CVE-2016-4555 page", url: "https://www.suse.com/security/cve/CVE-2016-4555/", }, { category: "self", summary: "SUSE CVE CVE-2016-4556 page", url: "https://www.suse.com/security/cve/CVE-2016-4556/", }, ], title: "Security update for squid3", tracking: { current_release_date: "2016-08-16T12:56:03Z", generator: { date: "2016-08-16T12:56:03Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "SUSE-SU-2016:2089-1", initial_release_date: "2016-08-16T12:56:03Z", revision_history: [ { date: "2016-08-16T12:56:03Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "squid3-3.1.23-8.16.30.1.i586", product: { name: "squid3-3.1.23-8.16.30.1.i586", product_id: "squid3-3.1.23-8.16.30.1.i586", }, }, ], category: "architecture", name: "i586", }, { branches: [ { category: "product_version", name: "squid3-3.1.23-8.16.30.1.ia64", product: { name: "squid3-3.1.23-8.16.30.1.ia64", product_id: "squid3-3.1.23-8.16.30.1.ia64", }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "squid3-3.1.23-8.16.30.1.ppc64", product: { name: "squid3-3.1.23-8.16.30.1.ppc64", product_id: "squid3-3.1.23-8.16.30.1.ppc64", }, }, ], category: "architecture", name: "ppc64", }, { branches: [ { category: "product_version", name: "squid3-3.1.23-8.16.30.1.s390x", product: { name: "squid3-3.1.23-8.16.30.1.s390x", product_id: "squid3-3.1.23-8.16.30.1.s390x", }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "squid3-3.1.23-8.16.30.1.x86_64", product: { name: "squid3-3.1.23-8.16.30.1.x86_64", product_id: "squid3-3.1.23-8.16.30.1.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "SUSE Linux Enterprise Server 11 SP4", product: { name: "SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4", product_identification_helper: { cpe: "cpe:/o:suse:suse_sles:11:sp4", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", product: { name: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_identification_helper: { cpe: "cpe:/o:suse:sles_sap:11:sp4", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.i586 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", }, product_reference: "squid3-3.1.23-8.16.30.1.i586", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.ia64 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", }, product_reference: "squid3-3.1.23-8.16.30.1.ia64", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.ppc64 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", }, product_reference: "squid3-3.1.23-8.16.30.1.ppc64", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.s390x as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", }, product_reference: "squid3-3.1.23-8.16.30.1.s390x", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", }, product_reference: "squid3-3.1.23-8.16.30.1.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.i586 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", }, product_reference: "squid3-3.1.23-8.16.30.1.i586", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.ia64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", }, product_reference: "squid3-3.1.23-8.16.30.1.ia64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.ppc64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", }, product_reference: "squid3-3.1.23-8.16.30.1.ppc64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", }, product_reference: "squid3-3.1.23-8.16.30.1.s390x", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", }, product_reference: "squid3-3.1.23-8.16.30.1.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, ], }, vulnerabilities: [ { cve: "CVE-2011-3205", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2011-3205", }, ], notes: [ { category: "general", text: "Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2011-3205", url: "https://www.suse.com/security/cve/CVE-2011-3205", }, { category: "external", summary: "SUSE Bug 715171 for CVE-2011-3205", url: "https://bugzilla.suse.com/715171", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2011-3205", }, { cve: "CVE-2011-4096", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2011-4096", }, ], notes: [ { category: "general", text: "The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service (daemon abort) via a DNS reply containing a CNAME record that references another CNAME record that contains an empty A record.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2011-4096", url: "https://www.suse.com/security/cve/CVE-2011-4096", }, { category: "external", summary: "SUSE Bug 727492 for CVE-2011-4096", url: "https://bugzilla.suse.com/727492", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2011-4096", }, { cve: "CVE-2012-5643", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2012-5643", }, ], notes: [ { category: "general", text: "Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2012-5643", url: "https://www.suse.com/security/cve/CVE-2012-5643", }, { category: "external", summary: "SUSE Bug 794954 for CVE-2012-5643", url: "https://bugzilla.suse.com/794954", }, { category: "external", summary: "SUSE Bug 796999 for CVE-2012-5643", url: "https://bugzilla.suse.com/796999", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2012-5643", }, { cve: "CVE-2013-0188", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2013-0188", }, ], notes: [ { category: "general", text: "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-0189, CVE-2013-0191. Reason: this identifier was intended for one issue, but it was inadvertently associated with multiple issues. Notes: All CVE users should consult CVE-2013-0189 and CVE-2013-0191 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2013-0188", url: "https://www.suse.com/security/cve/CVE-2013-0188", }, { category: "external", summary: "SUSE Bug 794954 for CVE-2013-0188", url: "https://bugzilla.suse.com/794954", }, { category: "external", summary: "SUSE Bug 796999 for CVE-2013-0188", url: "https://bugzilla.suse.com/796999", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2013-0188", }, { cve: "CVE-2013-4115", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2013-4115", }, ], notes: [ { category: "general", text: "Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows remote attackers to cause a denial of service (memory corruption and server termination) via a long name in a DNS lookup request.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2013-4115", url: "https://www.suse.com/security/cve/CVE-2013-4115", }, { category: "external", summary: "SUSE Bug 829084 for CVE-2013-4115", url: "https://bugzilla.suse.com/829084", }, { category: "external", summary: "SUSE Bug 880233 for CVE-2013-4115", url: "https://bugzilla.suse.com/880233", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2013-4115", }, { cve: "CVE-2014-0128", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2014-0128", }, ], notes: [ { category: "general", text: "Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2014-0128", url: "https://www.suse.com/security/cve/CVE-2014-0128", }, { category: "external", summary: "SUSE Bug 867533 for CVE-2014-0128", url: "https://bugzilla.suse.com/867533", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2014-0128", }, { cve: "CVE-2014-6270", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2014-6270", }, ], notes: [ { category: "general", text: "Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted UDP SNMP request, which triggers a heap-based buffer overflow.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2014-6270", url: "https://www.suse.com/security/cve/CVE-2014-6270", }, { category: "external", summary: "SUSE Bug 895773 for CVE-2014-6270", url: "https://bugzilla.suse.com/895773", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2014-6270", }, { cve: "CVE-2014-7141", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2014-7141", }, ], notes: [ { category: "general", text: "The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2014-7141", url: "https://www.suse.com/security/cve/CVE-2014-7141", }, { category: "external", summary: "SUSE Bug 1040640 for CVE-2014-7141", url: "https://bugzilla.suse.com/1040640", }, { category: "external", summary: "SUSE Bug 891268 for CVE-2014-7141", url: "https://bugzilla.suse.com/891268", }, { category: "external", summary: "SUSE Bug 895773 for CVE-2014-7141", url: "https://bugzilla.suse.com/895773", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2014-7141", }, { cve: "CVE-2014-7142", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2014-7142", }, ], notes: [ { category: "general", text: "The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2014-7142", url: "https://www.suse.com/security/cve/CVE-2014-7142", }, { category: "external", summary: "SUSE Bug 895773 for CVE-2014-7142", url: "https://bugzilla.suse.com/895773", }, { category: "external", summary: "SUSE Bug 973782 for CVE-2014-7142", url: "https://bugzilla.suse.com/973782", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2014-7142", }, { cve: "CVE-2015-5400", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-5400", }, ], notes: [ { category: "general", text: "Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-5400", url: "https://www.suse.com/security/cve/CVE-2015-5400", }, { category: "external", summary: "SUSE Bug 938715 for CVE-2015-5400", url: "https://bugzilla.suse.com/938715", }, { category: "external", summary: "SUSE Bug 967073 for CVE-2015-5400", url: "https://bugzilla.suse.com/967073", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2015-5400", }, { cve: "CVE-2016-2390", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-2390", }, ], notes: [ { category: "general", text: "The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-2390", url: "https://www.suse.com/security/cve/CVE-2016-2390", }, { category: "external", summary: "SUSE Bug 967011 for CVE-2016-2390", url: "https://bugzilla.suse.com/967011", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2016-2390", }, { cve: "CVE-2016-2569", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-2569", }, ], notes: [ { category: "general", text: "Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-2569", url: "https://www.suse.com/security/cve/CVE-2016-2569", }, { category: "external", summary: "SUSE Bug 968392 for CVE-2016-2569", url: "https://bugzilla.suse.com/968392", }, { category: "external", summary: "SUSE Bug 968393 for CVE-2016-2569", url: "https://bugzilla.suse.com/968393", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-2569", }, { cve: "CVE-2016-2570", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-2570", }, ], notes: [ { category: "general", text: "The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-2570", url: "https://www.suse.com/security/cve/CVE-2016-2570", }, { category: "external", summary: "SUSE Bug 968392 for CVE-2016-2570", url: "https://bugzilla.suse.com/968392", }, { category: "external", summary: "SUSE Bug 968393 for CVE-2016-2570", url: "https://bugzilla.suse.com/968393", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-2570", }, { cve: "CVE-2016-2571", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-2571", }, ], notes: [ { category: "general", text: "http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-2571", url: "https://www.suse.com/security/cve/CVE-2016-2571", }, { category: "external", summary: "SUSE Bug 968394 for CVE-2016-2571", url: "https://bugzilla.suse.com/968394", }, { category: "external", summary: "SUSE Bug 968395 for CVE-2016-2571", url: "https://bugzilla.suse.com/968395", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-2571", }, { cve: "CVE-2016-2572", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-2572", }, ], notes: [ { category: "general", text: "http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-2572", url: "https://www.suse.com/security/cve/CVE-2016-2572", }, { category: "external", summary: "SUSE Bug 968394 for CVE-2016-2572", url: "https://bugzilla.suse.com/968394", }, { category: "external", summary: "SUSE Bug 968395 for CVE-2016-2572", url: "https://bugzilla.suse.com/968395", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-2572", }, { cve: "CVE-2016-3947", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-3947", }, ], notes: [ { category: "general", text: "Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 allows remote servers to cause a denial of service (performance degradation or transition failures) or write sensitive information to log files via an ICMPv6 packet.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-3947", url: "https://www.suse.com/security/cve/CVE-2016-3947", }, { category: "external", summary: "SUSE Bug 973782 for CVE-2016-3947", url: "https://bugzilla.suse.com/973782", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.2, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2016-3947", }, { cve: "CVE-2016-3948", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-3948", }, ], notes: [ { category: "general", text: "Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP response, related to Vary headers.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-3948", url: "https://www.suse.com/security/cve/CVE-2016-3948", }, { category: "external", summary: "SUSE Bug 973783 for CVE-2016-3948", url: "https://bugzilla.suse.com/973783", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2016-3948", }, { cve: "CVE-2016-4051", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4051", }, ], notes: [ { category: "general", text: "Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4051", url: "https://www.suse.com/security/cve/CVE-2016-4051", }, { category: "external", summary: "SUSE Bug 976553 for CVE-2016-4051", url: "https://bugzilla.suse.com/976553", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.8, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-4051", }, { cve: "CVE-2016-4052", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4052", }, ], notes: [ { category: "general", text: "Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4052", url: "https://www.suse.com/security/cve/CVE-2016-4052", }, { category: "external", summary: "SUSE Bug 976556 for CVE-2016-4052", url: "https://bugzilla.suse.com/976556", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.1, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-4052", }, { cve: "CVE-2016-4053", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4053", }, ], notes: [ { category: "general", text: "Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4053", url: "https://www.suse.com/security/cve/CVE-2016-4053", }, { category: "external", summary: "SUSE Bug 976556 for CVE-2016-4053", url: "https://bugzilla.suse.com/976556", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 3.7, baseSeverity: "LOW", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-4053", }, { cve: "CVE-2016-4054", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4054", }, ], notes: [ { category: "general", text: "Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4054", url: "https://www.suse.com/security/cve/CVE-2016-4054", }, { category: "external", summary: "SUSE Bug 976556 for CVE-2016-4054", url: "https://bugzilla.suse.com/976556", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.1, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-4054", }, { cve: "CVE-2016-4553", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4553", }, ], notes: [ { category: "general", text: "client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4553", url: "https://www.suse.com/security/cve/CVE-2016-4553", }, { category: "external", summary: "SUSE Bug 979009 for CVE-2016-4553", url: "https://bugzilla.suse.com/979009", }, { category: "external", summary: "SUSE Bug 990451 for CVE-2016-4553", url: "https://bugzilla.suse.com/990451", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.6, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2016-4553", }, { cve: "CVE-2016-4554", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4554", }, ], notes: [ { category: "general", text: "mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a \"header smuggling\" issue.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4554", url: "https://www.suse.com/security/cve/CVE-2016-4554", }, { category: "external", summary: "SUSE Bug 979010 for CVE-2016-4554", url: "https://bugzilla.suse.com/979010", }, { category: "external", summary: "SUSE Bug 990451 for CVE-2016-4554", url: "https://bugzilla.suse.com/990451", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.6, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2016-4554", }, { cve: "CVE-2016-4555", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4555", }, ], notes: [ { category: "general", text: "client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4555", url: "https://www.suse.com/security/cve/CVE-2016-4555", }, { category: "external", summary: "SUSE Bug 979008 for CVE-2016-4555", url: "https://bugzilla.suse.com/979008", }, { category: "external", summary: "SUSE Bug 979011 for CVE-2016-4555", url: "https://bugzilla.suse.com/979011", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2016-4555", }, { cve: "CVE-2016-4556", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4556", }, ], notes: [ { category: "general", text: "Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4556", url: "https://www.suse.com/security/cve/CVE-2016-4556", }, { category: "external", summary: "SUSE Bug 979008 for CVE-2016-4556", url: "https://bugzilla.suse.com/979008", }, { category: "external", summary: "SUSE Bug 979011 for CVE-2016-4556", url: "https://bugzilla.suse.com/979011", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2016-4556", }, ], }
fkie_cve-2012-5643
Vulnerability from fkie_nvd
Published
2012-12-20 12:02
Modified
2025-04-11 00:51
Severity ?
Summary
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:squid-cache:squid:2.0:*:*:*:*:*:*:*", matchCriteriaId: "B7EB3DBC-313E-4F55-90F3-BED0918A4EFE", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:2.1:*:*:*:*:*:*:*", matchCriteriaId: "C3DCC264-510E-43D1-9C13-99CEA54C7940", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:2.2:*:*:*:*:*:*:*", matchCriteriaId: "ED31C038-4142-4C2C-B540-9223C5C199FB", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:2.3:*:*:*:*:*:*:*", matchCriteriaId: "177060A9-6211-4B6D-96BE-48B4BD1FAFEE", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:2.4:*:*:*:*:*:*:*", matchCriteriaId: "A7E210DD-8EE6-4182-A78E-F791FCFDEFCF", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:2.5:*:*:*:*:*:*:*", matchCriteriaId: "50327E36-756E-434D-804D-1E44A4ABAE1F", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:2.6:*:*:*:*:*:*:*", matchCriteriaId: "3AE100C3-0245-4305-B514-77D0572C2947", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:2.7:*:*:*:*:*:*:*", matchCriteriaId: "35C30CB9-FA3A-408D-A8B0-8805E75657BE", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:2.7:stable3:*:*:*:*:*:*", matchCriteriaId: "A03692DD-779F-4E3C-861C-29943870A816", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:2.7:stable4:*:*:*:*:*:*", matchCriteriaId: "79FF6B3C-A3CE-4AA2-80F9-44D05A6B2F08", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:squid-cache:squid:3.0:*:*:*:*:*:*:*", matchCriteriaId: "62B9F669-6217-498A-902E-22EDEEFC565E", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0:-:pre1:*:*:*:*:*", matchCriteriaId: "ED54A2B3-6D36-4016-9BF1-83FAD500103F", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0:-:pre2:*:*:*:*:*", matchCriteriaId: "C4F368E3-88A6-463C-AA18-8FA1B9E35A84", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0:-:pre3:*:*:*:*:*", matchCriteriaId: "1451771E-F456-4631-89C8-0A49F4C8F03B", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0:-:pre4:*:*:*:*:*", matchCriteriaId: "FC881283-D0DF-482E-8A06-5CFCF0FA0BB6", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0:-:pre5:*:*:*:*:*", matchCriteriaId: "E746946A-2D07-402B-A071-9B674F6FEA75", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0:-:pre6:*:*:*:*:*", matchCriteriaId: "6B1A697B-3777-492F-BA53-0BA7A9934C03", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0:-:pre7:*:*:*:*:*", matchCriteriaId: "1C579925-591E-4BD7-A888-B8D2B0228D34", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0:rc4:*:*:*:*:*:*", matchCriteriaId: "131C4C00-3811-42BF-A84A-EB2E5DA156B4", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable1:*:*:*:*:*:*:*", matchCriteriaId: "047EDDD6-02F5-4B53-8FCA-781962392080", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable2:*:*:*:*:*:*:*", matchCriteriaId: "01AD43AB-40BF-449F-A121-A8587E7AE449", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable3:*:*:*:*:*:*:*", matchCriteriaId: "3942285D-E20C-45C5-9EF8-821F6D782CB8", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable4:*:*:*:*:*:*:*", matchCriteriaId: "B3FDB45B-4D91-4427-9565-812919086E7E", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable5:*:*:*:*:*:*:*", matchCriteriaId: "86C3C8B5-C2A3-4454-9F89-38A860278366", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable6:*:*:*:*:*:*:*", matchCriteriaId: "8B37B7B4-2EAC-4C2A-9526-5C62CBA1DB8B", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable7:*:*:*:*:*:*:*", matchCriteriaId: "056EDEEE-A09C-47A2-9217-72E4B8387E00", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable8:*:*:*:*:*:*:*", matchCriteriaId: "2593CB12-03E2-4F98-9B89-C09D5EADE077", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable9:*:*:*:*:*:*:*", matchCriteriaId: "A44B7A4F-3070-4092-B9AF-3A1CD0897CC7", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable10:*:*:*:*:*:*:*", matchCriteriaId: "EF79D9A9-9C11-4E6D-81D1-32CA8CA95223", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable11:*:*:*:*:*:*:*", matchCriteriaId: "042FE60B-7239-45C7-8EE3-A036AC7778F8", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable11:rc1:*:*:*:*:*:*", matchCriteriaId: "FF5EE89A-720F-456A-BD26-FE46BBA29D9A", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable12:*:*:*:*:*:*:*", matchCriteriaId: "ADF61A74-9CF9-413E-B997-4FAE5BA28939", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable13:*:*:*:*:*:*:*", matchCriteriaId: "5605B00F-438B-45CC-A55D-E75E57BC4684", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable14:*:*:*:*:*:*:*", matchCriteriaId: "8316B22E-B016-4F0E-9A3F-383E9B1A85A4", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable15:*:*:*:*:*:*:*", matchCriteriaId: "49A2C5CB-E2F1-4A72-9EA3-912050AFEF7F", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable16:*:*:*:*:*:*:*", matchCriteriaId: "574C7DCC-B6E5-42A0-AA44-A0BCD67D1884", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable16:rc1:*:*:*:*:*:*", matchCriteriaId: "4D0DAD04-02C4-4FC4-BE08-3CAA3B85EB0B", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable17:*:*:*:*:*:*:*", matchCriteriaId: "A2B1F1A5-B435-4A5C-86DF-EC3F29D94417", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable18:*:*:*:*:*:*:*", matchCriteriaId: "113EF7A6-3B8D-4A50-8873-FD36FCBF284C", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable19:*:*:*:*:*:*:*", matchCriteriaId: "DC97E2DA-7378-486B-9178-3B38FF58589B", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable20:*:*:*:*:*:*:*", matchCriteriaId: "1F178890-2F7E-43F5-8D6D-5EFCD790E758", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable21:*:*:*:*:*:*:*", matchCriteriaId: "9FA231EB-0F06-4D13-B50D-76FC8393187A", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable22:*:*:*:*:*:*:*", matchCriteriaId: "31AB1D33-65EE-46DF-9D29-6B2BFACE7EC8", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable23:*:*:*:*:*:*:*", matchCriteriaId: "BDA4744F-5FB2-4DF8-A7B9-A33EAB004CBA", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable24:*:*:*:*:*:*:*", matchCriteriaId: "72023FB9-F081-4F0A-9E81-2AF0470EB278", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable25:*:*:*:*:*:*:*", matchCriteriaId: "2F7D973B-9D57-4F74-89B1-A18CDA388EF4", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1:*:*:*:*:*:*:*", matchCriteriaId: "6A8586AD-E820-4BAE-AAF9-AC7EF2316C06", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.1:*:*:*:*:*:*:*", matchCriteriaId: "802E3D2B-90B7-4725-854F-4174116BC314", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.2:*:*:*:*:*:*:*", matchCriteriaId: "7501697A-BCFD-4DC3-8D87-CC9A186D9589", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.3:*:*:*:*:*:*:*", matchCriteriaId: "0D6C4455-85F4-462D-9FF6-F830ED7D398E", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.4:*:*:*:*:*:*:*", matchCriteriaId: "B600BF4C-8169-4086-BFE6-F066BE5F5406", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.5:*:*:*:*:*:*:*", matchCriteriaId: "46272D1B-1468-48C0-B37A-7D06FAC39C47", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.6:*:*:*:*:*:*:*", matchCriteriaId: "DA782B4B-486F-4197-BD5D-ABF791D57211", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.7:*:*:*:*:*:*:*", matchCriteriaId: "558D8641-E097-4D91-9B6E-07433844BB82", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.8:*:*:*:*:*:*:*", matchCriteriaId: "0B46F5F1-38FC-4E25-8F04-CA2730561DF8", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.9:*:*:*:*:*:*:*", matchCriteriaId: "C69B0A4D-9619-4BEA-A846-C4438C2660F2", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.10:*:*:*:*:*:*:*", matchCriteriaId: "ED17FE35-6B2C-41BF-A7C7-2EECBDB5A934", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.11:*:*:*:*:*:*:*", matchCriteriaId: "78A50750-3A31-482C-B95C-019C8934850E", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.12:*:*:*:*:*:*:*", matchCriteriaId: "8FF6AC30-9570-4D4B-835E-CCADEB546F46", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.13:*:*:*:*:*:*:*", matchCriteriaId: "7FB84E4E-6A0A-41C8-9DDF-3C18F526F155", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.14:*:*:*:*:*:*:*", matchCriteriaId: "2E49E5C3-D01F-4DBC-B33A-5495D3EC44F8", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.15:*:*:*:*:*:*:*", matchCriteriaId: "79C53B22-9F33-43E7-8D1F-EEB0DEF4B503", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.16:*:*:*:*:*:*:*", matchCriteriaId: "25B60DB2-F50C-42F0-B6C9-B25C34B8F578", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.17:*:*:*:*:*:*:*", matchCriteriaId: "DE973F9E-8387-464F-AFA0-25215B340173", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.18:*:*:*:*:*:*:*", matchCriteriaId: "03D3F0E3-0C50-4A86-87F4-90FC82B312F5", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.1:*:*:*:*:*:*:*", matchCriteriaId: "CE26BEC0-B9C7-43F0-B0FB-E81870170B29", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.2:*:*:*:*:*:*:*", matchCriteriaId: "D0778579-A193-4C61-BB1A-6D2E733F3958", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.10:*:*:*:*:*:*:*", matchCriteriaId: "AE9A3716-8670-4847-A6EB-F601184D369E", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.11:*:*:*:*:*:*:*", matchCriteriaId: "D0E88EE3-EC00-4F1F-BAEF-4F1F893C5C5F", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.12:*:*:*:*:*:*:*", matchCriteriaId: "A330DFA8-BF79-45CC-BF88-6CEA26D7BC9E", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.13:*:*:*:*:*:*:*", matchCriteriaId: "679A55F8-34B4-435A-8BCE-8F842F3FB269", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.14:*:*:*:*:*:*:*", matchCriteriaId: "898674F9-6BF7-469F-A74E-558EAFC2CD27", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.15:*:*:*:*:*:*:*", matchCriteriaId: "3F50E718-1CF2-4C8F-A1EA-5F769B203B8A", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.16:*:*:*:*:*:*:*", matchCriteriaId: "290D66F4-D27F-4E86-AC95-05082F3C2E36", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.17:*:*:*:*:*:*:*", matchCriteriaId: "A8CD6A42-2C79-48EB-8F6C-0A7CE0C6AAAA", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.18:*:*:*:*:*:*:*", matchCriteriaId: "ABBA9A61-2B05-4527-A49D-425AD5FD863B", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.19:*:*:*:*:*:*:*", matchCriteriaId: "E893D7A8-9C39-438C-8EF2-9573EEDC884A", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.20:*:*:*:*:*:*:*", matchCriteriaId: "0B707451-BF0E-4F79-A348-B1141ABA6EF8", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.21:*:*:*:*:*:*:*", matchCriteriaId: "810AAA9D-F4B2-4F0A-89DD-2D9378516481", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.1:*:*:*:*:*:*:*", matchCriteriaId: "6DFAB3BA-BBE9-4CFB-BE6B-BDF3E7772E7F", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.2:*:*:*:*:*:*:*", matchCriteriaId: "C9F523B8-463E-4FB0-ACB6-E36AAAF85CD9", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.3:*:*:*:*:*:*:*", matchCriteriaId: "5BA593D9-907D-4051-A3F2-0F88F01A7C79", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.4:*:*:*:*:*:*:*", matchCriteriaId: "20D2B364-B98A-4484-A10A-86AF43774096", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.5:*:*:*:*:*:*:*", matchCriteriaId: "0B7BF076-0D43-407A-86DC-D1163922A787", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.6:*:*:*:*:*:*:*", matchCriteriaId: "AA576F49-A7F5-4013-89DF-F6C91C15B547", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.7:*:*:*:*:*:*:*", matchCriteriaId: "5D3F52FE-FFB3-4221-8DC7-3F5680A07429", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.8:*:*:*:*:*:*:*", matchCriteriaId: "604FEF42-ABA7-42C1-8A5F-C3AECFD68481", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.9:*:*:*:*:*:*:*", matchCriteriaId: "DC2568C1-89CB-41C1-9126-A8665614D0B1", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.10:*:*:*:*:*:*:*", matchCriteriaId: "C18B5392-3FDB-49E6-89DB-7945D337FBFB", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.11:*:*:*:*:*:*:*", matchCriteriaId: "BA9E0E7F-E93C-4DE9-8D91-5EE50BCFAC2A", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.12:*:*:*:*:*:*:*", matchCriteriaId: "0BFF9D8B-343B-415D-8AF8-B07AF94CC48B", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.13:*:*:*:*:*:*:*", matchCriteriaId: "16F5794B-BBFB-4B12-9A0B-88A0334681C7", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.14:*:*:*:*:*:*:*", matchCriteriaId: "17D0083E-8D50-4DC6-979F-685D5CB588AF", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.15:*:*:*:*:*:*:*", matchCriteriaId: "138FAD73-1D25-4F46-B9EA-599FF0EDA1AA", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.16:*:*:*:*:*:*:*", matchCriteriaId: "2CE34DC1-F654-474E-B6A3-D81B9BF4D6CF", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.17:*:*:*:*:*:*:*", matchCriteriaId: "8A4BF7AC-7D9F-40D8-A5AA-BE1EBF37CF96", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.18:*:*:*:*:*:*:*", matchCriteriaId: "643E8B9B-C3F4-4171-BF67-D9359BDCE5CB", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.19:*:*:*:*:*:*:*", matchCriteriaId: "A73CBC60-1EF1-4730-9350-EB51F269695B", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.1:*:*:*:*:*:*:*", matchCriteriaId: "2721E403-A553-492F-897F-1CD1E2685139", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.2:*:*:*:*:*:*:*", matchCriteriaId: "85B091C4-8104-4A1E-A09D-EBCD114DC829", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.3:*:*:*:*:*:*:*", matchCriteriaId: "FA2EDF9C-45AD-4980-8DEF-C7F473B22CAF", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:squid-cache:squid:3.3.0.1:*:*:*:*:*:*:*", matchCriteriaId: "A7A83183-74B1-4041-A961-D9F382AAC7E5", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.", }, { lang: "es", value: "Varias fugas de memoria en tools/cachemgr.cc en cachemgr.cgi en Squid v2.x y v3.x antes de v3.1.22, v3.2.x antes de v3.2.4 y v3.3.x antes de v3.3.0.2 permite a atacantes remotos provocar una denegación de servicio (consumo de memoria) a través de (1) cabeceras Content-Length no válidas, (2) largas peticiones POST, o (3) credenciales de autenticación manipuladas.", }, ], id: "CVE-2012-5643", lastModified: "2025-04-11T00:51:21.963", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], }, published: "2012-12-20T12:02:19.840", references: [ { source: "secalert@redhat.com", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", }, { source: "secalert@redhat.com", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", }, { source: "secalert@redhat.com", url: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00052.html", }, { source: "secalert@redhat.com", url: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00075.html", }, { source: "secalert@redhat.com", url: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00025.html", }, { source: "secalert@redhat.com", url: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00032.html", }, { source: "secalert@redhat.com", url: "http://openwall.com/lists/oss-security/2012/12/17/4", }, { source: "secalert@redhat.com", url: "http://rhn.redhat.com/errata/RHSA-2013-0505.html", }, { source: "secalert@redhat.com", url: "http://secunia.com/advisories/52024", }, { source: "secalert@redhat.com", url: "http://secunia.com/advisories/54839", }, { source: "secalert@redhat.com", url: "http://ubuntu.com/usn/usn-1713-1", }, { source: "secalert@redhat.com", url: "http://www.debian.org/security/2013/dsa-2631", }, { source: "secalert@redhat.com", url: "http://www.mandriva.com/security/advisories?name=MDVSA-2013:129", }, { source: "secalert@redhat.com", url: "http://www.securitytracker.com/id?1027890", }, { source: "secalert@redhat.com", tags: [ "Patch", "Vendor Advisory", ], url: "http://www.squid-cache.org/Advisories/SQUID-2012_1.txt", }, { source: "secalert@redhat.com", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch", }, { source: "secalert@redhat.com", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch", }, { source: "secalert@redhat.com", url: "https://bugs.gentoo.org/show_bug.cgi?id=447596", }, { source: "secalert@redhat.com", url: "https://bugzilla.redhat.com/show_bug.cgi?id=887962", }, { source: "secalert@redhat.com", url: "https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0368", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00052.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00075.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00025.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00032.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://openwall.com/lists/oss-security/2012/12/17/4", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://rhn.redhat.com/errata/RHSA-2013-0505.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/52024", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/54839", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://ubuntu.com/usn/usn-1713-1", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.debian.org/security/2013/dsa-2631", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.mandriva.com/security/advisories?name=MDVSA-2013:129", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securitytracker.com/id?1027890", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "http://www.squid-cache.org/Advisories/SQUID-2012_1.txt", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://bugs.gentoo.org/show_bug.cgi?id=447596", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://bugzilla.redhat.com/show_bug.cgi?id=887962", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0368", }, ], sourceIdentifier: "secalert@redhat.com", vulnStatus: "Deferred", weaknesses: [ { description: [ { lang: "en", value: "CWE-20", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
ghsa-pq8w-rcmc-8xgj
Vulnerability from github
Published
2022-05-17 03:46
Modified
2022-05-17 03:46
Details
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
{ affected: [], aliases: [ "CVE-2012-5643", ], database_specific: { cwe_ids: [ "CWE-20", ], github_reviewed: false, github_reviewed_at: null, nvd_published_at: "2012-12-20T12:02:00Z", severity: "MODERATE", }, details: "Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.", id: "GHSA-pq8w-rcmc-8xgj", modified: "2022-05-17T03:46:33Z", published: "2022-05-17T03:46:33Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2012-5643", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2013:0505", }, { type: "WEB", url: "https://access.redhat.com/security/cve/CVE-2012-5643", }, { type: "WEB", url: "https://bugs.gentoo.org/show_bug.cgi?id=447596", }, { type: "WEB", url: "https://bugzilla.redhat.com/show_bug.cgi?id=887962", }, { type: "WEB", url: "https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0368", }, { type: "WEB", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", }, { type: "WEB", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", }, { type: "WEB", url: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00052.html", }, { type: "WEB", url: "http://lists.opensuse.org/opensuse-updates/2013-01/msg00075.html", }, { type: "WEB", url: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00025.html", }, { type: "WEB", url: "http://lists.opensuse.org/opensuse-updates/2013-09/msg00032.html", }, { type: "WEB", url: "http://openwall.com/lists/oss-security/2012/12/17/4", }, { type: "WEB", url: "http://rhn.redhat.com/errata/RHSA-2013-0505.html", }, { type: "WEB", url: "http://secunia.com/advisories/52024", }, { type: "WEB", url: "http://secunia.com/advisories/54839", }, { type: "WEB", url: "http://ubuntu.com/usn/usn-1713-1", }, { type: "WEB", url: "http://www.debian.org/security/2013/dsa-2631", }, { type: "WEB", url: "http://www.mandriva.com/security/advisories?name=MDVSA-2013:129", }, { type: "WEB", url: "http://www.securitytracker.com/id?1027890", }, { type: "WEB", url: "http://www.squid-cache.org/Advisories/SQUID-2012_1.txt", }, { type: "WEB", url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch", }, { type: "WEB", url: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11714.patch", }, ], schema_version: "1.4.0", severity: [], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.