news 28 Posted May 16, 2016 Package : squid3 Version : 3.1.20-2.2+deb7u5 CVE ID : CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054 CVE-2016-4554 CVE-2016-4555 CVE-2016-4556 Debian Bug : 823968 Several security issues have been discovered in the Squid caching proxy. CVE-2016-4051 CESG and Yuriy M. Kaminskiy discovered that Squid cachemgr.cgi was vulnerable to a buffer overflow when processing remotely supplied inputs relayed through Squid. CVE-2016-4052 CESG discovered that a buffer overflow made Squid vulnerable to a Denial of Service (DoS) attack when processing ESI responses. CVE-2016-4053 CESG found that Squid was vulnerable to public information disclosure of the server stack layout when processing ESI responses. CVE-2016-4054 CESG discovered that Squid was vulnerable to remote code execution when processing ESI responses. CVE-2016-4554 Jianjun Chen found that Squid was vulnerable to a header smuggling attack that could lead to cache poisoning and to bypass of same-origin security policy in Squid and some client browsers. CVE-2016-4555 and CVE-2016-4556 "bfek-18" and " ( -at -) vftable" found that Squid was vulnerable to a Denial of Service (DoS) attack when processing ESI responses, due to incorrect pointer handling and reference counting. For Debian 7 "Wheezy", these issues have been fixed in squid3 version 3.1.20-2.2+deb7u5. We recommend you to upgrade your squid3 packages. Learn more about the Debian Long Term Support (LTS) Project and how to apply these updates at: https://wiki.debian.org/LTS/ Share this post Link to post
