Arch Linux Security Advisory ASA-201604-4 ========================================= Severity: Low, Medium, High, Critical Date : 2016-04-02 CVE-ID : CVE-2016-3947 Package : squid Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package squid before version 3.5.16-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.5.16-1. # pacman -Syu "squid>=3.5.16-1" The problem has been fixed upstream in version 3.5.16. Workaround ========== None. Description =========== Due to incorrect bounds checking Squid is vulnerable to a denial of service attack when processing HTTP responses. Impact ====== This problem allows a malicious client script and remote server delivering certain unusual HTTP response syntax to trigger a denial of service for all clients accessing the Squid service. References ========== http://article.gmane.org/gmane.comp.security.oss.general/19234 http://www.squid-cache.org/Advisories/SQUID-2016_4.txt