[arch-security] [ASA-201604-14] squid: multiple issues
anthraxx at archlinux.org
Sat Apr 23 22:26:26 UTC 2016
Arch Linux Security Advisory ASA-201604-14
Date : 2016-04-23
CVE-ID : CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
Package : squid
Type : multiple issues
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package squid before version 3.5.17-1 is vulnerable to multiple
issues including arbitrary code execution, information disclosure and
denial of service.
Upgrade to 3.5.17-1.
# pacman -Syu "squid>=3.5.17-1"
The problems have been fixed upstream in version 3.5.17.
- CVE-2016-4051 (denial of service)
Due to incorrect buffer management Squid cachemgr.cgi tool is vulnerable
to a buffer overflow when processing remotely supplied inputs relayed to
it from Squid.
- CVE-2016-4052 (denial of service)
Due to buffer overflow issues Squid is vulnerable to a denial of service
attack when processing ESI responses.
- CVE-2016-4053 (information disclosure)
Due to incorrect input validation Squid is vulnerable to public
information disclosure of the server stack layout when processing
- CVE-2016-4054 (arbitrary code execution)
Due to incorrect input validation and buffer overflow Squid is
vulnerable to remote code execution when processing ESI
A remote attacker is able to execute arbitrary code, disclose sensitive
information or perform a denial of service attack via multiple
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security