{"result": {"nessus": [{"id": "DEBIAN_DSA-3139.NASL", "type": "nessus", "title": "Debian DSA-3139-1 : squid - security update", "description": "Matthew Daley discovered that squid, a web proxy cache, does not properly perform input validation when parsing requests. A remote attacker could use this flaw to mount a denial of service attack, by sending specially crafted Range requests.", "published": "2015-01-27T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=81006", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-09-26T17:23:40"}, {"id": "FEDORA_2014-9882.NASL", "type": "nessus", "title": "Fedora 21 : squid-3.4.7-1.fc21 (2014-9882)", "description": "Security fix for CVE-2014-3609\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2014-09-23T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=77799", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-09-26T17:25:38"}, {"id": "SUSE_11_SQUID3-140912.NASL", "type": "nessus", "title": "SuSE 11.3 Security Update : squid3 (SAT Patch Number 9729)", "description": "Squid3 was updated to fix a denial of service in Range Header processing, which would have allowed proxy users to crash the squid proxy process. (CVE-2014-3609)", "published": "2014-09-18T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=77743", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-09-26T17:24:09"}, {"id": "ORACLELINUX_ELSA-2014-1147.NASL", "type": "nessus", "title": "Oracle Linux 7 : squid (ELSA-2014-1147)", "description": "From Red Hat Security Advisory 2014:1147 :\n\nUpdated squid packages that fix one security issue are now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nSquid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nA flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609)\n\nRed Hat would like to thank the Squid project for reporting this issue. Upstream acknowledges Matthew Daley as the original reporter.\n\nAll Squid users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the squid service will be restarted automatically.", "published": "2014-09-04T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=77516", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-09-26T17:25:37"}, {"id": "OPENSUSE-2014-548.NASL", "type": "nessus", "title": "openSUSE Security Update : squid (openSUSE-SU-2014:1144-1)", "description": "This update fixes the following security issues and bugs with squid :\n\nA denial of Service in Range header processing was fixed that could be used by proxy users to crash squid. (CVE-2014-3609)\n\nAlso the following bugs were fixed :\n\n - bnc#894840: removed unnecessary 'sharedscripts' in squid's logrotate snippet\n\n - bnc#894636: fixes run of init script when logrotate is called", "published": "2014-09-22T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=77777", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-09-26T17:23:42"}, {"id": "DEBIAN_DLA-45.NASL", "type": "nessus", "title": "Debian DLA-45-1 : squid3 security update", "description": "CVE-2014-3609: Denial of Service in Range header processing.\n\nIgnore Range headers with unidentifiable byte-range values. If squid is unable to determine the byte value for ranges, treat the header as invalid.\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2015-03-26T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=82192", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-09-26T17:25:22"}, {"id": "FEDORA_2014-9948.NASL", "type": "nessus", "title": "Fedora 20 : squid-3.3.13-1.fc20 (2014-9948)", "description": "Security fix for CVE-2014-3609\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2014-09-08T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=77559", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-09-26T17:23:40"}, {"id": "SQUID_3_4_7.NASL", "type": "nessus", "title": "Squid 3.x < 3.3.13 / 3.4.7 Request Processing DoS", "description": "According to its banner, the version of Squid running on the remote host is 3.x prior to 3.3.13 or 3.4.7. It is, therefore, affected by a denial of service vulnerability.\n\nThe flaw exists due to user-supplied input not being properly validated in request parsing. This allows a remote attacker to specially craft a request with Range headers with unidentifiable byte-range values to crash the application.\n\nNote that Nessus has relied only on the version in the proxy server's banner. The patch released to address the issue does not update the version in the banner. If the patch has been applied properly, and the service has been restarted, consider this to be a false positive.", "published": "2014-09-30T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=77985", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-09-26T17:25:49"}, {"id": "UBUNTU_USN-2327-1.NASL", "type": "nessus", "title": "Ubuntu 12.04 LTS / 14.04 LTS : squid3 vulnerability (USN-2327-1)", "description": "Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A remote attacker could send crafted Range requests to cause a denial of service.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2014-08-28T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=77420", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-09-26T17:25:59"}, {"id": "FEDORA_2014-9963.NASL", "type": "nessus", "title": "Fedora 19 : squid-3.3.13-1.fc19 (2014-9963)", "description": "Security fix for CVE-2014-3609\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2014-09-11T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=77617", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-09-26T17:25:37"}], "debian": [{"id": "DSA-3139", "type": "debian", "title": "squid -- security update", "description": "Matthew Daley discovered that squid, a web proxy cache, does not properly perform input validation when parsing requests. A remote attacker could use this flaw to mount a denial of service attack, by sending specially crafted Range requests.\n\nFor the stable distribution (wheezy), this problem has been fixed in version 2.7.STABLE9-4.1+deb7u1.\n\nWe recommend that you upgrade your squid packages.", "published": "2015-01-25T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://www.debian.org/security/dsa-3139", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-09-02T18:28:47"}, {"id": "DLA-216", "type": "debian", "title": "squid -- LTS security update", "description": "* [CVE-2014-3609](<https://security-tracker.debian.org/tracker/CVE-2014-3609>): \n\nDenial of Service in Range header processing.\n\nIgnore Range headers with unidentifiable byte-range values. If squid is unable to determine the byte value for ranges, treat the header as invalid.", "published": "2015-05-01T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://www.debian.org/security/2015/dla-216", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-09-02T12:57:17"}, {"id": "DSA-3014", "type": "debian", "title": "squid3 -- security update", "description": "Matthew Daley discovered that Squid3, a fully featured web proxy cache, did not properly perform input validation in request parsing. A remote attacker could use this flaw to mount a denial of service by sending crafted Range requests.\n\nFor the stable distribution (wheezy), this problem has been fixed in version 3.1.20-2.2+deb7u2.\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your squid3 packages.", "published": "2014-08-28T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://www.debian.org/security/dsa-3014", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-09-02T18:33:14"}], "centos": [{"id": "CESA-2014:1147", "type": "centos", "title": "squid security update", "description": "**CentOS Errata and Security Advisory** CESA-2014:1147\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2014-September/020531.html\n\n**Affected packages:**\nsquid\nsquid-sysvinit\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2014-1147.html", "published": "2014-09-03T23:09:15", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2014-September/020531.html", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-12-05T19:57:58"}, {"id": "CESA-2014:1148", "type": "centos", "title": "squid security update", "description": "**CentOS Errata and Security Advisory** CESA-2014:1148\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2014-September/020534.html\nhttp://lists.centos.org/pipermail/centos-announce/2014-September/020537.html\n\n**Affected packages:**\nsquid\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2014-1148.html", "published": "2014-09-03T23:16:08", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2014-September/020534.html", "cvelist": ["CVE-2013-4115", "CVE-2014-3609"], "lastseen": "2016-12-05T20:02:34"}], "ubuntu": [{"id": "USN-2327-1", "type": "ubuntu", "title": "Squid 3 vulnerability", "description": "Matthew Daley discovered that Squid 3 did not properly perform input \nvalidation in request parsing. A remote attacker could send crafted Range \nrequests to cause a denial of service.", "published": "2014-08-27T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://usn.ubuntu.com/usn/usn-2327-1/", "cvelist": ["CVE-2014-3609"], "lastseen": "2017-08-09T19:11:42"}], "openvas": [{"id": "OPENVAS:1361412562310806106", "type": "openvas", "title": "Squid HTTP Range Request Handling Denial of Service Vulnerability", "description": "This host is running Squid and is prone\n to denial of service vulnerability.", "published": "2015-09-08T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806106", "cvelist": ["CVE-2014-3609"], "lastseen": "2017-07-17T10:53:16"}, {"id": "OPENVAS:1361412562310841945", "type": "openvas", "title": "Ubuntu Update for squid3 USN-2327-1", "description": "Check for the Version of squid3", "published": "2014-08-29T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310841945", "cvelist": ["CVE-2014-3609"], "lastseen": "2017-07-25T10:49:02"}, {"id": "OPENVAS:1361412562310868166", "type": "openvas", "title": "Fedora Update for squid FEDORA-2014-9948", "description": "Check for the Version of squid", "published": "2014-09-06T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868166", "cvelist": ["CVE-2014-3609"], "lastseen": "2017-07-25T10:49:02"}, {"id": "OPENVAS:1361412562310123323", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2014-1147", "description": "Oracle Linux Local Security Checks ELSA-2014-1147", "published": "2015-10-06T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310123323", "cvelist": ["CVE-2014-3609"], "lastseen": "2017-07-24T12:52:18"}, {"id": "OPENVAS:703014", "type": "openvas", "title": "Debian Security Advisory DSA 3014-1 (squid3 - security update)", "description": "Matthew Daley discovered that Squid3, a fully featured web proxy cache,\ndid not properly perform input validation in request parsing. A remote\nattacker could use this flaw to mount a denial of service by sending\ncrafted Range requests.", "published": "2014-08-28T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=703014", "cvelist": ["CVE-2014-3609"], "lastseen": "2017-07-31T10:48:57"}, {"id": "OPENVAS:1361412562310871235", "type": "openvas", "title": "RedHat Update for squid RHSA-2014:1147-01", "description": "Check for the Version of squid", "published": "2014-09-04T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310871235", "cvelist": ["CVE-2014-3609"], "lastseen": "2017-07-27T10:48:33"}, {"id": "OPENVAS:1361412562310850753", "type": "openvas", "title": "SuSE Update for squid3 SUSE-SU-2014:1140-1 (squid3)", "description": "Check the version of squid3", "published": "2015-10-13T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310850753", "cvelist": ["CVE-2014-3609"], "lastseen": "2017-07-26T08:52:48"}, {"id": "OPENVAS:1361412562310882006", "type": "openvas", "title": "CentOS Update for squid CESA-2014:1147 centos7 ", "description": "Check for the Version of squid", "published": "2014-09-10T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310882006", "cvelist": ["CVE-2014-3609"], "lastseen": "2017-07-25T10:48:58"}, {"id": "OPENVAS:703139", "type": "openvas", "title": "Debian Security Advisory DSA 3139-1 (squid - security update)", "description": "Matthew Daley discovered that squid,\na web proxy cache, does not properly perform input validation when parsing requests.\nA remote attacker could use this flaw to mount a denial of service attack, by\nsending specially crafted Range requests.", "published": "2015-01-25T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=703139", "cvelist": ["CVE-2014-3609"], "lastseen": "2017-07-24T12:52:48"}, {"id": "OPENVAS:1361412562310881993", "type": "openvas", "title": "CentOS Update for squid CESA-2014:1148 centos5 ", "description": "Check for the Version of squid", "published": "2014-09-04T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310881993", "cvelist": ["CVE-2013-4115", "CVE-2014-3609"], "lastseen": "2017-07-25T10:48:51"}], "suse": [{"id": "SUSE-SU-2014:1140-1", "type": "suse", "title": "Security update for squid3 (important)", "description": "Squid3 was updated to fix a denial of service in Range Header processing,\n which would have allowed proxy users to crash the squid proxy process.\n (CVE-2014-3609)\n\n Security Issues:\n\n * CVE-2014-3609\n <<a rel=\"nofollow\" href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3609\">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3609</a>>\n\n", "published": "2014-09-18T00:05:25", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00025.html", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-09-04T12:30:16"}], "redhat": [{"id": "RHSA-2014:1147", "type": "redhat", "title": "(RHSA-2014:1147) Important: squid security update", "description": "Squid is a high-performance proxy caching server for web clients,\nsupporting FTP, Gopher, and HTTP data objects.\n\nA flaw was found in the way Squid handled malformed HTTP Range headers.\nA remote attacker able to send HTTP requests to the Squid proxy could use\nthis flaw to crash Squid. (CVE-2014-3609)\n\nRed Hat would like to thank the Squid project for reporting this issue.\nUpstream acknowledges Matthew Daley as the original reporter.\n\nAll Squid users are advised to upgrade to these updated packages, which\ncontain a backported patch to correct this issue. After installing this\nupdate, the squid service will be restarted automatically.\n", "published": "2014-09-03T04:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://access.redhat.com/errata/RHSA-2014:1147", "cvelist": ["CVE-2014-3609"], "lastseen": "2017-08-31T03:33:04"}, {"id": "RHSA-2014:1148", "type": "redhat", "title": "(RHSA-2014:1148) Important: squid security update", "description": "Squid is a high-performance proxy caching server for web clients,\nsupporting FTP, Gopher, and HTTP data objects.\n\nA flaw was found in the way Squid handled malformed HTTP Range headers.\nA remote attacker able to send HTTP requests to the Squid proxy could use\nthis flaw to crash Squid. (CVE-2014-3609)\n\nA buffer overflow flaw was found in Squid's DNS lookup module. A remote\nattacker able to send HTTP requests to the Squid proxy could use this flaw\nto crash Squid. (CVE-2013-4115)\n\nRed Hat would like to thank the Squid project for reporting the\nCVE-2014-3609 issue. Upstream acknowledges Matthew Daley as the original\nreporter.\n\nAll Squid users are advised to upgrade to this updated package, which\ncontains backported patches to correct these issues. After installing this\nupdate, the squid service will be restarted automatically.\n", "published": "2014-09-03T04:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://access.redhat.com/errata/RHSA-2014:1148", "cvelist": ["CVE-2013-4115", "CVE-2014-3609"], "lastseen": "2017-09-09T07:19:13"}], "oraclelinux": [{"id": "ELSA-2014-1147", "type": "oraclelinux", "title": "squid security update", "description": "[7:3.3.8-12]\n- Resolves: #1134933 - CVE-2014-3609 assertion failure in header processing", "published": "2014-09-03T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://linux.oracle.com/errata/ELSA-2014-1147.html", "cvelist": ["CVE-2014-3609"], "lastseen": "2016-09-04T11:16:42"}, {"id": "ELSA-2014-1148", "type": "oraclelinux", "title": "squid security update", "description": "[7:3.1.10-22]\n- Resolves: #1134936 - CVE-2013-4115 buffer overflow when processing overly long DNS names\n[7:3.1.10-21]\n- Resolves: #1134936 - CVE-2014-3609 assertion failure in header processing", "published": "2014-09-03T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://linux.oracle.com/errata/ELSA-2014-1148.html", "cvelist": ["CVE-2013-4115", "CVE-2014-3609"], "lastseen": "2016-09-04T11:16:40"}], "amazon": [{"id": "ALAS-2014-411", "type": "amazon", "title": "Important: squid", "description": "**Issue Overview:**\n\nA flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. ([CVE-2014-3609 __](<https://access.redhat.com/security/cve/CVE-2014-3609>))\n\nA buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. ([CVE-2013-4115 __](<https://access.redhat.com/security/cve/CVE-2013-4115>))\n\n \n**Affected Packages:** \n\n\nsquid\n\n \n**Issue Correction:** \nRun _yum update squid_ to update your system. \n\n \n**New Packages:**\n \n \n i686: \n squid-debuginfo-3.1.10-22.16.amzn1.i686 \n squid-3.1.10-22.16.amzn1.i686 \n \n src: \n squid-3.1.10-22.16.amzn1.src \n \n x86_64: \n squid-3.1.10-22.16.amzn1.x86_64 \n squid-debuginfo-3.1.10-22.16.amzn1.x86_64 \n \n \n", "published": "2014-09-17T21:47:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://alas.aws.amazon.com/ALAS-2014-411.html", "cvelist": ["CVE-2013-4115", "CVE-2014-3609"], "lastseen": "2016-09-28T21:04:04"}, {"id": "ALAS-2014-433", "type": "amazon", "title": "Important: squid", "description": "**Issue Overview:**\n\nA flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. ([CVE-2014-3609 __](<https://access.redhat.com/security/cve/CVE-2014-3609>))\n\nA buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. ([CVE-2013-4115 __](<https://access.redhat.com/security/cve/CVE-2013-4115>))\n\nSquid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management. ([CVE-2014-0128 __](<https://access.redhat.com/security/cve/CVE-2014-0128>))\n\n \n**Affected Packages:** \n\n\nsquid\n\n \n**Issue Correction:** \nRun _yum update squid_ to update your system. \n\n \n**New Packages:**\n \n \n i686: \n squid-3.1.10-29.17.amzn1.i686 \n squid-debuginfo-3.1.10-29.17.amzn1.i686 \n \n src: \n squid-3.1.10-29.17.amzn1.src \n \n x86_64: \n squid-3.1.10-29.17.amzn1.x86_64 \n squid-debuginfo-3.1.10-29.17.amzn1.x86_64 \n \n \n", "published": "2014-10-22T20:04:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://alas.aws.amazon.com/ALAS-2014-433.html", "cvelist": ["CVE-2014-0128", "CVE-2013-4115", "CVE-2014-3609"], "lastseen": "2016-09-28T21:04:10"}]}}