[SECURITY] [DLA 1596-1] squid3 security update

2018-11-2613:38:09

lists.debian.org

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.022 Low

EPSS

Percentile

89.3%

JSON

Package : squid3
Version : 3.4.8-6+deb8u6
CVE ID : CVE-2018-19132
Debian Bug : 912294

It was discovered that there can be a denial of service (DoS)
vulnerability in squid3 due to a memory leak in SNMP query rejection
code when SNMP is enabled. In environments where per-process memory
restrictions are not enforced strictly, a remote attacker to consume
all memory available to the Squid process, causing it to crash.

For Debian 8 "Jessie", this problem has been fixed in version
3.4.8-6+deb8u6.

We recommend that you upgrade your squid3 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8allsquid3-common< 3.4.8-6+deb8u6squid3-common_3.4.8-6+deb8u6_all.deb
Debian9armelsquid-cgi< 3.5.23-5+deb9u2squid-cgi_3.5.23-5+deb9u2_armel.deb
Debian9armhfsquid-cgi< 3.5.23-5+deb9u2squid-cgi_3.5.23-5+deb9u2_armhf.deb
Debian8armelsquid-cgi< 3.4.8-6+deb8u6squid-cgi_3.4.8-6+deb8u6_armel.deb
Debian8amd64squidclient< 3.4.8-6+deb8u6squidclient_3.4.8-6+deb8u6_amd64.deb
Debian9armelsquid-purge< 3.5.23-5+deb9u2squid-purge_3.5.23-5+deb9u2_armel.deb
Debian8armelsquid3-dbg< 3.4.8-6+deb8u6squid3-dbg_3.4.8-6+deb8u6_armel.deb
Debian9armhfsquidclient< 3.5.23-5+deb9u2squidclient_3.5.23-5+deb9u2_armhf.deb
Debian8amd64squid-cgi< 3.4.8-6+deb8u6squid-cgi_3.4.8-6+deb8u6_amd64.deb
Debian8i386squid3-dbg< 3.4.8-6+deb8u6squid3-dbg_3.4.8-6+deb8u6_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	all	squid3-common	< 3.4.8-6+deb8u6	squid3-common_3.4.8-6+deb8u6_all.deb
Debian	9	armel	squid-cgi	< 3.5.23-5+deb9u2	squid-cgi_3.5.23-5+deb9u2_armel.deb
Debian	9	armhf	squid-cgi	< 3.5.23-5+deb9u2	squid-cgi_3.5.23-5+deb9u2_armhf.deb
Debian	8	armel	squid-cgi	< 3.4.8-6+deb8u6	squid-cgi_3.4.8-6+deb8u6_armel.deb
Debian	8	amd64	squidclient	< 3.4.8-6+deb8u6	squidclient_3.4.8-6+deb8u6_amd64.deb
Debian	9	armel	squid-purge	< 3.5.23-5+deb9u2	squid-purge_3.5.23-5+deb9u2_armel.deb
Debian	8	armel	squid3-dbg	< 3.4.8-6+deb8u6	squid3-dbg_3.4.8-6+deb8u6_armel.deb
Debian	9	armhf	squidclient	< 3.5.23-5+deb9u2	squidclient_3.5.23-5+deb9u2_armhf.deb
Debian	8	amd64	squid-cgi	< 3.4.8-6+deb8u6	squid-cgi_3.4.8-6+deb8u6_amd64.deb
Debian	8	i386	squid3-dbg	< 3.4.8-6+deb8u6	squid3-dbg_3.4.8-6+deb8u6_i386.deb