logo
DATABASE RESOURCES PRICING ABOUT US

CVE-2019-12519

Description

An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack won't overflow.


Affected Package


OS OS Version Package Name Package Version
Debian 12 squid 5.7-1
Debian 11 squid 4.13-10+deb11u1
Debian 10 squid 4.6-1+deb10u7
Debian 999 squid 5.7-1

Related