CVE-2024-37894

2024-06-2520:15:11

Debian Security Bug Tracker

security-tracker.debian.org

squid

caching proxy

http

https

ftp

cve-2024-37894

unix

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

9.1%

JSON

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.

OSVersionArchitecturePackageVersionFilename
Debian12allsquid<= 5.7-2squid_5.7-2_all.deb
Debian11allsquid<= 4.13-10+deb11u2squid_4.13-10+deb11u2_all.deb
Debian10allsquid<= 4.6-1+deb10u7squid_4.6-1+deb10u7_all.deb
Debian999allsquid<= 6.9-1squid_6.9-1_all.deb
Debian13allsquid<= 6.9-1squid_6.9-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	squid	<= 5.7-2	squid_5.7-2_all.deb
Debian	11	all	squid	<= 4.13-10+deb11u2	squid_4.13-10+deb11u2_all.deb
Debian	10	all	squid	<= 4.6-1+deb10u7	squid_4.6-1+deb10u7_all.deb
Debian	999	all	squid	<= 6.9-1	squid_6.9-1_all.deb
Debian	13	all	squid	<= 6.9-1	squid_6.9-1_all.deb