Squid < 3.5.17, 4.0.9 Multiple Vulnerabilities

The specific version of Squid that the system is running is reportedly affected by the following vulnerabilities:

• Squid contains a flaw in esi/Esi.cc that is triggered as input is not properly validated when handling ESI responses. This may allow a remote attacker to disclose the server stack layout. (CVE-2016-4053)

• Squid contains an overflow condition in esi/Esi.cc that is triggered as user-supplied input is not properly validated when handling ESI responses. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-4054)

• Squid contains an assertion flaw in esi/Esi.cc that is triggered as input is not properly validated when handling ESI responses. This may allow a remote attacker to terminate the service. (CVE-2016-4052)

• Squid contains an overflow condition that is triggered as user-supplied input is not properly validated when processing the length of content lines in reports by the cachemgr.cgi tool. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-4051)