Squid 3.5.x < 3.5.23 / 4.0.x < 4.0.17 Multiple Information Disclosure

Versions of Squid 4.0.x prior to 4.0.17, and 3.5.x prior to 3.5.18 are affected by multiple vulnerabilities :

• A flaw exists in the collapsed forwarding functionality in ‘client_side_reply.cc’ that is triggered as request headers are not properly compared, which can cause the program to deliver responses containing private data to clients it should not have reached. This may allow a remote attacker to gain access to potentially sensitive information from other sessions.
• A flaw exists in ‘client_side_reply.cc’ that is triggered during the handling of HTTP conditional requests. This may allow a remote attacker to gain access to potentially sensitive information from other sessions.