Multiple vulnerabilities fixed in Squid

The developers of Squid have fixed several vulnerabilities in Squid proxy. An unauthenticated malicious person can exploit the remote vulnerabilities to exploit them to cause a denial-of-service cause, access sensitive data or execute arbitrary code with application privileges. For the...

Security update for squid (important)

openSUSE Security Update: Security update for squid Announcement ID: openSUSE-SU-2020:0623-1 Rating: important References: 1162689 1162691 1167373 1169659 1170313 Cross-References: CVE-2019-12519 CVE-2019-12521 CVE-2019-12528 CVE-2019-18860 CVE-2020-11945 CVE-2020-8517 Affected Products: openSUSE...

Debian DSA-4682-1 : squid - security update

Multiple security issues were discovered in the Squid proxy caching server, which could result in the bypass of security filters, information disclosure, the execution of arbitrary code or denial of service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

openSUSE Security Update : squid (openSUSE-2020-623)

This update for squid to version 4.11 fixes the following issues : - CVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication bsc1170313. - CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote...

Debian: Security Advisory (DSA-4682-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Friday Squid Blogging: Jurassic Squid Attack

It's the oldest squid attack on record: An ancient squid-like creature with 10 arms covered in hooks had just crushed the skull of its prey in a vicious attack when disaster struck, killing both predator and prey, according to a Jurassic period fossil of the duo found on the southern coast of...

[SECURITY] [DSA 4682-1] squid security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4682-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 08, 2020 https://www.debian.org/security/faq -...

SUSE-SU-2020:1227-1 Security update for squid

This update for squid fixes the following issues: - CVE-2019-12519, CVE-2019-12521: fixes incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses bsc1169659. - CVE-2020-11945: fixes a potential remote execution...

OPENSUSE-SU-2020:0623-1 Security update for squid

This update for squid to version 4.11 fixes the following issues: - CVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication bsc1170313. - CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote...

DSA-4682-1 squid - security update

Bulletin has no description...

Oracle Linux 7 : squid (ELSA-2020-2040)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-2040 advisory. - Resolves: 1828359 - CVE-2020-11945 squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution -...

Remote Code Execution (RCE)

Squid is vulnerable to remote code execution RCE. Due to an improper access restriction upon Digest Authentication nonce replay, it could lead to remote code execution...

Denial Of Service (DoS)

Squid is vulnerable to denial of service DoS. Parsing of header Proxy-Authentication leads to memory corruption...

Denial Of Service (DoS)

Squid is vulnerable to denial of service DoS. Due to an improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow...

squid security update

7:3.5.20-15.1 - Resolves: 1828359 - CVE-2020-11945 squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution - Resolves: 1828360 - CVE-2019-12519 squid: improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow -...

Scientific Linux Security Update : squid on SL7.x x86_64 (20200506)

Security Fixes : - squid: improper check for new member in ESIExpression::Evaluate allows for stack-based buffer overflow CVE-2019-12519 - squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution CVE-2020-11945 - squid: parsing of header...

Important: Red Hat Security Advisory: squid security update

An update for squid is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution

A flaw was found in Squid, where a remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This issue occurs because the attacker can overflow the nonce reference counter, which results in remote code execution if the pooled token...

squid: parsing of header Proxy-Authentication leads to memory corruption

An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as domain, uri, and qop. Squid checks if this token's value starts with a quote and ends...

squid: improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow

A flaw was found in Squid through version 4.7. When handling the tag esi:when, when ESI is enabled, Squid calls the ESIExpression::Evaluate function which uses a fixed stack buffer to hold the expression. While processing the expression, there is no check to ensure that the stack won't overflow...