openSUSE Security Update : squid (openSUSE-2020-606)

This update for squid to version 4.10 fixes the following issues : Security issues fixed : - CVE-2019-12528: Fixed an information disclosure flaw in the FTP gateway bsc1162689. - CVE-2020-8449: Fixed a buffer overflow when squid is acting as reverse-proxy bsc1162687. - CVE-2020-8450: Fixed a buff...

openSUSE: Security Advisory for squid (openSUSE-SU-2020:0606-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

FreeBSD : Squid -- multiple vulnerabilities (57c1c2ee-7914-11ea-90bf-0800276545c1)

The Squid developers reports : Improper Input Validation issues in HTTP Request processing CVE-2020-8449, CVE-2020-8450. Information Disclosure issue in FTP Gateway CVE-2019-12528. Buffer Overflow issue in extlmgroupacl helper CVE-2020-8517. C Tenable Network Security, Inc. The descriptive text a...

OPENSUSE-SU-2020:0606-1 Security update for squid

This update for squid to version 4.10 fixes the following issues: Security issues fixed: - CVE-2019-12528: Fixed an information disclosure flaw in the FTP gateway bsc1162689. - CVE-2020-8449: Fixed a buffer overflow when squid is acting as reverse-proxy bsc1162687. - CVE-2020-8450: Fixed a buffer...

Security update for squid (moderate)

openSUSE Security Update: Security update for squid Announcement ID: openSUSE-SU-2020:0606-1 Rating: moderate References: 1162687 1162689 1162691 Cross-References: CVE-2019-12528 CVE-2020-8449 CVE-2020-8450 CVE-2020-8517 Affected Products: openSUSE Leap 15.1 An update that fixes four...

Friday Squid Blogging: Cocaine Smuggled in Squid

Makes sense; there's room inside a squid's body cavity: Latin American drug lords have sent bumper shipments of cocaine to Europe in recent weeks, including one in a cargo of squid, even though the coronavirus epidemic has stifled legitimate transatlantic trade, senior anti-narcotics officials sa...

SUSE SLES15 Security Update : squid (SUSE-SU-2020:1156-1)

This update for squid to version 4.11 fixes the following issues : CVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication bsc1170313. CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote...

SUSE-SU-2020:1134-1 Security update for squid

This update for squid to version 4.11 fixes the following issues: - CVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication bsc1170313. - CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote...

SUSE SLES12 Security Update : squid (SUSE-SU-2020:1134-1)

This update for squid to version 4.11 fixes the following issues : CVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication bsc1170313. CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote...

The vulnerability of the Squid proxy server, related to the lack of protection for service data, allows attackers to disclose the protected information.

The vulnerability of the Squid proxy server is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to disclose the protected information...

The vulnerability of the `append_domain` parameter in the Squid proxy server, related to the manipulation of inter-domain requests, allows attackers to gain access to confidential data and compromise its integrity.

The vulnerability of the appenddomain parameter in the Squid proxy server is related to deficiencies in mechanisms for combating cross-site fraud. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to confidential data and compromise its integrity...

The vulnerability of the Squid proxy server, related to writing beyond the buffer limit, allows a hacker to cause a service failure.

The vulnerability of the Squid proxy server is caused by an overflow in the buffer in the dynamic memory. Exploiting this vulnerability allows a remote attacker to cause a service failure using a specially created URI scheme...

Friday Squid Blogging: Humboldt Squid Backlight Themselves to Communicate More Clearly

This is neat: Deep in the Pacific Ocean, six-foot-long Humboldt squid are known for being aggressive, cannibalistic and, according to new research, good communicators. Known as "red devils," the squid can rapidly change the color of their skin, making different patterns to communicate, something...

CVE-2019-12522

A flaw was found in squid. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leavesuid call. leavesuid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their...

CVE-2019-12524

A flaw was found in squid. The Cache Manager for Squid has rules that, by default, block access to anyone other than the maintainer. An attacker, with the ability to send a properly crafted URL, can bypass the urlregex check and gain access to the blocked resource. The highest threat from this...

CVE-2020-11945

A flaw was found in Squid, where a remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This issue occurs because the attacker can overflow the nonce reference counter, which results in remote code execution if the pooled token...

CVE-2019-12520

A flaw was found in squid. The absolute URL of a request can include the decoded UserInfo username and password for certain protocols. This decoded info may contain special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a...

CVE-2019-12521

A flaw was found in squid. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this buffer,...

CVE-2019-12519

A flaw was found in Squid through version 4.7. When handling the tag esi:when, when ESI is enabled, Squid calls the ESIExpression::Evaluate function which uses a fixed stack buffer to hold the expression. While processing the expression, there is no check to ensure that the stack won't overflow...

Squid Code Execution Vulnerability

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A security vulnerability exists in versions of Squid prior to 5.0.2. An attacker can exploit the vulnerability by...