CVE-2002-0069

Memory leak in SNMP in Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service...

CVE-2002-0068

Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service core dump and possibly execute arbitrary code with an ftp:// URL with a larger number of special characters, which exceed the buffer when Squid URL-escapes the characters...

CVE-2002-0163

Heap-based buffer overflow in Squid before 2.4 STABLE4, and Squid 2.5 and 2.6 until March 12, 2002 distributions, allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via compressed DNS responses...

CVE-2002-0916

This CVE (CVE-2002-0916) affects Squid 2.4.STABLE6 and earlier, in the Stellar-X msntauth authentication module. The issue is a format string vulnerability in the allowuser code that handles the user name, where untrusted input is used in a syslog call, enabling remote code execution. Documents c...

CVE-2002-0916

Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and earlier, allows remote attackers to execute arbitrary code via format strings in the user name, which are not properly handled in a syslog call...

CVE-2002-0163

Vulnerability: Squid earlier than 2.4 STABLE4 and some 2.5/2.6 builds were exposed to a heap-based buffer overflow in the internal DNS code when handling compressed DNS responses, caused by improper bounds/checks in lib/rfc1035.c. Impact per sources: potential denial of service and possible remot...

CVE-2002-0067

Squid 2.4 STABLE3 and earlier does not properly disable HTCP, even when "htcpport 0" is specified in squid.conf, which could allow remote attackers to bypass intended access restrictions...

CVE-2002-0714

FTP proxy in Squid before 2.4.STABLE6 does not compare the IP addresses of control and data connections with the FTP server, which allows remote attackers to bypass firewall rules or spoof FTP server responses...

CVE-2002-0067

Summary: CVE-2002-0067 affects Squid 2.4 STABLE3 and earlier, where the HTCP interface is not properly disabled even when squid.conf sets htcp_port 0, potentially allowing remote attackers to bypass access restrictions. Root cause (as described): HTCP cannot be fully disabled in these releases, e...

CVE-2002-0069

CVE-2002-0069 concerns Squid 2.4 STABLE3 and earlier with three issues per Mandrake MDKSA-2002:016-1: (1) memory leak in the SNMP interface that could allow remote DoS; (2) FTP URL handling buffer overflow that could cause DoS and possibly remote code execution (not confirmed); (3) HTCP interface...

CVE-2002-0068

CVE-2002-0068 affects Squid 2.4 STABLE3 and earlier, due to a buffer overflow in FTP URL parsing when the URL contains many special characters. This can cause a core dump (DoS) and, in some reports, may allow remote code execution. Mitigation: upgrade to Squid 2.4.STABLE4 or newer (and apply vend...

CVE-2002-0714

The advisory scope confirms that CVE-2002-0714 affects the Squid FTP proxy prior to 2.4.STABLE6, where the FTP control and data channel addresses were not compared to the FTP server’s address. This allowed remote attackers to bypass firewall rules or spoof FTP server responses. Multiple connected...

CVE-2002-0714

FTP proxy in Squid before 2.4.STABLE6 does not compare the IP addresses of control and data connections with the FTP server, which allows remote attackers to bypass firewall rules or spoof FTP server responses...

CVE-2002-2414

Opera 6.0.3, when using Squid 2.4 for HTTPS proxying, does not properly handle when accepting a non-global certificate authority CA certificate from a site and establishing a subsequent HTTPS connection, which allows remote attackers to cause a denial of service crash...

CVE-2002-0916

Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and earlier, allows remote attackers to execute arbitrary code via format strings in the user name, which are not properly handled in a syslog call...

DEBIAN-CVE-2002-0916

Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and earlier, allows remote attackers to execute arbitrary code via format strings in the user name, which are not properly handled in a syslog call...

CVE-2002-0916

Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and earlier, allows remote attackers to execute arbitrary code via format strings in the user name, which are not properly handled in a syslog call...

CVE-2002-0735

Format string vulnerability in the logging function in C-Note Squid LDAP authentication module squidauthLDAP 2.0.2 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code by triggering log messages...

CVE-2002-0735

Format string vulnerability in the logging function in C-Note Squid LDAP authentication module squidauthLDAP 2.0.2 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code by triggering log messages...

CVE-2002-0735

CVE-2002-0735 affects the C-Note Squid LDAP authentication module (squid_auth_LDAP) 2.0.2 and earlier. The issue is a format string vulnerability in the logging() function, allowing remote attackers to cause a denial of service and potentially execute arbitrary code by triggering log messages. No...