CVE-2011-3205

CVE-2011-3205 affects Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11. Description: a buffer overflow in gopherToHTML (gopher.cc) enables a remote Gopher server to trigger memory corruption and daemon restart (DoS) via a long line in a response; it is a regression tied t...

CVE-2011-4096

CVE-2011-4096 affects Squid proxies (notably Squid 3.1.x up to before 3.1.16). The root cause is a mis-free of memory in idnsGrokReply, enabling a remote attacker to trigger a denial of service (daemon abort) via a DNS reply containing a CNAME that references another CNAME containing an empty A r...

CVE-2012-5643

The CVE-2012-5643 entry describes memory leaks in cachemgr.cgi of Squid 2.x/3.x (pre-3.1.22, pre-3.2.4, pre-3.3.0.2) enabling remote DoS via invalid Content-Length headers, long POSTs, or crafted credentials. Connected advisories confirm this causes memory consumption and potential DoS, with mult...

CVE-2014-6270

CVE-2014-6270: In Squid 2.x and 3.x, an off-by-one error in the SNMP subsystem (snmpHandleUdp in snmp_core.cc) when an SNMP port is configured can be triggered by a crafted UDP SNMP request, leading to a heap-based buffer overflow and potentially remote denial of service or arbitrary code executi...

CVE-2016-2569

CVE-2016-2569 affects Squid (3.x before 3.5.15 and 4.x before 4.0.7). The issue is an incorrect boundary check when appending data to a String object for HTTP headers (notably the Vary header) in responses, which can cause an assertion failure and crash the daemon via a crafted header. Multiple c...

CVE-2016-2571

CVE-2016-2571 is a vulnerability in Squid where http.cc proceeds with storing data after a response-parsing failure, enabling remote HTTP servers to cause a denial of service via a malformed response. Affected: Squid 3.x before 3.5.15 and 4.x before 4.0.7. Mitigation: upgrade to 3.5.15+/4.0.7+ or...

CVE-2016-2570

CVE-2016-2570 affects Squid 3.x before 3.5.15 and 4.x before 4.0.7. The Edge Side Includes (ESI) parser does not check buffer limits during XML parsing, allowing remote HTTP servers to trigger a denial of service (assertion failure and daemon exit) with a crafted XML document (esi/CustomParser.cc...

CVE-2016-3948

CVE-2016-3948 affects Squid 3.x before 3.5.16 and 4.x before 4.0.8, where insufficient bounds checking on HTTP Vary headers allows remote attackers to cause a denial of service via a crafted HTTP response. Related advisories show fixes in newer Squid releases (e.g., 3.5.20 and 4.x series updates)...

CVE-2010-0639

CVE-2010-0639 affects Squid where the function htcpHandleTstRequest in htcp.c (and htcp.cc for 3.0) can be triggered by crafting HTCP packets to the HTCP port, causing a NULL pointer dereference and a daemon crash (DoS). It affects Squid 2.x prior to 2.6.STABLE24 and 2.7 prior to 2.7.STABLE8, and...

CVE-2010-0308

CVE-2010-0308 affects Squid legacy releases: lib/rfc1035.c in Squid 2.x, 3.0–3.0.STABLE22, and 3.1–3.1.0.15 is vulnerable to a remote denial-of-service via a crafted DNS packet containing only a header. The vulnerability is triggered by processing such DNS headers, causing an assertion failure in...

CVE-2010-3072

CVE-2010-3072 affects Squid 3.x: string comparisons in String.cci on 3.1.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to trigger a NULL pointer dereference, causing a daemon crash (DoS). Concrete variants observed in advisories include upgrades to Squid 3.1.10 (and related patch...