Squid@3.2.11 Security Vulnerabilities and Issues — Squid@3.2.11 CVE List

Lucene search

Squid-cacheSquid3.2.11

18 matches found

CVE•added 2017/01/27 5:59 p.m.•221 views

CVE-2016-10002

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe ...

7.5CVSS7.2AI score0.10413EPSS

CVE•added 2016/04/25 2:59 p.m.•183 views

CVE-2016-4054

Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.

8.1CVSS8.7AI score0.77003EPSS

CVE•added 2013/09/16 7:14 p.m.•158 views

CVE-2013-4123

client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafted port number in a HTTP Host header.

5CVSS6.3AI score0.75783EPSS

CVE•added 2016/04/25 2:59 p.m.•138 views

CVE-2016-4051

Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data.

8.8CVSS8.8AI score0.05513EPSS

CVE•added 2016/04/25 2:59 p.m.•126 views

CVE-2016-4052

Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses.

8.1CVSS8.5AI score0.13625EPSS

CVE•added 2016/05/10 7:59 p.m.•111 views

CVE-2016-4556

Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.

7.5CVSS7.5AI score0.56857EPSS

CVE•added 2016/04/25 2:59 p.m.•108 views

CVE-2016-4053

Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.

4.3CVSS5.8AI score0.09506EPSS

CVE•added 2016/05/10 7:59 p.m.•105 views

CVE-2016-4555

client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.

7.5CVSS7.5AI score0.68924EPSS

CVE•added 2014/09/12 2:55 p.m.•97 views

CVE-2014-6270

Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted UDP SNMP request, which triggers a heap-based buffer overflow.

6.8CVSS8.4AI score0.19915EPSS

CVE•added 2016/02/27 5:59 a.m.•90 views

CVE-2016-2571

http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.

7.5CVSS7.2AI score0.22992EPSS

CVE•added 2016/02/27 5:59 a.m.•86 views

CVE-2016-2569

Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.

7.5CVSS7.1AI score0.74153EPSS

CVE•added 2016/04/07 6:59 p.m.•85 views

CVE-2016-3948

Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP response, related to Vary headers.

7.5CVSS7.2AI score0.59748EPSS

CVE•added 2014/11/26 3:59 p.m.•75 views

CVE-2014-7142

The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.

6.4CVSS8.1AI score0.64227EPSS

CVE•added 2014/09/11 6:55 p.m.•73 views

CVE-2014-3609

HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values."

5CVSS6.2AI score0.84085EPSS

CVE•added 2014/11/26 3:59 p.m.•72 views

CVE-2014-7141

The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.

6.4CVSS8.1AI score0.77333EPSS

CVE•added 2014/04/14 3:9 p.m.•71 views

CVE-2014-0128

Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.

5CVSS8AI score0.54968EPSS

CVE•added 2016/02/27 5:59 a.m.•71 views

CVE-2016-2570

The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/C...

7.5CVSS7.2AI score0.09233EPSS

CVE•added 2015/05/18 3:59 p.m.•69 views

CVE-2015-3455

Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificat...

2.6CVSS7.2AI score0.05013EPSS