CVE-2019-12525

CVE-2019-12525 affects Squid (3.3.9–3.5.28 and 4.x–4.7). When Digest authentication is used, Proxy-Authorization parsing may treat a single quote as valid and memcpy with length−1, causing memory corruption. Connected advisories confirm the issue and reference updates to Squid versions; however e...

CVE-2019-12522

CVE-2019-12522 (Squid) affects Squid up to version 4.7. When Squid runs as root, its child processes are spawned as a lesser user (default: nobody). The code path uses leave_suid, which leaves the Saved UID as 0, enabling an attacker who compromises a child process to escalate privileges back to ...

CVE-2019-13345

CVE-2019-13345 : XSS in the cachemgr.cgi web module of Squid through 4.7, exploitable via the user_name or auth parameter. Connected advisories confirm multiple distributions issue fixes and recommended upgrades (e.g., Debian DSA-4507, CentOS/RHEL advisories, ALAS-2 entries). The exposure is limi...

CVE-2019-12529

CVE-2019-12529 affects Squid 2.x–4.x (up to 4.7) where Basic Authentication parsing decodes Proxy-Authorization using uudecode. The decoder does not validate that the calculated decode length fits the input buffer, causing adjacent memory to be decoded and enabling a potential DoS via out-of-boun...

CVE-2019-12521

CVE-2019-12521 is a Squid vulnerability where, while parsing ESI, the ESIContext buffer used to hold ESIElements is overflowed due to an off-by-one bug in addStackElement. The overflow is within the same structure and causes a crash during processing (not adjacent memory corruption). Affected: Sq...

CVE-2019-12524

CVE-2019-12524 concerns Squid up to version 4.7 where the Cache Manager block relies on a url_regex rule that decodes incoming requests. An attacker can craft an encoded URL to bypass the url_regex check and access the blocked Cache Manager resource. Affects Squid’s request handling path and deco...

CVE-2019-12527

CVE-2019-12527 affects Squid 4.0.23–4.7. The issue arises in Basic Authentication handling: HttpHeader::getAuth decodes the Base64 blob into a fixed-size buffer without confirming decoded length, causing a heap-based buffer overflow with user-controlled data. Some sources note this can lead to re...

CVE-2019-12854

CVE-2019-12854 affects Squid up to 4.7, where incorrect string termination in cachemgr.cgi can cause access to unallocated memory and DoS for clients. Public advisories document this as a Denial of Service vector and list Squid 4.0–4.7 as affected; remediation seen in later vendor advisories/upda...

CVE-2019-12520

CVE-2019-12520 affects Squid (versions up to 4.7 and 5.x per the sources). The vulnerability arises when Squid handles a request by computing an MD5 hash of the absolute URL to check the cache; if the URL includes a decoded UserInfo (username:password), that info is prepended to the domain. An at...