CVE-2016-4054

CVE-2016-4054: A remote code execution vulnerability in Squid related to processing Edge Side Includes (ESI) responses. The issue appears in Squid 3.x (pre-3.5.17) and 4.x (pre-4.0.9) per the initial entry; connected advisories confirm ESI-related buffer/validation flaws and exposures when Squid ...

CVE-2016-4554

CVE-2016-4554 affects Squid and is a header smuggling flaw in mime_get_header_field() that can bypass same-origin protections and enable cache poisoning when Squid acts as a reverse/interception proxy. Connected advisories describe concurrent issues (CVE-2016-4051/4052/4053/4054) in ESI processin...

CVE-2016-4051

Squid’s vulnerability CVE-2016-4051 is a buffer overflow in cachemgr.cgi that could allow remote attackers to cause a DoS or execute arbitrary code. Affected products include Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9, via remotely supplied data sent to the CGI interface. Public advisorie...

CVE-2016-4556

Squid 3.x before 3.5.18 and 4.x before 4.0.10 is vulnerable to a double-free in Esi.cc (related to processing Edge Side Includes) which can allow remote servers to trigger a Denial of Service (crash). The issue is confirmed across multiple advisories (e.g., Debian DSA-3625-1, CentOS/RH advisories...

CVE-2016-4052

CVE-2016-4052 is a Squid vulnerability where buffer overflows occur while processing ESI responses, enabling a remote attacker to cause a DoS or potentially execute arbitrary code. Affected releases include Squid 3.x before 3.5.17 and 4.x before 4.0.9. Connected advisories confirm multiple mitiga...

CVE-2016-4053

CVE-2016-4053 in Squid allowed public information disclosure of the server stack layout when processing ESI responses. The issue is documented across multiple advisories (Debian, Red Hat/CentOS, Fedora, Amazon ALAS) with fixes in various branches: Debians fixed squid3 3.1.20-2.2+deb7u5; Jessie/St...

CVE-2016-4555

CVE-2016-4555 affects Squid 3.x (before 3.5.18) and 4.x (before 4.0.10); DoS/crash via crafted Edge Side Includes (ESI) responses due to incorrect pointer handling and ref-counting. Connected advisories indicate fixes in Squid 3.4.8-6+deb8u3 and 3.5.19-1 (Debian), CentOS/RHSA advisories, and Fedo...

CVE-2016-2569

CVE-2016-2569 affects Squid (3.x before 3.5.15 and 4.x before 4.0.7). The issue is an incorrect boundary check when appending data to a String object for HTTP headers (notably the Vary header) in responses, which can cause an assertion failure and crash the daemon via a crafted header. Multiple c...

CVE-2016-2571

CVE-2016-2571 is a vulnerability in Squid where http.cc proceeds with storing data after a response-parsing failure, enabling remote HTTP servers to cause a denial of service via a malformed response. Affected: Squid 3.x before 3.5.15 and 4.x before 4.0.7. Mitigation: upgrade to 3.5.15+/4.0.7+ or...

CVE-2016-2570

CVE-2016-2570 affects Squid 3.x before 3.5.15 and 4.x before 4.0.7. The Edge Side Includes (ESI) parser does not check buffer limits during XML parsing, allowing remote HTTP servers to trigger a denial of service (assertion failure and daemon exit) with a crafted XML document (esi/CustomParser.cc...

CVE-2016-3948

CVE-2016-3948 affects Squid 3.x before 3.5.16 and 4.x before 4.0.8, where insufficient bounds checking on HTTP Vary headers allows remote attackers to cause a denial of service via a crafted HTTP response. Related advisories show fixes in newer Squid releases (e.g., 3.5.20 and 4.x series updates)...

CVE-2016-4553

CVE-2016-4553 affects Squid, where the HTTP request handling fails to ignore the Host header for absolute URIs in the request line. This allows remote attackers to perform cache-poisoning. Affected versions are Squid < 3.5.18 and 4.x

CVE-2016-3947

CVE-2016-3947 is a heap-based buffer overflow in Squid's pinger ICMPv6 processing (Icmp6::Recv) that affects Squid 3.5.x before 3.5.16 and 4.x before 4.0.8. Exploitation can cause denial of service (performance degradation or transition failures) or write sensitive data to logs via ICMPv6 packets...

CVE-2016-2390

CVE-2016-2390 affects Squid up to 3.5.14 and 4.0.x up to 4.0.6 where FwdState::connectedToPeer mishandles SSL handshake errors when built with --with-openssl, enabling remote DoS via a plaintext HTTP message. Remediation is to upgrade to Squid 3.5.14+ and 4.0.6+ (or apply vendor-specific security...

CVE-2016-2572

CVE-2016-2572 affects Squid with http.cc in 4.x before 4.0.7. Root cause: after a response-parsing failure, Squid relies on the HTTP status code, enabling remote HTTP servers to trigger a denial of service (assertion failure and daemon exit) via a malformed response. Public advisories (e.g., Mira...