Lucene search

K
ubuntuUbuntuUSN-2995-1
HistoryJun 09, 2016 - 12:00 a.m.

Squid vulnerabilities

2016-06-0900:00:00
ubuntu.com
34

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.529 Medium

EPSS

Percentile

97.5%

Releases

  • Ubuntu 16.04 ESM
  • Ubuntu 15.10
  • Ubuntu 14.04 ESM
  • Ubuntu 12.04

Packages

  • squid3 - Web proxy cache server

Details

Yuriy M. Kaminskiy discovered that the Squid pinger utility incorrectly
handled certain ICMPv6 packets. A remote attacker could use this issue to
cause Squid to crash, resulting in a denial of service, or possibly cause
Squid to leak information into log files. (CVE-2016-3947)

Yuriy M. Kaminskiy discovered that the Squid cachemgr.cgi tool incorrectly
handled certain crafted data. A remote attacker could use this issue to
cause Squid to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-4051)

It was discovered that Squid incorrectly handled certain Edge Side Includes
(ESI) responses. A remote attacker could possibly use this issue to cause
Squid to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-4052, CVE-2016-4053, CVE-2016-4054)

Jianjun Chen discovered that Squid did not correctly ignore the Host header
when absolute-URI is provided. A remote attacker could possibly use this
issue to conduct cache-poisoning attacks. This issue only affected Ubuntu
14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-4553)

Jianjun Chen discovered that Squid incorrectly handled certain HTTP Host
headers. A remote attacker could possibly use this issue to conduct
cache-poisoning attacks. (CVE-2016-4554)

It was discovered that Squid incorrectly handled certain Edge Side Includes
(ESI) responses. A remote attacker could possibly use this issue to cause
Squid to crash, resulting in a denial of service. (CVE-2016-4555,
CVE-2016-4556)

OSVersionArchitecturePackageVersionFilename
Ubuntu16.04noarchsquid-cgi< 3.5.12-1ubuntu7.2UNKNOWN
Ubuntu16.04noarchsquid< 3.5.12-1ubuntu7.2UNKNOWN
Ubuntu16.04noarchsquid-cgi-dbgsym< 3.5.12-1ubuntu7.2UNKNOWN
Ubuntu16.04noarchsquid-common< 3.5.12-1ubuntu7.2UNKNOWN
Ubuntu16.04noarchsquid-dbg< 3.5.12-1ubuntu7.2UNKNOWN
Ubuntu16.04noarchsquid-dbgsym< 3.5.12-1ubuntu7.2UNKNOWN
Ubuntu16.04noarchsquid-purge< 3.5.12-1ubuntu7.2UNKNOWN
Ubuntu16.04noarchsquid-purge-dbgsym< 3.5.12-1ubuntu7.2UNKNOWN
Ubuntu16.04noarchsquid3< 3.5.12-1ubuntu7.2UNKNOWN
Ubuntu16.04noarchsquidclient< 3.5.12-1ubuntu7.2UNKNOWN
Rows per page:
1-10 of 421

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.529 Medium

EPSS

Percentile

97.5%