Описание
Security update for squid3
This update for squid3 fixes the following issues:
-
Multiple issues in pinger ICMP processing. (CVE-2014-7141, CVE-2014-7142)
-
CVE-2016-3947: Buffer overrun issue in pinger ICMPv6 processing. (bsc#973782)
-
CVE-2016-4554: fix header smuggling issue in HTTP Request processing (bsc#979010)
-
Fix multiple Denial of Service issues in HTTP Response processing. (CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393, bsc#968394, bsc#968395)
-
Regression caused by the DoS fixes above (bsc#993299)
-
CVE-2016-3948: Fix denial of service in HTTP Response processing (bsc#973783)
-
CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553)
-
CVE-2016-4052, CVE-2016-4053, CVE-2016-4054:
- fixes multiple issues in ESI processing (bsc#976556)
-
CVE-2016-4556: fixes double free vulnerability in Esi.cc (bsc#979008)
-
CVE-2015-5400: Improper Protection of Alternate Path (bsc#938715)
-
CVE-2014-6270: fix off-by-one in snmp subsystem (bsc#895773)
-
Memory leak in squid3 when using external_acl (bsc#976708)
Список пакетов
SUSE Linux Enterprise Server 11 SP4
SUSE Linux Enterprise Server for SAP Applications 11 SP4
Ссылки
- Link for SUSE-SU-2016:2089-1
- E-Mail link for SUSE-SU-2016:2089-1
- SUSE Security Ratings
- SUSE Bug 895773
- SUSE Bug 902197
- SUSE Bug 938715
- SUSE Bug 963539
- SUSE Bug 967011
- SUSE Bug 968392
- SUSE Bug 968393
- SUSE Bug 968394
- SUSE Bug 968395
- SUSE Bug 973782
- SUSE Bug 973783
- SUSE Bug 976553
- SUSE Bug 976556
- SUSE Bug 976708
- SUSE Bug 979008
- SUSE Bug 979009
- SUSE Bug 979010
Описание
Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.
Затронутые продукты
Ссылки
- CVE-2011-3205
- SUSE Bug 715171
Описание
The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service (daemon abort) via a DNS reply containing a CNAME record that references another CNAME record that contains an empty A record.
Затронутые продукты
Ссылки
- CVE-2011-4096
- SUSE Bug 727492
Описание
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
Затронутые продукты
Ссылки
- CVE-2012-5643
- SUSE Bug 794954
- SUSE Bug 796999
Описание
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-0189, CVE-2013-0191. Reason: this identifier was intended for one issue, but it was inadvertently associated with multiple issues. Notes: All CVE users should consult CVE-2013-0189 and CVE-2013-0191 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Затронутые продукты
Ссылки
- CVE-2013-0188
- SUSE Bug 794954
- SUSE Bug 796999
Описание
Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows remote attackers to cause a denial of service (memory corruption and server termination) via a long name in a DNS lookup request.
Затронутые продукты
Ссылки
- CVE-2013-4115
- SUSE Bug 829084
- SUSE Bug 880233
Описание
Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.
Затронутые продукты
Ссылки
- CVE-2014-0128
- SUSE Bug 867533
Описание
Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted UDP SNMP request, which triggers a heap-based buffer overflow.
Затронутые продукты
Ссылки
- CVE-2014-6270
- SUSE Bug 895773
Описание
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.
Затронутые продукты
Ссылки
- CVE-2014-7141
- SUSE Bug 1040640
- SUSE Bug 891268
- SUSE Bug 895773
Описание
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
Затронутые продукты
Ссылки
- CVE-2014-7142
- SUSE Bug 895773
- SUSE Bug 973782
Описание
Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request.
Затронутые продукты
Ссылки
- CVE-2015-5400
- SUSE Bug 938715
- SUSE Bug 967073
Описание
The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.
Затронутые продукты
Ссылки
- CVE-2016-2390
- SUSE Bug 967011
Описание
Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.
Затронутые продукты
Ссылки
- CVE-2016-2569
- SUSE Bug 968392
- SUSE Bug 968393
Описание
The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h.
Затронутые продукты
Ссылки
- CVE-2016-2570
- SUSE Bug 968392
- SUSE Bug 968393
Описание
http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.
Затронутые продукты
Ссылки
- CVE-2016-2571
- SUSE Bug 968394
- SUSE Bug 968395
Описание
http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.
Затронутые продукты
Ссылки
- CVE-2016-2572
- SUSE Bug 968394
- SUSE Bug 968395
Описание
Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 allows remote servers to cause a denial of service (performance degradation or transition failures) or write sensitive information to log files via an ICMPv6 packet.
Затронутые продукты
Ссылки
- CVE-2016-3947
- SUSE Bug 973782
Описание
Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP response, related to Vary headers.
Затронутые продукты
Ссылки
- CVE-2016-3948
- SUSE Bug 973783
Описание
Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data.
Затронутые продукты
Ссылки
- CVE-2016-4051
- SUSE Bug 976553
Описание
Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses.
Затронутые продукты
Ссылки
- CVE-2016-4052
- SUSE Bug 976556
Описание
Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.
Затронутые продукты
Ссылки
- CVE-2016-4053
- SUSE Bug 976556
Описание
Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.
Затронутые продукты
Ссылки
- CVE-2016-4054
- SUSE Bug 976556
Описание
client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.
Затронутые продукты
Ссылки
- CVE-2016-4553
- SUSE Bug 979009
- SUSE Bug 990451
Описание
mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue.
Затронутые продукты
Ссылки
- CVE-2016-4554
- SUSE Bug 979010
- SUSE Bug 990451
Описание
client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.
Затронутые продукты
Ссылки
- CVE-2016-4555
- SUSE Bug 979008
- SUSE Bug 979011
Описание
Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.
Затронутые продукты
Ссылки
- CVE-2016-4556
- SUSE Bug 979008
- SUSE Bug 979011