CVSS: 7.5EPSS: 95%CPEs: 143EXPL: 1CVE-2016-2569 – squid: some code paths fail to check bounds in string object
https://notcve.org/view.php?id=CVE-2016-2569
Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header. Squid 3.x en versiones anteriores a 3.5.15 y 4.x en versiones anteriores a 4.0.7 no añade datos a objetos String adecuadamente, lo que permite a servidores remotos provocar una denegación de servicio (error de aserción y salida de demonio) a través de una cadena larga, según lo demostrado por una cabecera HTTP Vary manipulada. Incorrect boundary checks were found in the way squid handled headers in HTTP responses, which could lead to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a specially crafted HTTP response. • https://github.com/amit-raut/CVE-2016-2569 http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html http://rhn.redhat.com/errata/RHSA-2016-2600.html http://www.openwall.com/lists/oss-security/2016/02/26/2 http://www.securitytracker.com/id/1035101 http://www.squid-cache.org/Advisories/SQUID-2016_2.txt http://www.squi • CWE-20: Improper Input Validation CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 66%CPEs: 143EXPL: 0CVE-2016-2570 – squid: some code paths fail to check bounds in string object
https://notcve.org/view.php?id=CVE-2016-2570
The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h. El analizador de Edge Side Includes (ESI) en Squid 3.x en versiones anteriores a 3.5.15 y 4.x en versiones anteriores a 4.0.7 no comprueba los limites del buffer durante el análisis gramatical XML, lo que permite a servidores HTTP remotos provocar una denegación de servicio (fallo de aserción y salida de demonio) a través de un documento XML manipulado, relacionado con esi/CustomParser.cc y esi/CustomParser.h. Incorrect boundary checks were found in the way squid handled headers in HTTP responses, which could lead to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a specially crafted HTTP response. • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html http://rhn.redhat.com/errata/RHSA-2016-2600.html http://www.openwall.com/lists/oss-security/2016/02/26/2 http://www.securitytracker.com/id/1035101 http://www.squid-cache.org/Advisories/SQUID-2016_2.txt http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3 • CWE-20: Improper Input Validation CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 59%CPEs: 143EXPL: 0CVE-2016-2571 – squid: wrong error handling for malformed HTTP responses
https://notcve.org/view.php?id=CVE-2016-2571
http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response. http.cc en Squid 3.x en versiones anteriores a 3.5.15 y 4.x en versiones anteriores a 4.0.7 procede con el almacenamiento de ciertos datos después de un fallo de respuesta de análisis, lo que permite a servidores HTTP remotos provocar una denegación de servicio (fallo de aserción y salida de demonio) a través de una respuesta mal formada. It was found that squid did not properly handle errors when failing to parse an HTTP response, possibly leading to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a specially crafted HTTP response. • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html http://rhn.redhat.com/errata/RHSA-2016-2600.html http://www.debian.org/security/2016/dsa-3522 http://www.openwall.com/lists/oss-security/2016/02/26/2 http://www.securitytracker.com/id/1035101 http://www.squid-cache.org/Advisories/SQUID-2016_2.txt http://www.s • CWE-20: Improper Input Validation CWE-228: Improper Handling of Syntactically Invalid Structure •
CVSS: 7.5EPSS: 67%CPEs: 6EXPL: 0CVE-2016-2572 – squid: wrong error handling for malformed HTTP responses
https://notcve.org/view.php?id=CVE-2016-2572
http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response. http.cc en Squid 4.x en versiones anteriores a 4.0.7 confía en el código de estado HTTP después de un fallo de respuesta de análisis, lo que permite a servidores HTTP remotos provocar una denegación de servicio (fallo de aserción y salida de demonio) a través de una respuesta mal formada. It was found that squid did not properly handle errors when failing to parse an HTTP response, possibly leading to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a specially crafted HTTP response. • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html http://rhn.redhat.com/errata/RHSA-2016-2600.html http://www.openwall.com/lists/oss-security/2016/02/26/2 http://www.securitytracker.com/id/1035101 http://www.squid-cache.org/Advisories/SQUID-2016_2.txt http://www.squid-cache.org/Versions/v4/changesets/squid-4-14548 • CWE-20: Improper Input Validation CWE-228: Improper Handling of Syntactically Invalid Structure •
CVSS: 4.0EPSS: 0%CPEs: 17EXPL: 0CVE-2014-9749
https://notcve.org/view.php?id=CVE-2014-9749
Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability." Squid 3.4.4 hasta la versión 3.4.11 y 3.5.0.1 hasta la versión 3.5.1, cuando es utilizada la autenticación Digest, permiten a usuarios remotos autenticados retener el acceso aprovechando un nonce caducado, también conocido como 'Nonce replay vulnerability'. • http://bugs.squid-cache.org/show_bug.cgi?id=4066 http://lists.opensuse.org/opensuse-updates/2015-10/msg00052.html http://www.openwall.com/lists/oss-security/2015/10/01/1 http://www.openwall.com/lists/oss-security/2015/10/11/4 http://www.openwall.com/lists/oss-security/2015/10/12/2 • CWE-264: Permissions, Privileges, and Access Controls •