CVSS: 5.0EPSS: 95%CPEs: 88EXPL: 0CVE-2014-3609 – squid: assertion failure in Range header processing (SQUID-2014:2)
https://notcve.org/view.php?id=CVE-2014-3609
HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values." HttpHdrRange.cc en Squid 3.x anterior a 3.3.12 y 3.4.x anterior a 3.4.6 permite a atacantes remotos causar una denegación de servicio (caída) a través de una solicitud con ' cabeceras de rango con valores de rango de bytes no identificables' manipuladas. A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. • http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00025.html http://lists.opensuse.org/opensuse-updates/2014-09/msg00029.html http://rhn.redhat.com/errata/RHSA-2014-1147.html http://secunia.com/advisories/60179 http://secunia.com/advisories/60334 http://secunia.com/advisories/61320 http://secunia.com/advisories/61412 http://www.debian.org/security/2014/dsa-3014 http://www.debian.org/security/2015/dsa-3139 http://www.oracle.com/technetwork/topics/security/bulletinj • CWE-20: Improper Input Validation CWE-617: Reachable Assertion •
CVSS: 5.0EPSS: 15%CPEs: 87EXPL: 0CVE-2014-0128 – squid: denial of service when using SSL-Bump
https://notcve.org/view.php?id=CVE-2014-0128
Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management. Squid 3.1 anterior a 3.3.12 y 3.4 anterior a 3.4.4, cuando SSL-Bump está habilitado, permite a atacantes remotos causar una denegación de servicio (fallo de aserción) a través de una solicitud de rango manipulada, relacionado con gestión de estado. • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html http://lists.opensuse.org/opensuse-updates/2014-04/msg00030.html http://lists.opensuse.org/opensuse-updates/2014-04/msg00060.html http://secunia.com/advisories/57288 http://secunia.com/advisories/57889 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.securityfocus.com/bid/66112 http://www.squid-cache.org • CWE-20: Improper Input Validation •