CVSS: 8.6EPSS: 46%CPEs: 15EXPL: 0CVE-2016-4553 – squid: Cache poisoning issue in HTTP Request handling
https://notcve.org/view.php?id=CVE-2016-4553
10 May 2016 — client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request. client_side.cc en Squid en versiones anteriores a 3.5.18 y 4.x en versiones anteriores a 4.0.10 no ignora correctamente la cabecera Host cuando se proporciona una URI absoluta, lo que permite a atacantes remotos llevar a cabo ataques de envenenamiento de caché a través de una petición HTTP. An... • http://bugs.squid-cache.org/show_bug.cgi?id=4501 • CWE-20: Improper Input Validation CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 8.6EPSS: 0%CPEs: 7EXPL: 0CVE-2016-4554 – squid: Header Smuggling issue in HTTP Request processing
https://notcve.org/view.php?id=CVE-2016-4554
10 May 2016 — mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue. mime_header.cc en Squid en versiones anteriores a 3.5.18 permite a atacantes remotos eludir restricciones destinadas al mismo origen y posiblemente llevar a cabo ataques de envenenamiento de caché a través de una cabecera HTTP Host manipulada, también conocido como un problema "contrabando de pet... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-20: Improper Input Validation CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 7.5EPSS: 2%CPEs: 148EXPL: 1CVE-2016-4555 – squid: SegFault from ESIInclude::Start
https://notcve.org/view.php?id=CVE-2016-4555
10 May 2016 — client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses. client_side_request.cc en Squid 3.x en versiones anteriores a 3.5.18 y 4.x en versiones anteriores a 4.0.10 permite a servidores remotos provocar una denegación de servicio (caída) a través de respuestas Edge Side Includes (ESI) manipuladas. A NULL pointer dereference flaw was found in the way Squid processes ESI responses. If Squi... • http://bugs.squid-cache.org/show_bug.cgi?id=4455 • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 5%CPEs: 148EXPL: 0CVE-2016-4556 – squid: SIGSEGV in ESIContext response handling
https://notcve.org/view.php?id=CVE-2016-4556
10 May 2016 — Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response. Vulnerabilidad de liberación doble de memoria en Esi.cc en Squid 3.x en versiones anteriores a 3.5.18 y 4.x en versiones anteriores a 4.0.10 permite a servidores remotos provocar una denegación de servicio (caída) a través de una respuesta Edge Side Includes (ESI) manipulada. An incorrect reference counting flaw was f... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 4%CPEs: 154EXPL: 0CVE-2016-4051 – squid: buffer overflow in cachemgr.cgi
https://notcve.org/view.php?id=CVE-2016-4051
25 Apr 2016 — Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data. Desbordamiento de buffer en cachemgr.cgi en Squid 2.x, 3.x en versiones anteriores a 3.5.17 y 4.x en versiones anteriores a 4.0.9 podría permitir a atacantes remotos provocar una denegación de servicio o ejecutar código arbitrario sembrando informes manager con datos manipulados. A buffer overfl... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 8.1EPSS: 2%CPEs: 144EXPL: 0CVE-2016-4052 – squid: multiple issues in ESI processing
https://notcve.org/view.php?id=CVE-2016-4052
25 Apr 2016 — Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses. Múltiples desbordamientos de buffer basado en pila en Squid 3.x en versiones anteriores a 3.5.17 y 4.x en versiones anteriores a 4.0.9 permiten a servidores HTTP remotos provocar una denegación de servicio o ejecutar código arbitrario a través de respuestas Edge Side Includes (ESI) manipuladas. B... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.1EPSS: 0%CPEs: 146EXPL: 0CVE-2016-4053 – squid: multiple issues in ESI processing
https://notcve.org/view.php?id=CVE-2016-4053
25 Apr 2016 — Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization. Squid 3.x en versiones anteriores a 3.5.17 y 4.x en versiones anteriores a 4.0.9 permite a atacantes remotos obtener información sensible sobre la estructura de pila a través de respuestas Edge Side Includes (ESI) manipuladas, relacionado con el uso incorrecto de assert y optimización del... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.1EPSS: 28%CPEs: 146EXPL: 0CVE-2016-4054 – squid: multiple issues in ESI processing
https://notcve.org/view.php?id=CVE-2016-4054
25 Apr 2016 — Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses. Desbordamiento de buffer en Squid 3.x en versiones anteriores a 3.5.17 y 4.x en versiones anteriores a 4.0.9 permite a atacantes remotos ejecutar código arbitrario a través de respuestas Edge Side Includes (ESI) manipuladas. Buffer overflow and input validation flaws were found in the way Squid processed ESI responses. If Squid was used as a revers... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.9EPSS: 65%CPEs: 3EXPL: 0CVE-2016-2390
https://notcve.org/view.php?id=CVE-2016-2390
19 Apr 2016 — The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message. El método FwdState::connectedToPeer en FwdState.cc en Squid en versiones anteriores a 3.5.14 y 4.0.x en versiones anteriores a 4.0.6 no maneja correctamente los errores de apretones de manos SSL cuando se construye c... • http://bugs.squid-cache.org/show_bug.cgi?id=4437 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 4%CPEs: 158EXPL: 0CVE-2016-3948 – squid: denial of service issue in HTTP response processing
https://notcve.org/view.php?id=CVE-2016-3948
07 Apr 2016 — Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP response, related to Vary headers. Squid 3.x en versiones anteriores a 3.5.16 y 4.x en versiones anteriores a 4.0.8 no realiza adecuadamente la comprobación de límites, lo que permite a atacantes remotos provocar una denegación de servicio a través de una respuesta HTTP manipulada, relacionada con cabeceras Vary. An incorrect boundary check was found ... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-617: Reachable Assertion •