CVSS: 7.5EPSS: 75%CPEs: 88EXPL: 0CVE-2014-3609 – squid: assertion failure in Range header processing (SQUID-2014:2)
https://notcve.org/view.php?id=CVE-2014-3609
28 Aug 2014 — HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values." HttpHdrRange.cc en Squid 3.x anterior a 3.3.12 y 3.4.x anterior a 3.4.6 permite a atacantes remotos causar una denegación de servicio (caída) a través de una solicitud con ' cabeceras de rango con valores de rango de bytes no identificables' manipuladas. A flaw was found in the way Squid handled malfor... • http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00025.html • CWE-20: Improper Input Validation CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 55%CPEs: 87EXPL: 0CVE-2014-0128 – squid: denial of service when using SSL-Bump
https://notcve.org/view.php?id=CVE-2014-0128
14 Apr 2014 — Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management. Squid 3.1 anterior a 3.3.12 y 3.4 anterior a 3.4.4, cuando SSL-Bump está habilitado, permite a atacantes remotos causar una denegación de servicio (fallo de aserción) a través de una solicitud de rango manipulada, relacionado con gestión de estado. Due to incorrect state management, Squid before 3.3.12 is vu... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 37%CPEs: 32EXPL: 0CVE-2013-1839 – Gentoo Linux Security Advisory 201309-22
https://notcve.org/view.php?id=CVE-2013-1839
27 Sep 2013 — The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a "," character in an Accept-Language header. La función strHdrAcptLangGetItem en errorpage.cc de Squid 3.2.x (anteriores a 3.2.9) y 3.3.x (anteriores a 3.3.3) permite a un atacante remoto causar una denegación de servicio (bucle infinito y consumo de CPU) a través de un caracter "," en la cabecera Accept-Language. ... • http://archives.neohapsis.com/archives/bugtraq/2013-03/0025.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 76%CPEs: 42EXPL: 1CVE-2013-4123 – Squid 3.3.5 - Denial of Service (PoC)
https://notcve.org/view.php?id=CVE-2013-4123
16 Sep 2013 — client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafted port number in a HTTP Host header. client_side_request.cc en Squid 3.2.x anteriores a 3.2.13 y 3.3.x anteriores a 3.3.8 permite a un atacante remoto causar una denegación de servicio a través de un número de puerto manipulado en una cabecera HTTP Host. Multiple vulnerabilities have been found in Squid, possibly resulting in remote Denial of Service. Versions less than... • https://www.exploit-db.com/exploits/26886 • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 75%CPEs: 23EXPL: 0CVE-2013-4115 – squid: buffer overflow when processing overly long DNS names (SQUID-2013:2)
https://notcve.org/view.php?id=CVE-2013-4115
25 Jul 2013 — Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows remote attackers to cause a denial of service (memory corruption and server termination) via a long name in a DNS lookup request. Desbordamiento de búfer en la función idnsALookup en dns_internal.cc en Squid v3.2 hasta v3.2.11 y v3.3 hasta v3.3.6, lo que permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria o finalización de servicio) a través de un nombre ... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 72%CPEs: 63EXPL: 0CVE-2013-0189 – Gentoo Linux Security Advisory 201309-22
https://notcve.org/view.php?id=CVE-2013-0189
08 Feb 2013 — cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service (resource consumption) via a crafted request. NOTE: this issue is due to an incorrect fix for CVE-2012-5643, possibly involving an incorrect order of arguments or incorrect comparison. cachemgr.cgi en Squid v3.1.x, v3.2.x y posiblemente, v3.1.22, v3.2.4 y otras versiones, permite a atacantes remotos provocar una denegación de servicio (consumo de recursos) a través de una s... • http://bazaar.launchpad.net/~squid/squid/3.2/revision/11743 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 39%CPEs: 102EXPL: 0CVE-2012-5643 – squid: cachemgr.cgi memory usage DoS and memory leaks
https://notcve.org/view.php?id=CVE-2012-5643
20 Dec 2012 — Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials. Varias fugas de memoria en tools/cachemgr.cc en cachemgr.cgi en Squid v2.x y v3.x antes de v3.1.22, v3.2.x antes de v3.2.4 y v3.3.x antes de v3.3.0.2 permite a atacantes remotos provocar una d... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-20: Improper Input Validation CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 9.1EPSS: 4%CPEs: 1EXPL: 0CVE-2012-2213
https://notcve.org/view.php?id=CVE-2012-2213
28 Apr 2012 — Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable system, and the observed behavior is consistent with a squid.conf file that was (perhaps inadvertently) designed to allow access based on a "req_header Host" acl regex that matches www.uol.com.br ** EN DISPUTA ** Squid v3.1.9 p... • http://archives.neohapsis.com/archives/bugtraq/2012-04/0117.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 60%CPEs: 87EXPL: 0CVE-2011-4096 – squid: Invalid free by processing CNAME DNS record pointing to another CNAME record pointing to an empty A-record
https://notcve.org/view.php?id=CVE-2011-4096
17 Nov 2011 — The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service (daemon abort) via a DNS reply containing a CNAME record that references another CNAME record that contains an empty A record. La función idnsGrokReply en Squid anterior a v3.1.16 no adecuada de memoria libre, permite a atacantes remotos provocar una denegación de servicio (daemon abortar) a través de una respuesta DNS que contiene un registro CNAME que hace referencia ... • http://bugs.squid-cache.org/show_bug.cgi?id=3237#c12 • CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 77%CPEs: 71EXPL: 0CVE-2011-3205 – squid: buffer overflow flaw in Squid's Gopher reply parser (SQUID-2011:3)
https://notcve.org/view.php?id=CVE-2011-3205
06 Sep 2011 — Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression. Desbordamiento de búfer en la v3.0 anterior a v3.0.STABLE26, v3.1 anterior a v3.1.15, y v3.2 anterior a v3.2.0.11 per... • http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html •