Most recent entries from all

ALSA-2020:2041 — Important: squid:4 security update

Affected: AlmaLinux:8: libecap, AlmaLinux:8: libecap-devel

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es):

* squid: improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow (CVE-2019-12519)

* squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution (CVE-2020-11945)

* squid: parsing of header Proxy-Authentication leads to memory corruption (CVE-2019-12525)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2021-01747

certfr-2020-avi-239 — De multiples vulnérabilités ont été découvertes dans Squid. Elles permettent à un attaquant de provoquer une exécution…

certfr-2020-avi-239

cnvd-2020-25818

EUVD-2026-55077

fkie_cve-2019-12519

An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack won't overflow.

GHSA-2398-fmp4-7w9h

gsd-2019-12519

OESA-2021-1020 — squid security update

Affected: openEuler:20.03-LTS: squid, openEuler:20.03-LTS-SP1: squid

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.\r\n\r\n Security Fix(es):\r\n\r\n An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while its being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack wont overflow.(CVE-2019-12519)\r\n\r\n

openSUSE-SU-2020:0623-1 — Security update for squid

Security update for squid

RHSA-2020:2038 — Red Hat Security Advisory: squid:4 security update

squid: improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution

SUSE-SU-2020:1134-1 — Security update for squid

Security update for squid

UBUNTU-CVE-2019-12519

Affected: Ubuntu:16.04:LTS: squid3, Ubuntu:18.04:LTS: squid3, Ubuntu:20.04:LTS: squid

WID-SEC-W-2022-1593 — Squid: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Squid ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen oder Sicherheitsvorkehrungen zu umgehen.