Most recent entries from all

ALSA-2024:4861 — Moderate: squid security update

Affected: AlmaLinux:9: squid

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es):

* squid: vulnerable to a Denial of Service attack against Cache Manager error responses (CVE-2024-23638) * squid: Out-of-bounds write error may lead to Denial of Service (CVE-2024-37894)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-00895

certfr-2024-avi-0066 — Une vulnérabilité a été découverte dans Squid. Elle permet à un attaquant de provoquer un déni de service à distance.

certfr-2024-avi-0066

cnvd-2024-08086

EUVD-2026-244944

fkie_cve-2024-23638

Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.

gsd-2024-23638

OESA-2024-1124 — squid security update

Affected: openEuler:20.03-LTS-SP1: squid, openEuler:20.03-LTS-SP4: squid, openEuler:22.03-LTS: squid, openEuler:22.03-LTS-SP1: squid, openEuler:22.03-LTS-SP2: squid, openEuler:22.03-LTS-SP3: squid

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fix(es): Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.(CVE-2024-23638)

openSUSE-SU-2024:13631-1 — squid-6.6-2.1 on GA media

squid-6.6-2.1 on GA media

SUSE-SU-2024:0296-1 — Security update for squid

Security update for squid

UBUNTU-CVE-2024-23638

Affected: Ubuntu:Pro:16.04:LTS: squid3, Ubuntu:Pro:18.04:LTS: squid3, Ubuntu:20.04:LTS: squid, Ubuntu:22.04:LTS: squid

WID-SEC-W-2024-0180 — Squid: Schwachstelle ermöglicht Denial of Service

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Squid ausnutzen, um einen Denial of Service Angriff durchzuführen.