Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2011-3205 (GCVE-0-2011-3205)
Vulnerability from cvelistv5
Published
2011-09-06 15:00
Modified
2024-08-06 23:29
Severity ?
EPSS score ?
Summary
Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-06T23:29:55.437Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "RHSA-2011:1293", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://www.redhat.com/support/errata/RHSA-2011-1293.html", }, { name: "46029", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/46029", }, { name: "45906", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/45906", }, { name: "FEDORA-2011-11854", tags: [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred", ], url: "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html", }, { name: "SUSE-SU-2016:1996", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", }, { name: "SUSE-SU-2011:1019", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html", }, { name: "1025981", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://securitytracker.com/id?1025981", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch", }, { name: "45965", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/45965", }, { name: "45805", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/45805", }, { name: "DSA-2304", tags: [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred", ], url: "http://www.debian.org/security/2011/dsa-2304", }, { name: "[oss-security] 20110830 Re: CVE-request(?): squid: buffer overflow in Gopher reply parser", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "http://openwall.com/lists/oss-security/2011/08/30/8", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.squid-cache.org/Advisories/SQUID-2011_3.txt", }, { name: "openSUSE-SU-2011:1018", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html", }, { name: "[oss-security] 20110829 CVE-request(?): squid: buffer overflow in Gopher reply parser", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "http://openwall.com/lists/oss-security/2011/08/29/2", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", }, { name: "[oss-security] 20110830 Re: CVE-request(?): squid: buffer overflow in Gopher reply parser", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "http://openwall.com/lists/oss-security/2011/08/30/4", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch", }, { name: "SUSE-SU-2016:2089", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", }, { name: "49356", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/49356", }, { name: "74847", tags: [ "vdb-entry", "x_refsource_OSVDB", "x_transferred", ], url: "http://www.osvdb.org/74847", }, { name: "45920", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/45920", }, { name: "MDVSA-2011:150", tags: [ "vendor-advisory", "x_refsource_MANDRIVA", "x_transferred", ], url: "http://www.mandriva.com/security/advisories?name=MDVSA-2011:150", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2011-08-29T00:00:00", descriptions: [ { lang: "en", value: "Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2016-11-25T20:57:01", orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", shortName: "redhat", }, references: [ { name: "RHSA-2011:1293", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://www.redhat.com/support/errata/RHSA-2011-1293.html", }, { name: "46029", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/46029", }, { name: "45906", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/45906", }, { name: "FEDORA-2011-11854", tags: [ "vendor-advisory", "x_refsource_FEDORA", ], url: "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html", }, { name: "SUSE-SU-2016:1996", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", }, { name: "SUSE-SU-2011:1019", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html", }, { name: "1025981", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://securitytracker.com/id?1025981", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch", }, { name: "45965", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/45965", }, { name: "45805", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/45805", }, { name: "DSA-2304", tags: [ "vendor-advisory", "x_refsource_DEBIAN", ], url: "http://www.debian.org/security/2011/dsa-2304", }, { name: "[oss-security] 20110830 Re: CVE-request(?): squid: buffer overflow in Gopher reply parser", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "http://openwall.com/lists/oss-security/2011/08/30/8", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://www.squid-cache.org/Advisories/SQUID-2011_3.txt", }, { name: "openSUSE-SU-2011:1018", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html", }, { name: "[oss-security] 20110829 CVE-request(?): squid: buffer overflow in Gopher reply parser", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "http://openwall.com/lists/oss-security/2011/08/29/2", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", }, { name: "[oss-security] 20110830 Re: CVE-request(?): squid: buffer overflow in Gopher reply parser", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "http://openwall.com/lists/oss-security/2011/08/30/4", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch", }, { name: "SUSE-SU-2016:2089", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", }, { name: "49356", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/49356", }, { name: "74847", tags: [ "vdb-entry", "x_refsource_OSVDB", ], url: "http://www.osvdb.org/74847", }, { name: "45920", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/45920", }, { name: "MDVSA-2011:150", tags: [ "vendor-advisory", "x_refsource_MANDRIVA", ], url: "http://www.mandriva.com/security/advisories?name=MDVSA-2011:150", }, ], }, }, cveMetadata: { assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", assignerShortName: "redhat", cveId: "CVE-2011-3205", datePublished: "2011-09-06T15:00:00", dateReserved: "2011-08-19T00:00:00", dateUpdated: "2024-08-06T23:29:55.437Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { fkie_nvd: { configurations: "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"047EDDD6-02F5-4B53-8FCA-781962392080\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"01AD43AB-40BF-449F-A121-A8587E7AE449\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3942285D-E20C-45C5-9EF8-821F6D782CB8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B3FDB45B-4D91-4427-9565-812919086E7E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"86C3C8B5-C2A3-4454-9F89-38A860278366\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B37B7B4-2EAC-4C2A-9526-5C62CBA1DB8B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"056EDEEE-A09C-47A2-9217-72E4B8387E00\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2593CB12-03E2-4F98-9B89-C09D5EADE077\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A44B7A4F-3070-4092-B9AF-3A1CD0897CC7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EF79D9A9-9C11-4E6D-81D1-32CA8CA95223\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"042FE60B-7239-45C7-8EE3-A036AC7778F8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"FF5EE89A-720F-456A-BD26-FE46BBA29D9A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ADF61A74-9CF9-413E-B997-4FAE5BA28939\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5605B00F-438B-45CC-A55D-E75E57BC4684\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable14:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8316B22E-B016-4F0E-9A3F-383E9B1A85A4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable15:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"49A2C5CB-E2F1-4A72-9EA3-912050AFEF7F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable16:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"574C7DCC-B6E5-42A0-AA44-A0BCD67D1884\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable16:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"4D0DAD04-02C4-4FC4-BE08-3CAA3B85EB0B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable17:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A2B1F1A5-B435-4A5C-86DF-EC3F29D94417\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable18:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"113EF7A6-3B8D-4A50-8873-FD36FCBF284C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable19:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DC97E2DA-7378-486B-9178-3B38FF58589B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable20:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1F178890-2F7E-43F5-8D6D-5EFCD790E758\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable21:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9FA231EB-0F06-4D13-B50D-76FC8393187A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable22:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"31AB1D33-65EE-46DF-9D29-6B2BFACE7EC8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable23:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BDA4744F-5FB2-4DF8-A7B9-A33EAB004CBA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable24:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"72023FB9-F081-4F0A-9E81-2AF0470EB278\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.0.stable25:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2F7D973B-9D57-4F74-89B1-A18CDA388EF4\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6A8586AD-E820-4BAE-AAF9-AC7EF2316C06\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"802E3D2B-90B7-4725-854F-4174116BC314\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7501697A-BCFD-4DC3-8D87-CC9A186D9589\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0D6C4455-85F4-462D-9FF6-F830ED7D398E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B600BF4C-8169-4086-BFE6-F066BE5F5406\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"46272D1B-1468-48C0-B37A-7D06FAC39C47\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DA782B4B-486F-4197-BD5D-ABF791D57211\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"558D8641-E097-4D91-9B6E-07433844BB82\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0B46F5F1-38FC-4E25-8F04-CA2730561DF8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C69B0A4D-9619-4BEA-A846-C4438C2660F2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ED17FE35-6B2C-41BF-A7C7-2EECBDB5A934\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"78A50750-3A31-482C-B95C-019C8934850E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8FF6AC30-9570-4D4B-835E-CCADEB546F46\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7FB84E4E-6A0A-41C8-9DDF-3C18F526F155\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.14:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2E49E5C3-D01F-4DBC-B33A-5495D3EC44F8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.15:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"79C53B22-9F33-43E7-8D1F-EEB0DEF4B503\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.16:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"25B60DB2-F50C-42F0-B6C9-B25C34B8F578\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.17:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DE973F9E-8387-464F-AFA0-25215B340173\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.0.18:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"03D3F0E3-0C50-4A86-87F4-90FC82B312F5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CE26BEC0-B9C7-43F0-B0FB-E81870170B29\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D0778579-A193-4C61-BB1A-6D2E733F3958\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9ED5DC63-6E9D-4068-95DF-AF8FD9A0A7ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8DE890F9-12C0-4D66-B6C1-6A5A87FAD5F0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FB414FE3-3567-474B-B5A7-D3EF5DD63AB8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AF450F17-12A2-4E33-875A-5F3C2CA4A5C1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E3AB229E-2C32-410B-BFE2-62DCA734C3F3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"78A6D6B0-9BC0-418E-84EE-23697A0FEC19\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5BF7AFE1-A45A-43B7-B3C7-45C060D046BC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"41914354-D5BE-4B1F-BED3-0ECA43586537\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AE9A3716-8670-4847-A6EB-F601184D369E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D0E88EE3-EC00-4F1F-BAEF-4F1F893C5C5F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A330DFA8-BF79-45CC-BF88-6CEA26D7BC9E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"679A55F8-34B4-435A-8BCE-8F842F3FB269\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.1.14:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"898674F9-6BF7-469F-A74E-558EAFC2CD27\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.2.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6DFAB3BA-BBE9-4CFB-BE6B-BDF3E7772E7F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.2.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C9F523B8-463E-4FB0-ACB6-E36AAAF85CD9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.2.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5BA593D9-907D-4051-A3F2-0F88F01A7C79\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.2.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"20D2B364-B98A-4484-A10A-86AF43774096\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.2.0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0B7BF076-0D43-407A-86DC-D1163922A787\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.2.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AA576F49-A7F5-4013-89DF-F6C91C15B547\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.2.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5D3F52FE-FFB3-4221-8DC7-3F5680A07429\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.2.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"604FEF42-ABA7-42C1-8A5F-C3AECFD68481\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.2.0.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DC2568C1-89CB-41C1-9126-A8665614D0B1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squid-cache:squid:3.2.0.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C18B5392-3FDB-49E6-89DB-7945D337FBFB\"}]}]}]", descriptions: "[{\"lang\": \"en\", \"value\": \"Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.\"}, {\"lang\": \"es\", \"value\": \"Desbordamiento de b\\u00fafer en la v3.0 anterior a v3.0.STABLE26, v3.1 anterior a v3.1.15, y v3.2 anterior a v3.2.0.11 permite a servidores remotos Gopher provocar una denegaci\\u00f3n de servicio (corrupci\\u00f3n de memoria y reinicio del demonio) o posiblemente tener un impacto no especificado a trav\\u00e9s de una respuesta demasiado larga. NOTA: Este problema existe debido a una regresi\\u00f3n de CVE-2005-0094.\"}]", id: "CVE-2011-3205", lastModified: "2024-11-21T01:29:58.557", metrics: "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}", published: "2011-09-06T15:55:08.383", references: "[{\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://openwall.com/lists/oss-security/2011/08/29/2\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://openwall.com/lists/oss-security/2011/08/30/4\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://openwall.com/lists/oss-security/2011/08/30/8\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://secunia.com/advisories/45805\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://secunia.com/advisories/45906\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://secunia.com/advisories/45920\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://secunia.com/advisories/45965\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://secunia.com/advisories/46029\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://securitytracker.com/id?1025981\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://www.debian.org/security/2011/dsa-2304\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://www.mandriva.com/security/advisories?name=MDVSA-2011:150\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://www.osvdb.org/74847\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2011-1293.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://www.securityfocus.com/bid/49356\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://www.squid-cache.org/Advisories/SQUID-2011_3.txt\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Patch\"]}, {\"url\": \"http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Patch\"]}, {\"url\": \"http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Patch\"]}, {\"url\": \"http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Patch\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=734583\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Patch\"]}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://openwall.com/lists/oss-security/2011/08/29/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://openwall.com/lists/oss-security/2011/08/30/4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://openwall.com/lists/oss-security/2011/08/30/8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/45805\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://secunia.com/advisories/45906\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/45920\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/45965\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/46029\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://securitytracker.com/id?1025981\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.debian.org/security/2011/dsa-2304\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.mandriva.com/security/advisories?name=MDVSA-2011:150\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.osvdb.org/74847\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2011-1293.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/49356\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.squid-cache.org/Advisories/SQUID-2011_3.txt\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=734583\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]", sourceIdentifier: "secalert@redhat.com", vulnStatus: "Modified", weaknesses: "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]", }, nvd: "{\"cve\":{\"id\":\"CVE-2011-3205\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2011-09-06T15:55:08.383\",\"lastModified\":\"2025-04-11T00:51:21.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.\"},{\"lang\":\"es\",\"value\":\"Desbordamiento de búfer en la v3.0 anterior a v3.0.STABLE26, v3.1 anterior a v3.1.15, y v3.2 anterior a v3.2.0.11 permite a servidores remotos Gopher provocar una denegación de servicio (corrupción de memoria y reinicio del demonio) o posiblemente tener un impacto no especificado a través de una respuesta demasiado larga. NOTA: Este problema existe debido a una regresión de CVE-2005-0094.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"047EDDD6-02F5-4B53-8FCA-781962392080\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"01AD43AB-40BF-449F-A121-A8587E7AE449\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3942285D-E20C-45C5-9EF8-821F6D782CB8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3FDB45B-4D91-4427-9565-812919086E7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"86C3C8B5-C2A3-4454-9F89-38A860278366\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B37B7B4-2EAC-4C2A-9526-5C62CBA1DB8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"056EDEEE-A09C-47A2-9217-72E4B8387E00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2593CB12-03E2-4F98-9B89-C09D5EADE077\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A44B7A4F-3070-4092-B9AF-3A1CD0897CC7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF79D9A9-9C11-4E6D-81D1-32CA8CA95223\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"042FE60B-7239-45C7-8EE3-A036AC7778F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF5EE89A-720F-456A-BD26-FE46BBA29D9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ADF61A74-9CF9-413E-B997-4FAE5BA28939\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5605B00F-438B-45CC-A55D-E75E57BC4684\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8316B22E-B016-4F0E-9A3F-383E9B1A85A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49A2C5CB-E2F1-4A72-9EA3-912050AFEF7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"574C7DCC-B6E5-42A0-AA44-A0BCD67D1884\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D0DAD04-02C4-4FC4-BE08-3CAA3B85EB0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2B1F1A5-B435-4A5C-86DF-EC3F29D94417\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"113EF7A6-3B8D-4A50-8873-FD36FCBF284C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC97E2DA-7378-486B-9178-3B38FF58589B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F178890-2F7E-43F5-8D6D-5EFCD790E758\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9FA231EB-0F06-4D13-B50D-76FC8393187A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31AB1D33-65EE-46DF-9D29-6B2BFACE7EC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDA4744F-5FB2-4DF8-A7B9-A33EAB004CBA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"72023FB9-F081-4F0A-9E81-2AF0470EB278\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.0.stable25:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F7D973B-9D57-4F74-89B1-A18CDA388EF4\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6A8586AD-E820-4BAE-AAF9-AC7EF2316C06\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"802E3D2B-90B7-4725-854F-4174116BC314\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7501697A-BCFD-4DC3-8D87-CC9A186D9589\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D6C4455-85F4-462D-9FF6-F830ED7D398E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B600BF4C-8169-4086-BFE6-F066BE5F5406\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"46272D1B-1468-48C0-B37A-7D06FAC39C47\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA782B4B-486F-4197-BD5D-ABF791D57211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"558D8641-E097-4D91-9B6E-07433844BB82\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B46F5F1-38FC-4E25-8F04-CA2730561DF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C69B0A4D-9619-4BEA-A846-C4438C2660F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED17FE35-6B2C-41BF-A7C7-2EECBDB5A934\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"78A50750-3A31-482C-B95C-019C8934850E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8FF6AC30-9570-4D4B-835E-CCADEB546F46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FB84E4E-6A0A-41C8-9DDF-3C18F526F155\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E49E5C3-D01F-4DBC-B33A-5495D3EC44F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"79C53B22-9F33-43E7-8D1F-EEB0DEF4B503\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25B60DB2-F50C-42F0-B6C9-B25C34B8F578\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE973F9E-8387-464F-AFA0-25215B340173\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"03D3F0E3-0C50-4A86-87F4-90FC82B312F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE26BEC0-B9C7-43F0-B0FB-E81870170B29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0778579-A193-4C61-BB1A-6D2E733F3958\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9ED5DC63-6E9D-4068-95DF-AF8FD9A0A7ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8DE890F9-12C0-4D66-B6C1-6A5A87FAD5F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB414FE3-3567-474B-B5A7-D3EF5DD63AB8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF450F17-12A2-4E33-875A-5F3C2CA4A5C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3AB229E-2C32-410B-BFE2-62DCA734C3F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"78A6D6B0-9BC0-418E-84EE-23697A0FEC19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5BF7AFE1-A45A-43B7-B3C7-45C060D046BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"41914354-D5BE-4B1F-BED3-0ECA43586537\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE9A3716-8670-4847-A6EB-F601184D369E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0E88EE3-EC00-4F1F-BAEF-4F1F893C5C5F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A330DFA8-BF79-45CC-BF88-6CEA26D7BC9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"679A55F8-34B4-435A-8BCE-8F842F3FB269\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.1.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"898674F9-6BF7-469F-A74E-558EAFC2CD27\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6DFAB3BA-BBE9-4CFB-BE6B-BDF3E7772E7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9F523B8-463E-4FB0-ACB6-E36AAAF85CD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5BA593D9-907D-4051-A3F2-0F88F01A7C79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"20D2B364-B98A-4484-A10A-86AF43774096\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B7BF076-0D43-407A-86DC-D1163922A787\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA576F49-A7F5-4013-89DF-F6C91C15B547\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D3F52FE-FFB3-4221-8DC7-3F5680A07429\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"604FEF42-ABA7-42C1-8A5F-C3AECFD68481\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC2568C1-89CB-41C1-9126-A8665614D0B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squid-cache:squid:3.2.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C18B5392-3FDB-49E6-89DB-7945D337FBFB\"}]}]}],\"references\":[{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://openwall.com/lists/oss-security/2011/08/29/2\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://openwall.com/lists/oss-security/2011/08/30/4\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://openwall.com/lists/oss-security/2011/08/30/8\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/45805\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/45906\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/45920\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/45965\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/46029\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://securitytracker.com/id?1025981\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.debian.org/security/2011/dsa-2304\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2011:150\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.osvdb.org/74847\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2011-1293.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securityfocus.com/bid/49356\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.squid-cache.org/Advisories/SQUID-2011_3.txt\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=734583\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://openwall.com/lists/oss-security/2011/08/29/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://openwall.com/lists/oss-security/2011/08/30/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://openwall.com/lists/oss-security/2011/08/30/8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/45805\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/45906\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/45920\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/45965\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/46029\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://securitytracker.com/id?1025981\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2011/dsa-2304\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2011:150\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.osvdb.org/74847\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2011-1293.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/49356\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.squid-cache.org/Advisories/SQUID-2011_3.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=734583\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}", }, }
ghsa-xv7f-73w8-27qj
Vulnerability from github
Published
2022-05-17 03:46
Modified
2022-05-17 03:46
Details
Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.
{ affected: [], aliases: [ "CVE-2011-3205", ], database_specific: { cwe_ids: [], github_reviewed: false, github_reviewed_at: null, nvd_published_at: "2011-09-06T15:55:00Z", severity: "MODERATE", }, details: "Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.", id: "GHSA-xv7f-73w8-27qj", modified: "2022-05-17T03:46:34Z", published: "2022-05-17T03:46:34Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2011-3205", }, { type: "WEB", url: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", }, { type: "WEB", url: "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html", }, { type: "WEB", url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html", }, { type: "WEB", url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html", }, { type: "WEB", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", }, { type: "WEB", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", }, { type: "WEB", url: "http://openwall.com/lists/oss-security/2011/08/29/2", }, { type: "WEB", url: "http://openwall.com/lists/oss-security/2011/08/30/4", }, { type: "WEB", url: "http://openwall.com/lists/oss-security/2011/08/30/8", }, { type: "WEB", url: "http://secunia.com/advisories/45805", }, { type: "WEB", url: "http://secunia.com/advisories/45906", }, { type: "WEB", url: "http://secunia.com/advisories/45920", }, { type: "WEB", url: "http://secunia.com/advisories/45965", }, { type: "WEB", url: "http://secunia.com/advisories/46029", }, { type: "WEB", url: "http://securitytracker.com/id?1025981", }, { type: "WEB", url: "http://www.debian.org/security/2011/dsa-2304", }, { type: "WEB", url: "http://www.mandriva.com/security/advisories?name=MDVSA-2011:150", }, { type: "WEB", url: "http://www.osvdb.org/74847", }, { type: "WEB", url: "http://www.redhat.com/support/errata/RHSA-2011-1293.html", }, { type: "WEB", url: "http://www.securityfocus.com/bid/49356", }, { type: "WEB", url: "http://www.squid-cache.org/Advisories/SQUID-2011_3.txt", }, { type: "WEB", url: "http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch", }, { type: "WEB", url: "http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch", }, { type: "WEB", url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch", }, { type: "WEB", url: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch", }, ], schema_version: "1.4.0", severity: [], }
RHSA-2011:1293
Vulnerability from csaf_redhat
Published
2011-09-14 18:48
Modified
2024-11-22 04:39
Summary
Red Hat Security Advisory: squid security update
Notes
Topic
An updated squid package that fixes one security issue is now available for
Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
Details
Squid is a high-performance proxy caching server for web clients,
supporting FTP, Gopher, and HTTP data objects.
A buffer overflow flaw was found in the way Squid parsed replies from
remote Gopher servers. A remote user allowed to send Gopher requests to a
Squid proxy could possibly use this flaw to cause the squid child process
to crash or execute arbitrary code with the privileges of the squid user,
by making Squid perform a request to an attacker-controlled Gopher server.
(CVE-2011-3205)
Users of squid should upgrade to this updated package, which contains a
backported patch to correct this issue. After installing this update, the
squid service will be restarted automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An updated squid package that fixes one security issue is now available for\nRed Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.", title: "Topic", }, { category: "general", text: "Squid is a high-performance proxy caching server for web clients,\nsupporting FTP, Gopher, and HTTP data objects.\n\nA buffer overflow flaw was found in the way Squid parsed replies from\nremote Gopher servers. A remote user allowed to send Gopher requests to a\nSquid proxy could possibly use this flaw to cause the squid child process\nto crash or execute arbitrary code with the privileges of the squid user,\nby making Squid perform a request to an attacker-controlled Gopher server.\n(CVE-2011-3205)\n\nUsers of squid should upgrade to this updated package, which contains a\nbackported patch to correct this issue. After installing this update, the\nsquid service will be restarted automatically.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2011:1293", url: "https://access.redhat.com/errata/RHSA-2011:1293", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "734583", url: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1293.json", }, ], title: "Red Hat Security Advisory: squid security update", tracking: { current_release_date: "2024-11-22T04:39:51+00:00", generator: { date: "2024-11-22T04:39:51+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2011:1293", initial_release_date: "2011-09-14T18:48:00+00:00", revision_history: [ { date: "2011-09-14T18:48:00+00:00", number: "1", summary: "Initial version", }, { date: "2011-09-14T14:51:13+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T04:39:51+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux Server (v. 6)", product: { name: "Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:6::server", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "squid-debuginfo-7:3.1.10-1.el6_1.1.i686", product: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.i686", product_id: "squid-debuginfo-7:3.1.10-1.el6_1.1.i686", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-1.el6_1.1?arch=i686&epoch=7", }, }, }, { category: "product_version", name: "squid-7:3.1.10-1.el6_1.1.i686", product: { name: "squid-7:3.1.10-1.el6_1.1.i686", product_id: "squid-7:3.1.10-1.el6_1.1.i686", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-1.el6_1.1?arch=i686&epoch=7", }, }, }, ], category: "architecture", name: "i686", }, { branches: [ { category: "product_version", name: "squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", product: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", product_id: "squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-1.el6_1.1?arch=ppc64&epoch=7", }, }, }, { category: "product_version", name: "squid-7:3.1.10-1.el6_1.1.ppc64", product: { name: "squid-7:3.1.10-1.el6_1.1.ppc64", product_id: "squid-7:3.1.10-1.el6_1.1.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-1.el6_1.1?arch=ppc64&epoch=7", }, }, }, ], category: "architecture", name: "ppc64", }, { branches: [ { category: "product_version", name: "squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", product: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", product_id: "squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-1.el6_1.1?arch=s390x&epoch=7", }, }, }, { category: "product_version", name: "squid-7:3.1.10-1.el6_1.1.s390x", product: { name: "squid-7:3.1.10-1.el6_1.1.s390x", product_id: "squid-7:3.1.10-1.el6_1.1.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-1.el6_1.1?arch=s390x&epoch=7", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", product: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", product_id: "squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-1.el6_1.1?arch=x86_64&epoch=7", }, }, }, { category: "product_version", name: "squid-7:3.1.10-1.el6_1.1.x86_64", product: { name: "squid-7:3.1.10-1.el6_1.1.x86_64", product_id: "squid-7:3.1.10-1.el6_1.1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-1.el6_1.1?arch=x86_64&epoch=7", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-1.el6_1.1.src", product: { name: "squid-7:3.1.10-1.el6_1.1.src", product_id: "squid-7:3.1.10-1.el6_1.1.src", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-1.el6_1.1?arch=src&epoch=7", }, }, }, ], category: "architecture", name: "src", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-1.el6_1.1.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.i686", }, product_reference: "squid-7:3.1.10-1.el6_1.1.i686", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-1.el6_1.1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.ppc64", }, product_reference: "squid-7:3.1.10-1.el6_1.1.ppc64", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-1.el6_1.1.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.s390x", }, product_reference: "squid-7:3.1.10-1.el6_1.1.s390x", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-1.el6_1.1.src as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.src", }, product_reference: "squid-7:3.1.10-1.el6_1.1.src", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-1.el6_1.1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.x86_64", }, product_reference: "squid-7:3.1.10-1.el6_1.1.x86_64", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.i686", }, product_reference: "squid-debuginfo-7:3.1.10-1.el6_1.1.i686", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", }, product_reference: "squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", }, product_reference: "squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", }, product_reference: "squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", relates_to_product_reference: "6Server-6.1.z", }, ], }, vulnerabilities: [ { cve: "CVE-2011-3205", discovery_date: "2011-08-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "734583", }, ], notes: [ { category: "description", text: "Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.", title: "Vulnerability description", }, { category: "summary", text: "squid: buffer overflow flaw in Squid's Gopher reply parser (SQUID-2011:3)", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.src", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.x86_64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2011-3205", }, { category: "external", summary: "RHBZ#734583", url: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2011-3205", url: "https://www.cve.org/CVERecord?id=CVE-2011-3205", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2011-3205", url: "https://nvd.nist.gov/vuln/detail/CVE-2011-3205", }, ], release_date: "2011-08-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2011-09-14T18:48:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/kb/docs/DOC-11259", product_ids: [ "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.src", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.x86_64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2011:1293", }, ], scores: [ { cvss_v2: { accessComplexity: "MEDIUM", accessVector: "ADJACENT_NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5.4, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:A/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, products: [ "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.src", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.x86_64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "squid: buffer overflow flaw in Squid's Gopher reply parser (SQUID-2011:3)", }, ], }
rhsa-2011:1293
Vulnerability from csaf_redhat
Published
2011-09-14 18:48
Modified
2024-11-22 04:39
Summary
Red Hat Security Advisory: squid security update
Notes
Topic
An updated squid package that fixes one security issue is now available for
Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
Details
Squid is a high-performance proxy caching server for web clients,
supporting FTP, Gopher, and HTTP data objects.
A buffer overflow flaw was found in the way Squid parsed replies from
remote Gopher servers. A remote user allowed to send Gopher requests to a
Squid proxy could possibly use this flaw to cause the squid child process
to crash or execute arbitrary code with the privileges of the squid user,
by making Squid perform a request to an attacker-controlled Gopher server.
(CVE-2011-3205)
Users of squid should upgrade to this updated package, which contains a
backported patch to correct this issue. After installing this update, the
squid service will be restarted automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An updated squid package that fixes one security issue is now available for\nRed Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.", title: "Topic", }, { category: "general", text: "Squid is a high-performance proxy caching server for web clients,\nsupporting FTP, Gopher, and HTTP data objects.\n\nA buffer overflow flaw was found in the way Squid parsed replies from\nremote Gopher servers. A remote user allowed to send Gopher requests to a\nSquid proxy could possibly use this flaw to cause the squid child process\nto crash or execute arbitrary code with the privileges of the squid user,\nby making Squid perform a request to an attacker-controlled Gopher server.\n(CVE-2011-3205)\n\nUsers of squid should upgrade to this updated package, which contains a\nbackported patch to correct this issue. After installing this update, the\nsquid service will be restarted automatically.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2011:1293", url: "https://access.redhat.com/errata/RHSA-2011:1293", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "734583", url: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1293.json", }, ], title: "Red Hat Security Advisory: squid security update", tracking: { current_release_date: "2024-11-22T04:39:51+00:00", generator: { date: "2024-11-22T04:39:51+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2011:1293", initial_release_date: "2011-09-14T18:48:00+00:00", revision_history: [ { date: "2011-09-14T18:48:00+00:00", number: "1", summary: "Initial version", }, { date: "2011-09-14T14:51:13+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T04:39:51+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux Server (v. 6)", product: { name: "Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:6::server", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "squid-debuginfo-7:3.1.10-1.el6_1.1.i686", product: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.i686", product_id: "squid-debuginfo-7:3.1.10-1.el6_1.1.i686", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-1.el6_1.1?arch=i686&epoch=7", }, }, }, { category: "product_version", name: "squid-7:3.1.10-1.el6_1.1.i686", product: { name: "squid-7:3.1.10-1.el6_1.1.i686", product_id: "squid-7:3.1.10-1.el6_1.1.i686", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-1.el6_1.1?arch=i686&epoch=7", }, }, }, ], category: "architecture", name: "i686", }, { branches: [ { category: "product_version", name: "squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", product: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", product_id: "squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-1.el6_1.1?arch=ppc64&epoch=7", }, }, }, { category: "product_version", name: "squid-7:3.1.10-1.el6_1.1.ppc64", product: { name: "squid-7:3.1.10-1.el6_1.1.ppc64", product_id: "squid-7:3.1.10-1.el6_1.1.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-1.el6_1.1?arch=ppc64&epoch=7", }, }, }, ], category: "architecture", name: "ppc64", }, { branches: [ { category: "product_version", name: "squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", product: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", product_id: "squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-1.el6_1.1?arch=s390x&epoch=7", }, }, }, { category: "product_version", name: "squid-7:3.1.10-1.el6_1.1.s390x", product: { name: "squid-7:3.1.10-1.el6_1.1.s390x", product_id: "squid-7:3.1.10-1.el6_1.1.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-1.el6_1.1?arch=s390x&epoch=7", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", product: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", product_id: "squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-1.el6_1.1?arch=x86_64&epoch=7", }, }, }, { category: "product_version", name: "squid-7:3.1.10-1.el6_1.1.x86_64", product: { name: "squid-7:3.1.10-1.el6_1.1.x86_64", product_id: "squid-7:3.1.10-1.el6_1.1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-1.el6_1.1?arch=x86_64&epoch=7", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-1.el6_1.1.src", product: { name: "squid-7:3.1.10-1.el6_1.1.src", product_id: "squid-7:3.1.10-1.el6_1.1.src", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-1.el6_1.1?arch=src&epoch=7", }, }, }, ], category: "architecture", name: "src", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-1.el6_1.1.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.i686", }, product_reference: "squid-7:3.1.10-1.el6_1.1.i686", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-1.el6_1.1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.ppc64", }, product_reference: "squid-7:3.1.10-1.el6_1.1.ppc64", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-1.el6_1.1.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.s390x", }, product_reference: "squid-7:3.1.10-1.el6_1.1.s390x", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-1.el6_1.1.src as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.src", }, product_reference: "squid-7:3.1.10-1.el6_1.1.src", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-1.el6_1.1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.x86_64", }, product_reference: "squid-7:3.1.10-1.el6_1.1.x86_64", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.i686", }, product_reference: "squid-debuginfo-7:3.1.10-1.el6_1.1.i686", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", }, product_reference: "squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", }, product_reference: "squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", }, product_reference: "squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", relates_to_product_reference: "6Server-6.1.z", }, ], }, vulnerabilities: [ { cve: "CVE-2011-3205", discovery_date: "2011-08-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "734583", }, ], notes: [ { category: "description", text: "Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.", title: "Vulnerability description", }, { category: "summary", text: "squid: buffer overflow flaw in Squid's Gopher reply parser (SQUID-2011:3)", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.src", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.x86_64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2011-3205", }, { category: "external", summary: "RHBZ#734583", url: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2011-3205", url: "https://www.cve.org/CVERecord?id=CVE-2011-3205", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2011-3205", url: "https://nvd.nist.gov/vuln/detail/CVE-2011-3205", }, ], release_date: "2011-08-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2011-09-14T18:48:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/kb/docs/DOC-11259", product_ids: [ "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.src", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.x86_64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2011:1293", }, ], scores: [ { cvss_v2: { accessComplexity: "MEDIUM", accessVector: "ADJACENT_NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5.4, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:A/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, products: [ "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.src", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.x86_64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "squid: buffer overflow flaw in Squid's Gopher reply parser (SQUID-2011:3)", }, ], }
rhsa-2011_1293
Vulnerability from csaf_redhat
Published
2011-09-14 18:48
Modified
2024-11-22 04:39
Summary
Red Hat Security Advisory: squid security update
Notes
Topic
An updated squid package that fixes one security issue is now available for
Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
Details
Squid is a high-performance proxy caching server for web clients,
supporting FTP, Gopher, and HTTP data objects.
A buffer overflow flaw was found in the way Squid parsed replies from
remote Gopher servers. A remote user allowed to send Gopher requests to a
Squid proxy could possibly use this flaw to cause the squid child process
to crash or execute arbitrary code with the privileges of the squid user,
by making Squid perform a request to an attacker-controlled Gopher server.
(CVE-2011-3205)
Users of squid should upgrade to this updated package, which contains a
backported patch to correct this issue. After installing this update, the
squid service will be restarted automatically.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An updated squid package that fixes one security issue is now available for\nRed Hat Enterprise Linux 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.", title: "Topic", }, { category: "general", text: "Squid is a high-performance proxy caching server for web clients,\nsupporting FTP, Gopher, and HTTP data objects.\n\nA buffer overflow flaw was found in the way Squid parsed replies from\nremote Gopher servers. A remote user allowed to send Gopher requests to a\nSquid proxy could possibly use this flaw to cause the squid child process\nto crash or execute arbitrary code with the privileges of the squid user,\nby making Squid perform a request to an attacker-controlled Gopher server.\n(CVE-2011-3205)\n\nUsers of squid should upgrade to this updated package, which contains a\nbackported patch to correct this issue. After installing this update, the\nsquid service will be restarted automatically.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2011:1293", url: "https://access.redhat.com/errata/RHSA-2011:1293", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "734583", url: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1293.json", }, ], title: "Red Hat Security Advisory: squid security update", tracking: { current_release_date: "2024-11-22T04:39:51+00:00", generator: { date: "2024-11-22T04:39:51+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2011:1293", initial_release_date: "2011-09-14T18:48:00+00:00", revision_history: [ { date: "2011-09-14T18:48:00+00:00", number: "1", summary: "Initial version", }, { date: "2011-09-14T14:51:13+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T04:39:51+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux Server (v. 6)", product: { name: "Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:6::server", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "squid-debuginfo-7:3.1.10-1.el6_1.1.i686", product: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.i686", product_id: "squid-debuginfo-7:3.1.10-1.el6_1.1.i686", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-1.el6_1.1?arch=i686&epoch=7", }, }, }, { category: "product_version", name: "squid-7:3.1.10-1.el6_1.1.i686", product: { name: "squid-7:3.1.10-1.el6_1.1.i686", product_id: "squid-7:3.1.10-1.el6_1.1.i686", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-1.el6_1.1?arch=i686&epoch=7", }, }, }, ], category: "architecture", name: "i686", }, { branches: [ { category: "product_version", name: "squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", product: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", product_id: "squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-1.el6_1.1?arch=ppc64&epoch=7", }, }, }, { category: "product_version", name: "squid-7:3.1.10-1.el6_1.1.ppc64", product: { name: "squid-7:3.1.10-1.el6_1.1.ppc64", product_id: "squid-7:3.1.10-1.el6_1.1.ppc64", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-1.el6_1.1?arch=ppc64&epoch=7", }, }, }, ], category: "architecture", name: "ppc64", }, { branches: [ { category: "product_version", name: "squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", product: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", product_id: "squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-1.el6_1.1?arch=s390x&epoch=7", }, }, }, { category: "product_version", name: "squid-7:3.1.10-1.el6_1.1.s390x", product: { name: "squid-7:3.1.10-1.el6_1.1.s390x", product_id: "squid-7:3.1.10-1.el6_1.1.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-1.el6_1.1?arch=s390x&epoch=7", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", product: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", product_id: "squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/squid-debuginfo@3.1.10-1.el6_1.1?arch=x86_64&epoch=7", }, }, }, { category: "product_version", name: "squid-7:3.1.10-1.el6_1.1.x86_64", product: { name: "squid-7:3.1.10-1.el6_1.1.x86_64", product_id: "squid-7:3.1.10-1.el6_1.1.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-1.el6_1.1?arch=x86_64&epoch=7", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "squid-7:3.1.10-1.el6_1.1.src", product: { name: "squid-7:3.1.10-1.el6_1.1.src", product_id: "squid-7:3.1.10-1.el6_1.1.src", product_identification_helper: { purl: "pkg:rpm/redhat/squid@3.1.10-1.el6_1.1?arch=src&epoch=7", }, }, }, ], category: "architecture", name: "src", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-1.el6_1.1.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.i686", }, product_reference: "squid-7:3.1.10-1.el6_1.1.i686", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-1.el6_1.1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.ppc64", }, product_reference: "squid-7:3.1.10-1.el6_1.1.ppc64", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-1.el6_1.1.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.s390x", }, product_reference: "squid-7:3.1.10-1.el6_1.1.s390x", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-1.el6_1.1.src as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.src", }, product_reference: "squid-7:3.1.10-1.el6_1.1.src", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-7:3.1.10-1.el6_1.1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.x86_64", }, product_reference: "squid-7:3.1.10-1.el6_1.1.x86_64", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.i686", }, product_reference: "squid-debuginfo-7:3.1.10-1.el6_1.1.i686", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", }, product_reference: "squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", }, product_reference: "squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", relates_to_product_reference: "6Server-6.1.z", }, { category: "default_component_of", full_product_name: { name: "squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", product_id: "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", }, product_reference: "squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", relates_to_product_reference: "6Server-6.1.z", }, ], }, vulnerabilities: [ { cve: "CVE-2011-3205", discovery_date: "2011-08-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "734583", }, ], notes: [ { category: "description", text: "Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.", title: "Vulnerability description", }, { category: "summary", text: "squid: buffer overflow flaw in Squid's Gopher reply parser (SQUID-2011:3)", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.src", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.x86_64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2011-3205", }, { category: "external", summary: "RHBZ#734583", url: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2011-3205", url: "https://www.cve.org/CVERecord?id=CVE-2011-3205", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2011-3205", url: "https://nvd.nist.gov/vuln/detail/CVE-2011-3205", }, ], release_date: "2011-08-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2011-09-14T18:48:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/kb/docs/DOC-11259", product_ids: [ "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.src", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.x86_64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2011:1293", }, ], scores: [ { cvss_v2: { accessComplexity: "MEDIUM", accessVector: "ADJACENT_NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5.4, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:A/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, products: [ "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.src", "6Server-6.1.z:squid-7:3.1.10-1.el6_1.1.x86_64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.i686", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.ppc64", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.s390x", "6Server-6.1.z:squid-debuginfo-7:3.1.10-1.el6_1.1.x86_64", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "squid: buffer overflow flaw in Squid's Gopher reply parser (SQUID-2011:3)", }, ], }
var-201109-0081
Vulnerability from variot
Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression. Squid is a proxy server and web cache server. Squid is flawed in parsing responses from the Gopher server. If the Gopher server returns more than 4096 bytes, it can trigger a buffer overflow. This overflow can cause memory corruption to generally cause Squid to crash. A malicious user must set up a fake Gopher server and forward the request through Squid. Successful exploitation of vulnerabilities allows arbitrary code to be executed in a server context. Squid Proxy is prone remote buffer-overflow vulnerability affects the Gopher-to-HTML functionality. Failed exploit attempts will result in a denial-of-service condition. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Debian Security Advisory DSA-2304-1 security@debian.org http://www.debian.org/security/ Nico Golde Sep 11, 2011 http://www.debian.org/security/faq
Package : squid3 Vulnerability : buffer overflow Problem type : remote Debian-specific: no Debian bug : 639755 CVE IDs : CVE-2011-3205
Ben Hawkes discovered that squid3, a full featured Web Proxy cache (HTTP proxy), is vulnerable to a buffer overflow when processing gopher server replies.
For the oldstable distribution (lenny), this problem has been fixed in version 3.0.STABLE8-3+lenny5.
For the stable distribution (squeeze), this problem has been fixed in version 3.1.6-1.2+squeeze1.
For the testing distribution (wheezy), this problem has been fixed in version 3.1.15-1.
For the unstable distribution (sid), this problem has been fixed in version 3.1.15-1.
We recommend that you upgrade your squid3 packages. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
===================================================================== Red Hat Security Advisory
Synopsis: Moderate: squid security update Advisory ID: RHSA-2011:1293-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1293.html Issue date: 2011-09-14 CVE Names: CVE-2011-3205 =====================================================================
- Summary:
An updated squid package that fixes one security issue is now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
- Description:
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. (CVE-2011-3205)
Users of squid should upgrade to this updated package, which contains a backported patch to correct this issue. After installing this update, the squid service will be restarted automatically.
- Solution:
Before applying this update, make sure all previously-released errata relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259
- Package List:
Red Hat Enterprise Linux Server (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/squid-3.1.10-1.el6_1.1.src.rpm
i386: squid-3.1.10-1.el6_1.1.i686.rpm squid-debuginfo-3.1.10-1.el6_1.1.i686.rpm
ppc64: squid-3.1.10-1.el6_1.1.ppc64.rpm squid-debuginfo-3.1.10-1.el6_1.1.ppc64.rpm
s390x: squid-3.1.10-1.el6_1.1.s390x.rpm squid-debuginfo-3.1.10-1.el6_1.1.s390x.rpm
x86_64: squid-3.1.10-1.el6_1.1.x86_64.rpm squid-debuginfo-3.1.10-1.el6_1.1.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/squid-3.1.10-1.el6_1.1.src.rpm
i386: squid-3.1.10-1.el6_1.1.i686.rpm squid-debuginfo-3.1.10-1.el6_1.1.i686.rpm
x86_64: squid-3.1.10-1.el6_1.1.x86_64.rpm squid-debuginfo-3.1.10-1.el6_1.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package
- References:
https://www.redhat.com/security/data/cve/CVE-2011-3205.html https://access.redhat.com/security/updates/classification/#moderate
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFOcPqzXlSAg2UNWIIRAutlAJ9nlG0w3FNBVqFtxSNe10FKir/WkACeNQAA rDOr/svPTfi23jLvkODeYbk= =0hIH -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . ----------------------------------------------------------------------
The Secunia CSI 5.0 Beta - now available for testing Find out more, take a free test drive, and share your opinion with us: http://secunia.com/blog/242
TITLE: Squid Gopher Response Processing Buffer Overflow Vulnerability
SECUNIA ADVISORY ID: SA45805
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/45805/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=45805
RELEASE DATE: 2011-08-30
DISCUSS ADVISORY: http://secunia.com/advisories/45805/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/45805/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=45805
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: A vulnerability has been reported in Squid, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.
The vulnerability is caused due to a boundary error when processing Gopher responses and can be exploited to cause a buffer overflow via an overly long string.
This is related to vulnerability #2 in: SA13825
The vulnerability is reported in versions 3.0.x prior to 3.0.STABLE25 and 3.1.x prior to 3.1.14
SOLUTION: Update to version 3.0.STABLE26 or 3.1.15.
PROVIDED AND/OR DISCOVERED BY: The vendor credits Ben Hawkes, Google Security Team.
ORIGINAL ADVISORY: http://www.squid-cache.org/Advisories/SQUID-2011_3.txt
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. ----------------------------------------------------------------------
The new Secunia Corporate Software Inspector (CSI) 5.0 Integrates with Microsoft WSUS & SCCM and supports Apple Mac OS X. This fixes a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.
For more information: SA45805
SOLUTION: Apply updated packages via the apt-get package manager. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201110-24
http://security.gentoo.org/
Severity: High Title: Squid: Multiple vulnerabilities Date: October 26, 2011 Bugs: #279379, #279380, #301828, #334263, #381065, #386215 ID: 201110-24
Synopsis
Multiple vulnerabilities were found in Squid allowing attackers to execute arbitrary code or cause a Denial of Service.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-proxy/squid < 3.1.15 >= 3.1.15
Description
Multiple vulnerabilities have been discovered in Squid. Please review the CVE identifiers referenced below for details.
Workaround
There is no known workaround at this time.
Resolution
All squid users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-proxy/squid-3.1.15"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since September 4, 2011. It is likely that your system is already no longer affected by this issue.
References
[ 1 ] CVE-2009-2621 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2621 [ 2 ] CVE-2009-2622 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2622 [ 3 ] CVE-2009-2855 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2855 [ 4 ] CVE-2010-0308 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0308 [ 5 ] CVE-2010-0639 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0639 [ 6 ] CVE-2010-2951 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2951 [ 7 ] CVE-2010-3072 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3072 [ 8 ] CVE-2011-3205 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3205
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201110-24.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2011 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-201109-0081", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: "squid", scope: "eq", trust: 1.9, vendor: "squid cache", version: "3.1.3", }, { model: "squid", scope: "eq", trust: 1.9, vendor: "squid cache", version: "3.1.5.1", }, { model: "squid", scope: "eq", trust: 1.9, vendor: "squid cache", version: "3.1.6", }, { model: "squid", scope: "eq", trust: 1.9, vendor: "squid cache", version: "3.1.4", }, { model: "squid", scope: "eq", trust: 1.9, vendor: "squid cache", version: "3.1.0.9", }, { model: "squid", scope: "eq", trust: 1.9, vendor: "squid cache", version: "3.1.7", }, { model: "squid", scope: "eq", trust: 1.9, vendor: "squid cache", version: "3.1.5", }, { model: "squid", scope: "eq", trust: 1.6, vendor: "squid cache", version: "3.0.stable3", }, { model: "squid", scope: "eq", trust: 1.6, vendor: "squid cache", version: "3.0.stable2", }, { model: "squid", scope: "eq", trust: 1.6, vendor: "squid cache", version: "3.1.0.5", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.0.11", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.0.14", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.0.6", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.0.2", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.0.16", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.2", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.0.10", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.1", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.0.17", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.0.18", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.0.1", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.0.12", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.0.13", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.0.3", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.0.8", }, { model: "squid", scope: "eq", trust: 1.3, vendor: "squid cache", version: "3.1.0.7", }, { model: "squid", scope: "eq", trust: 1.1, vendor: "squid cache", version: "3.1.15", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable5", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.1.11", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.1.10", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.2.0.8", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable22", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable10", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable17", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable16", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable25", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.1.8", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.2.0.10", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable9", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.2.0.4", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.1.14", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable8", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.1.13", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.2.0.2", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable24", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable7", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.1.0.15", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.1.0.4", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable1", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable13", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable19", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable6", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable23", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.2.0.3", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable4", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable15", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable14", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.2.0.5", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable11", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable12", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.2.0.1", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.1.9", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.2.0.7", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable20", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.1.12", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable21", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.0.stable18", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.2.0.6", }, { model: "squid", scope: "eq", trust: 1, vendor: "squid cache", version: "3.2.0.9", }, { model: "squid", scope: "eq", trust: 0.8, vendor: "squid cache", version: "3.2.0.11", }, { model: "squid", scope: "lt", trust: 0.8, vendor: "squid cache", version: "3.1", }, { model: "squid", scope: "lt", trust: 0.8, vendor: "squid cache", version: "3.0", }, { model: "squid", scope: "lt", trust: 0.8, vendor: "squid cache", version: "3.2", }, { model: "squid", scope: "eq", trust: 0.8, vendor: "squid cache", version: "3.0.stable26", }, { model: "squid", scope: "eq", trust: 0.6, vendor: "squid", version: "3.x", }, { model: "web proxy", scope: "eq", trust: 0.3, vendor: "squid", version: "3.1.13", }, { model: "3.0.stable25", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "3.0.stable18", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "3.0.stable21", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "web proxy", scope: "eq", trust: 0.3, vendor: "squid", version: "3.1.14", }, { model: "3.0.stable8", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "web proxy 3.0.stable26", scope: null, trust: 0.3, vendor: "squid", version: null, }, { model: "3.0.stable22", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "3.0.stable7", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "3.0.stable13", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "web proxy cache", scope: "eq", trust: 0.3, vendor: "squid", version: "3.2.0.10", }, { model: "3.0.stable6", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "linux arm", scope: "eq", trust: 0.3, vendor: "debian", version: "6.0", }, { model: "3.0.stable23", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "3.0.stable15", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "3.0.stable16 rc1", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "3.0.stable20", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "linux s/390", scope: "eq", trust: 0.3, vendor: "debian", version: "6.0", }, { model: "web proxy cache", scope: "ne", trust: 0.3, vendor: "squid", version: "3.2.0.11", }, { model: "linux ia-64", scope: "eq", trust: 0.3, vendor: "debian", version: "6.0", }, { model: "web proxy", scope: "eq", trust: 0.3, vendor: "squid", version: "3.0", }, { model: "3.0.stable5", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "linux", scope: null, trust: 0.3, vendor: "gentoo", version: null, }, { model: "3.0.stable4", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "enterprise linux server", scope: "eq", trust: 0.3, vendor: "redhat", version: "6", }, { model: "3.0.stable3", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "3.0.stable12", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "linux amd64", scope: "eq", trust: 0.3, vendor: "debian", version: "6.0", }, { model: "3.0.stable2", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "3.0.stable17", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "linux sparc", scope: "eq", trust: 0.3, vendor: "debian", version: "6.0", }, { model: "linux powerpc", scope: "eq", trust: 0.3, vendor: "debian", version: "6.0", }, { model: "web proxy", scope: "ne", trust: 0.3, vendor: "squid", version: "3.1.15", }, { model: "3.0.stable1", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "3.0.stable11", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "3.0.stable24", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "web proxy", scope: "eq", trust: 0.3, vendor: "squid", version: "3.1", }, { model: "3.0.stable11 rc1", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "3.0.stable9", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "3.0.stable14", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "web proxy cache", scope: "eq", trust: 0.3, vendor: "squid", version: "3.2.0.2", }, { model: "enterprise linux workstation", scope: "eq", trust: 0.3, vendor: "redhat", version: "6", }, { model: "web proxy cache", scope: "eq", trust: 0.3, vendor: "squid", version: "3.2.0.1", }, { model: "3.0.stable19", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "solaris", scope: "eq", trust: 0.3, vendor: "sun", version: "11", }, { model: "3.0.stable10", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, { model: "linux mips", scope: "eq", trust: 0.3, vendor: "debian", version: "6.0", }, { model: "linux ia-32", scope: "eq", trust: 0.3, vendor: "debian", version: "6.0", }, { model: "web proxy 3.0.stable25", scope: null, trust: 0.3, vendor: "squid", version: null, }, { model: "3.0.stable16", scope: null, trust: 0.3, vendor: "squid cache", version: null, }, ], sources: [ { db: "CNVD", id: "CNVD-2011-3411", }, { db: "BID", id: "49356", }, { db: "JVNDB", id: "JVNDB-2011-004877", }, { db: "CNNVD", id: "CNNVD-201109-051", }, { db: "NVD", id: "CVE-2011-3205", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable13:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable9:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable20:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable14:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable24:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable16:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable16:rc1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable11:rc1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable18:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable6:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable15:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable5:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable21:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable17:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable11:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable10:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable8:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable12:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable25:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable23:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable22:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable7:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable19:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.18:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.13:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.7:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.14:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.12:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.14:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.8:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.6:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.9:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.15:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.13:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.12:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.10:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.5:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.7:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.6:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.16:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.11:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.8:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.5:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.5.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.10:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.9:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.11:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.17:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.9:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.6:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.10:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.7:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.8:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.5:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, ], sources: [ { db: "NVD", id: "CVE-2011-3205", }, ], }, credits: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Secunia", sources: [ { db: "PACKETSTORM", id: "104550", }, { db: "PACKETSTORM", id: "104920", }, { db: "PACKETSTORM", id: "104911", }, { db: "PACKETSTORM", id: "107145", }, { db: "PACKETSTORM", id: "105010", }, ], trust: 0.5, }, cve: "CVE-2011-3205", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { acInsufInfo: false, accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", author: "NVD", availabilityImpact: "PARTIAL", baseScore: 6.8, confidentialityImpact: "PARTIAL", exploitabilityScore: 8.6, impactScore: 6.4, integrityImpact: "PARTIAL", obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "MEDIUM", trust: 1, userInteractionRequired: false, vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, { acInsufInfo: null, accessComplexity: "Medium", accessVector: "Network", authentication: "None", author: "NVD", availabilityImpact: "Partial", baseScore: 6.8, confidentialityImpact: "Partial", exploitabilityScore: null, id: "CVE-2011-3205", impactScore: null, integrityImpact: "Partial", obtainAllPrivilege: null, obtainOtherPrivilege: null, obtainUserPrivilege: null, severity: "Medium", trust: 0.8, userInteractionRequired: null, vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, ], cvssV3: [], severity: [ { author: "NVD", id: "CVE-2011-3205", trust: 1.8, value: "MEDIUM", }, { author: "CNNVD", id: "CNNVD-201109-051", trust: 0.6, value: "HIGH", }, ], }, ], sources: [ { db: "JVNDB", id: "JVNDB-2011-004877", }, { db: "CNNVD", id: "CNNVD-201109-051", }, { db: "NVD", id: "CVE-2011-3205", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression. Squid is a proxy server and web cache server. Squid is flawed in parsing responses from the Gopher server. If the Gopher server returns more than 4096 bytes, it can trigger a buffer overflow. This overflow can cause memory corruption to generally cause Squid to crash. A malicious user must set up a fake Gopher server and forward the request through Squid. Successful exploitation of vulnerabilities allows arbitrary code to be executed in a server context. Squid Proxy is prone remote buffer-overflow vulnerability affects the Gopher-to-HTML functionality. Failed exploit attempts will result in a denial-of-service condition. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n- --------------------------------------------------------------------------\nDebian Security Advisory DSA-2304-1 security@debian.org\nhttp://www.debian.org/security/ Nico Golde\nSep 11, 2011 http://www.debian.org/security/faq\n- --------------------------------------------------------------------------\n\nPackage : squid3\nVulnerability : buffer overflow\nProblem type : remote\nDebian-specific: no\nDebian bug : 639755\nCVE IDs : CVE-2011-3205\n\nBen Hawkes discovered that squid3, a full featured Web Proxy cache\n(HTTP proxy), is vulnerable to a buffer overflow when processing gopher\nserver replies. \n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 3.0.STABLE8-3+lenny5. \n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 3.1.6-1.2+squeeze1. \n\nFor the testing distribution (wheezy), this problem has been fixed in\nversion 3.1.15-1. \n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.1.15-1. \n\nWe recommend that you upgrade your squid3 packages. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Moderate: squid security update\nAdvisory ID: RHSA-2011:1293-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://rhn.redhat.com/errata/RHSA-2011-1293.html\nIssue date: 2011-09-14\nCVE Names: CVE-2011-3205 \n=====================================================================\n\n1. Summary:\n\nAn updated squid package that fixes one security issue is now available for\nRed Hat Enterprise Linux 6. \n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 6) - i386, x86_64\n\n3. Description:\n\nSquid is a high-performance proxy caching server for web clients,\nsupporting FTP, Gopher, and HTTP data objects. \n(CVE-2011-3205)\n\nUsers of squid should upgrade to this updated package, which contains a\nbackported patch to correct this issue. After installing this update, the\nsquid service will be restarted automatically. \n\n4. Solution:\n\nBefore applying this update, make sure all previously-released errata\nrelevant to your system have been applied. \n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/kb/docs/DOC-11259\n\n5. Package List:\n\nRed Hat Enterprise Linux Server (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/squid-3.1.10-1.el6_1.1.src.rpm\n\ni386:\nsquid-3.1.10-1.el6_1.1.i686.rpm\nsquid-debuginfo-3.1.10-1.el6_1.1.i686.rpm\n\nppc64:\nsquid-3.1.10-1.el6_1.1.ppc64.rpm\nsquid-debuginfo-3.1.10-1.el6_1.1.ppc64.rpm\n\ns390x:\nsquid-3.1.10-1.el6_1.1.s390x.rpm\nsquid-debuginfo-3.1.10-1.el6_1.1.s390x.rpm\n\nx86_64:\nsquid-3.1.10-1.el6_1.1.x86_64.rpm\nsquid-debuginfo-3.1.10-1.el6_1.1.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/squid-3.1.10-1.el6_1.1.src.rpm\n\ni386:\nsquid-3.1.10-1.el6_1.1.i686.rpm\nsquid-debuginfo-3.1.10-1.el6_1.1.i686.rpm\n\nx86_64:\nsquid-3.1.10-1.el6_1.1.x86_64.rpm\nsquid-debuginfo-3.1.10-1.el6_1.1.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and \ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/#package\n\n7. References:\n\nhttps://www.redhat.com/security/data/cve/CVE-2011-3205.html\nhttps://access.redhat.com/security/updates/classification/#moderate\n\n8. Contact:\n\nThe Red Hat security contact is <secalert@redhat.com>. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2011 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.4 (GNU/Linux)\n\niD8DBQFOcPqzXlSAg2UNWIIRAutlAJ9nlG0w3FNBVqFtxSNe10FKir/WkACeNQAA\nrDOr/svPTfi23jLvkODeYbk=\n=0hIH\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. ----------------------------------------------------------------------\n\nThe Secunia CSI 5.0 Beta - now available for testing\nFind out more, take a free test drive, and share your opinion with us: \nhttp://secunia.com/blog/242 \n\n----------------------------------------------------------------------\n\nTITLE:\nSquid Gopher Response Processing Buffer Overflow Vulnerability\n\nSECUNIA ADVISORY ID:\nSA45805\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/45805/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory&vuln_id=45805\n\nRELEASE DATE:\n2011-08-30\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/45805/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/45805/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory&vuln_id=45805\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nA vulnerability has been reported in Squid, which can be exploited by\nmalicious people to cause a DoS (Denial of Service) or potentially\ncompromise a vulnerable system. \n\nThe vulnerability is caused due to a boundary error when processing\nGopher responses and can be exploited to cause a buffer overflow via\nan overly long string. \n\nThis is related to vulnerability #2 in:\nSA13825\n\nThe vulnerability is reported in versions 3.0.x prior to 3.0.STABLE25\nand 3.1.x prior to 3.1.14\n\nSOLUTION:\nUpdate to version 3.0.STABLE26 or 3.1.15. \n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits Ben Hawkes, Google Security Team. \n\nORIGINAL ADVISORY:\nhttp://www.squid-cache.org/Advisories/SQUID-2011_3.txt\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. ----------------------------------------------------------------------\n\nThe new Secunia Corporate Software Inspector (CSI) 5.0 \nIntegrates with Microsoft WSUS & SCCM and supports Apple Mac OS X. This fixes a vulnerability,\nwhich can be exploited by malicious people to cause a DoS (Denial of\nService) or potentially compromise a vulnerable system. \n\nFor more information:\nSA45805\n\nSOLUTION:\nApply updated packages via the apt-get package manager. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201110-24\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: High\n Title: Squid: Multiple vulnerabilities\n Date: October 26, 2011\n Bugs: #279379, #279380, #301828, #334263, #381065, #386215\n ID: 201110-24\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities were found in Squid allowing attackers to\nexecute arbitrary code or cause a Denial of Service. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 net-proxy/squid < 3.1.15 >= 3.1.15\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in Squid. Please review\nthe CVE identifiers referenced below for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll squid users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-proxy/squid-3.1.15\"\n\nNOTE: This is a legacy GLSA. Updates for all affected architectures are\navailable since September 4, 2011. It is likely that your system is\nalready no longer affected by this issue. \n\nReferences\n==========\n\n[ 1 ] CVE-2009-2621\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2621\n[ 2 ] CVE-2009-2622\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2622\n[ 3 ] CVE-2009-2855\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2855\n[ 4 ] CVE-2010-0308\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0308\n[ 5 ] CVE-2010-0639\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0639\n[ 6 ] CVE-2010-2951\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2951\n[ 7 ] CVE-2010-3072\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3072\n[ 8 ] CVE-2011-3205\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3205\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201110-24.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users' machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2011 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n\n", sources: [ { db: "NVD", id: "CVE-2011-3205", }, { db: "JVNDB", id: "JVNDB-2011-004877", }, { db: "CNVD", id: "CNVD-2011-3411", }, { db: "BID", id: "49356", }, { db: "PACKETSTORM", id: "105002", }, { db: "PACKETSTORM", id: "105119", }, { db: "PACKETSTORM", id: "104550", }, { db: "PACKETSTORM", id: "104920", }, { db: "PACKETSTORM", id: "104911", }, { db: "PACKETSTORM", id: "107145", }, { db: "PACKETSTORM", id: "105010", }, { db: "PACKETSTORM", id: "106273", }, ], trust: 3.15, }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "NVD", id: "CVE-2011-3205", trust: 3, }, { db: "BID", id: "49356", trust: 2.5, }, { db: "SECUNIA", id: "45805", trust: 2.3, }, { db: "SECUNIA", id: "45920", trust: 1.7, }, { db: "SECUNIA", id: "45906", trust: 1.7, }, { db: "SECUNIA", id: "46029", trust: 1.7, }, { db: "SECUNIA", id: "45965", trust: 1.7, }, { db: "SECTRACK", id: "1025981", trust: 1.6, }, { db: "OPENWALL", id: "OSS-SECURITY/2011/08/29/2", trust: 1.6, }, { db: "OPENWALL", id: "OSS-SECURITY/2011/08/30/8", trust: 1.6, }, { db: "OPENWALL", id: "OSS-SECURITY/2011/08/30/4", trust: 1.6, }, { db: "OSVDB", id: "74847", trust: 1.6, }, { db: "JVNDB", id: "JVNDB-2011-004877", trust: 0.8, }, { db: "CNVD", id: "CNVD-2011-3411", trust: 0.6, }, { db: "CNNVD", id: "CNNVD-201108-512", trust: 0.6, }, { db: "CNNVD", id: "CNNVD-201109-051", trust: 0.6, }, { db: "PACKETSTORM", id: "105002", trust: 0.1, }, { db: "PACKETSTORM", id: "105119", trust: 0.1, }, { db: "PACKETSTORM", id: "104550", trust: 0.1, }, { db: "PACKETSTORM", id: "104920", trust: 0.1, }, { db: "PACKETSTORM", id: "104911", trust: 0.1, }, { db: "PACKETSTORM", id: "107145", trust: 0.1, }, { db: "PACKETSTORM", id: "105010", trust: 0.1, }, { db: "PACKETSTORM", id: "106273", trust: 0.1, }, ], sources: [ { db: "CNVD", id: "CNVD-2011-3411", }, { db: "BID", id: "49356", }, { db: "JVNDB", id: "JVNDB-2011-004877", }, { db: "PACKETSTORM", id: "105002", }, { db: "PACKETSTORM", id: "105119", }, { db: "PACKETSTORM", id: "104550", }, { db: "PACKETSTORM", id: "104920", }, { db: "PACKETSTORM", id: "104911", }, { db: "PACKETSTORM", id: "107145", }, { db: "PACKETSTORM", id: "105010", }, { db: "PACKETSTORM", id: "106273", }, { db: "CNNVD", id: "CNNVD-201108-512", }, { db: "CNNVD", id: "CNNVD-201109-051", }, { db: "NVD", id: "CVE-2011-3205", }, ], }, id: "VAR-201109-0081", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "CNVD", id: "CNVD-2011-3411", }, ], trust: 0.06, }, iot_taxonomy: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { category: [ "Network device", ], sub_category: null, trust: 0.6, }, ], sources: [ { db: "CNVD", id: "CNVD-2011-3411", }, ], }, last_update_date: "2024-07-22T23:14:00.068000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "Buffer Overflow vulnerability in Squid", trust: 0.8, url: "https://blogs.oracle.com/sunsecurity/entry/cve_2011_3205_buffer_overflow", }, { title: "SQUID-2011:3", trust: 0.8, url: "http://www.squid-cache.org/advisories/squid-2011_3.txt", }, { title: "Squid Gopher Answers Patch for Handling Buffer Overflow Vulnerabilities", trust: 0.6, url: "https://www.cnvd.org.cn/patchinfo/show/4943", }, { title: "Squid Security vulnerabilities", trust: 0.6, url: "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=234527", }, ], sources: [ { db: "CNVD", id: "CNVD-2011-3411", }, { db: "JVNDB", id: "JVNDB-2011-004877", }, { db: "CNNVD", id: "CNNVD-201109-051", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "NVD-CWE-Other", trust: 1, }, { problemtype: "CWE-DesignError", trust: 0.8, }, ], sources: [ { db: "JVNDB", id: "JVNDB-2011-004877", }, { db: "NVD", id: "CVE-2011-3205", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 2.2, url: "http://www.securityfocus.com/bid/49356", }, { trust: 2, url: "http://www.squid-cache.org/advisories/squid-2011_3.txt", }, { trust: 1.7, url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html", }, { trust: 1.7, url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html", }, { trust: 1.7, url: "http://lists.fedoraproject.org/pipermail/package-announce/2011-september/065534.html", }, { trust: 1.7, url: "http://www.debian.org/security/2011/dsa-2304", }, { trust: 1.6, url: "http://secunia.com/advisories/46029", }, { trust: 1.6, url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", }, { trust: 1.6, url: "http://openwall.com/lists/oss-security/2011/08/30/8", }, { trust: 1.6, url: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", }, { trust: 1.6, url: "http://www.squid-cache.org/versions/v3/3.0/changesets/squid-3.0-9193.patch", }, { trust: 1.6, url: "http://secunia.com/advisories/45920", }, { trust: 1.6, url: "http://www.squid-cache.org/versions/v3/3.2/changesets/squid-3.2-11294.patch", }, { trust: 1.6, url: "http://www.mandriva.com/security/advisories?name=mdvsa-2011:150", }, { trust: 1.6, url: "http://secunia.com/advisories/45965", }, { trust: 1.6, url: "http://secunia.com/advisories/45805", }, { trust: 1.6, url: "http://secunia.com/advisories/45906", }, { trust: 1.6, url: "http://openwall.com/lists/oss-security/2011/08/30/4", }, { trust: 1.6, url: "http://www.squid-cache.org/versions/v2/2.head/changesets/12710.patch", }, { trust: 1.6, url: "http://www.squid-cache.org/versions/v3/3.1/changesets/squid-3.1-10363.patch", }, { trust: 1.6, url: "http://openwall.com/lists/oss-security/2011/08/29/2", }, { trust: 1.6, url: "http://securitytracker.com/id?1025981", }, { trust: 1.6, url: "http://www.redhat.com/support/errata/rhsa-2011-1293.html", }, { trust: 1.6, url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", }, { trust: 1.6, url: "http://www.osvdb.org/74847", }, { trust: 0.8, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-3205", }, { trust: 0.8, url: "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-3205", }, { trust: 0.6, url: "http://secunia.com/advisories/45805/http", }, { trust: 0.5, url: "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/", }, { trust: 0.5, url: "http://secunia.com/vulnerability_intelligence/", }, { trust: 0.5, url: "http://secunia.com/advisories/secunia_security_advisories/", }, { trust: 0.5, url: "http://secunia.com/vulnerability_scanning/personal/", }, { trust: 0.5, url: "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org", }, { trust: 0.5, url: "http://secunia.com/advisories/about_secunia_advisories/", }, { trust: 0.3, url: "http://blogs.oracle.com/sunsecurity/entry/cve_2011_3205_buffer_overflow", }, { trust: 0.3, url: "http://www.squid-cache.org/", }, { trust: 0.3, url: "https://nvd.nist.gov/vuln/detail/cve-2011-3205", }, { trust: 0.3, url: "http://secunia.com/blog/242", }, { trust: 0.2, url: "https://rhn.redhat.com/errata/rhsa-2011-1293.html", }, { trust: 0.1, url: "http://secunia.com/", }, { trust: 0.1, url: "http://www.debian.org/security/faq", }, { trust: 0.1, url: "http://www.debian.org/security/", }, { trust: 0.1, url: "http://lists.grok.org.uk/full-disclosure-charter.html", }, { trust: 0.1, url: "https://www.redhat.com/mailman/listinfo/rhsa-announce", }, { trust: 0.1, url: "https://www.redhat.com/security/data/cve/cve-2011-3205.html", }, { trust: 0.1, url: "https://access.redhat.com/kb/docs/doc-11259", }, { trust: 0.1, url: "https://access.redhat.com/security/team/key/#package", }, { trust: 0.1, url: "http://bugzilla.redhat.com/):", }, { trust: 0.1, url: "https://access.redhat.com/security/updates/classification/#moderate", }, { trust: 0.1, url: "https://access.redhat.com/security/team/contact/", }, { trust: 0.1, url: "http://secunia.com/advisories/45805/#comments", }, { trust: 0.1, url: "http://secunia.com/advisories/45805/", }, { trust: 0.1, url: "https://ca.secunia.com/?page=viewadvisory&vuln_id=45805", }, { trust: 0.1, url: "http://secunia.com/advisories/45920/", }, { trust: 0.1, url: "http://secunia.com/advisories/45920/#comments", }, { trust: 0.1, url: "https://ca.secunia.com/?page=viewadvisory&vuln_id=45920", }, { trust: 0.1, url: "https://ca.secunia.com/?page=viewadvisory&vuln_id=45906", }, { trust: 0.1, url: "http://secunia.com/advisories/45906/#comments", }, { trust: 0.1, url: "http://secunia.com/advisories/45906/", }, { trust: 0.1, url: "http://secunia.com/company/jobs/", }, { trust: 0.1, url: "http://secunia.com/advisories/46029/", }, { trust: 0.1, url: "http://secunia.com/advisories/46029/#comments", }, { trust: 0.1, url: "https://ca.secunia.com/?page=viewadvisory&vuln_id=46029", }, { trust: 0.1, url: "http://secunia.com/vulnerability_scanning/corporate/trial/", }, { trust: 0.1, url: "http://secunia.com/advisories/45965/", }, { trust: 0.1, url: "https://ca.secunia.com/?page=viewadvisory&vuln_id=45965", }, { trust: 0.1, url: "http://secunia.com/advisories/45965/#comments", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-0308", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-2951", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2010-0308", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-0639", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-3205", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2010-2951", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3072", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2009-2855", }, { trust: 0.1, url: "http://security.gentoo.org/glsa/glsa-201110-24.xml", }, { trust: 0.1, url: "http://creativecommons.org/licenses/by-sa/2.5", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-2621", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-2855", }, { trust: 0.1, url: "http://security.gentoo.org/", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2009-2622", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2009-2621", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2010-0639", }, { trust: 0.1, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-2622", }, { trust: 0.1, url: "https://bugs.gentoo.org.", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2010-3072", }, ], sources: [ { db: "CNVD", id: "CNVD-2011-3411", }, { db: "BID", id: "49356", }, { db: "JVNDB", id: "JVNDB-2011-004877", }, { db: "PACKETSTORM", id: "105002", }, { db: "PACKETSTORM", id: "105119", }, { db: "PACKETSTORM", id: "104550", }, { db: "PACKETSTORM", id: "104920", }, { db: "PACKETSTORM", id: "104911", }, { db: "PACKETSTORM", id: "107145", }, { db: "PACKETSTORM", id: "105010", }, { db: "PACKETSTORM", id: "106273", }, { db: "CNNVD", id: "CNNVD-201108-512", }, { db: "CNNVD", id: "CNNVD-201109-051", }, { db: "NVD", id: "CVE-2011-3205", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "CNVD", id: "CNVD-2011-3411", }, { db: "BID", id: "49356", }, { db: "JVNDB", id: "JVNDB-2011-004877", }, { db: "PACKETSTORM", id: "105002", }, { db: "PACKETSTORM", id: "105119", }, { db: "PACKETSTORM", id: "104550", }, { db: "PACKETSTORM", id: "104920", }, { db: "PACKETSTORM", id: "104911", }, { db: "PACKETSTORM", id: "107145", }, { db: "PACKETSTORM", id: "105010", }, { db: "PACKETSTORM", id: "106273", }, { db: "CNNVD", id: "CNNVD-201108-512", }, { db: "CNNVD", id: "CNNVD-201109-051", }, { db: "NVD", id: "CVE-2011-3205", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2011-08-30T00:00:00", db: "CNVD", id: "CNVD-2011-3411", }, { date: "2011-08-29T00:00:00", db: "BID", id: "49356", }, { date: "2012-03-27T00:00:00", db: "JVNDB", id: "JVNDB-2011-004877", }, { date: "2011-09-12T14:44:49", db: "PACKETSTORM", id: "105002", }, { date: "2011-09-14T22:52:18", db: "PACKETSTORM", id: "105119", }, { date: "2011-08-29T05:10:22", db: "PACKETSTORM", id: "104550", }, { date: "2011-09-08T08:14:56", db: "PACKETSTORM", id: "104920", }, { date: "2011-09-08T08:14:29", db: "PACKETSTORM", id: "104911", }, { date: "2011-11-19T11:11:14", db: "PACKETSTORM", id: "107145", }, { date: "2011-09-13T05:45:01", db: "PACKETSTORM", id: "105010", }, { date: "2011-10-26T23:33:14", db: "PACKETSTORM", id: "106273", }, { date: "1900-01-01T00:00:00", db: "CNNVD", id: "CNNVD-201108-512", }, { date: "2011-09-07T00:00:00", db: "CNNVD", id: "CNNVD-201109-051", }, { date: "2011-09-06T15:55:08.383000", db: "NVD", id: "CVE-2011-3205", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2011-08-30T00:00:00", db: "CNVD", id: "CNVD-2011-3411", }, { date: "2015-05-07T17:11:00", db: "BID", id: "49356", }, { date: "2012-04-18T00:00:00", db: "JVNDB", id: "JVNDB-2011-004877", }, { date: "2011-08-31T00:00:00", db: "CNNVD", id: "CNNVD-201108-512", }, { date: "2023-04-23T00:00:00", db: "CNNVD", id: "CNNVD-201109-051", }, { date: "2023-11-07T02:08:27.883000", db: "NVD", id: "CVE-2011-3205", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "remote", sources: [ { db: "PACKETSTORM", id: "105119", }, { db: "CNNVD", id: "CNNVD-201108-512", }, { db: "CNNVD", id: "CNNVD-201109-051", }, ], trust: 1.3, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Gopher of gopherToHTML Buffer overflow vulnerability in functions", sources: [ { db: "JVNDB", id: "JVNDB-2011-004877", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "buffer overflow", sources: [ { db: "CNNVD", id: "CNNVD-201108-512", }, ], trust: 0.6, }, }
suse-su-2016:2089-1
Vulnerability from csaf_suse
Published
2016-08-16 12:56
Modified
2016-08-16 12:56
Summary
Security update for squid3
Notes
Title of the patch
Security update for squid3
Description of the patch
This update for squid3 fixes the following issues:
- Multiple issues in pinger ICMP processing. (CVE-2014-7141, CVE-2014-7142)
- CVE-2016-3947: Buffer overrun issue in pinger
ICMPv6 processing. (bsc#973782)
- CVE-2016-4554: fix header smuggling issue in HTTP Request processing (bsc#979010)
- Fix multiple Denial of Service issues in HTTP Response processing.
(CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572,
bsc#968392, bsc#968393, bsc#968394, bsc#968395)
- Regression caused by the DoS fixes above (bsc#993299)
- CVE-2016-3948: Fix denial of service in HTTP Response processing (bsc#973783)
- CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553)
- CVE-2016-4052, CVE-2016-4053, CVE-2016-4054:
* fixes multiple issues in ESI processing (bsc#976556)
- CVE-2016-4556: fixes double free vulnerability in Esi.cc (bsc#979008)
- CVE-2015-5400: Improper Protection of Alternate Path (bsc#938715)
- CVE-2014-6270: fix off-by-one in snmp subsystem (bsc#895773)
- Memory leak in squid3 when using external_acl (bsc#976708)
Patchnames
slessp4-squid3-12701
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for squid3", title: "Title of the patch", }, { category: "description", text: "\n\nThis update for squid3 fixes the following issues:\n\n- Multiple issues in pinger ICMP processing. (CVE-2014-7141, CVE-2014-7142) \n\n- CVE-2016-3947: Buffer overrun issue in pinger\n ICMPv6 processing. (bsc#973782)\n\n- CVE-2016-4554: fix header smuggling issue in HTTP Request processing (bsc#979010)\n\n- Fix multiple Denial of Service issues in HTTP Response processing.\n (CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572,\n bsc#968392, bsc#968393, bsc#968394, bsc#968395)\n- Regression caused by the DoS fixes above (bsc#993299)\n\n- CVE-2016-3948: Fix denial of service in HTTP Response processing (bsc#973783)\n\n- CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553)\n\n- CVE-2016-4052, CVE-2016-4053, CVE-2016-4054:\n * fixes multiple issues in ESI processing (bsc#976556)\n\n- CVE-2016-4556: fixes double free vulnerability in Esi.cc (bsc#979008)\n\n- CVE-2015-5400: Improper Protection of Alternate Path (bsc#938715)\n\n- CVE-2014-6270: fix off-by-one in snmp subsystem (bsc#895773)\n\n- Memory leak in squid3 when using external_acl (bsc#976708)\n", title: "Description of the patch", }, { category: "details", text: "slessp4-squid3-12701", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_2089-1.json", }, { category: "self", summary: "URL for SUSE-SU-2016:2089-1", url: "https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/", }, { category: "self", summary: "E-Mail link for SUSE-SU-2016:2089-1", url: "https://lists.suse.com/pipermail/sle-security-updates/2016-August/002212.html", }, { category: "self", summary: "SUSE Bug 895773", url: "https://bugzilla.suse.com/895773", }, { category: "self", summary: "SUSE Bug 902197", url: "https://bugzilla.suse.com/902197", }, { category: "self", summary: "SUSE Bug 938715", url: "https://bugzilla.suse.com/938715", }, { category: "self", summary: "SUSE Bug 963539", url: "https://bugzilla.suse.com/963539", }, { category: "self", summary: "SUSE Bug 967011", url: "https://bugzilla.suse.com/967011", }, { category: "self", summary: "SUSE Bug 968392", url: "https://bugzilla.suse.com/968392", }, { category: "self", summary: "SUSE Bug 968393", url: "https://bugzilla.suse.com/968393", }, { category: "self", summary: "SUSE Bug 968394", url: "https://bugzilla.suse.com/968394", }, { category: "self", summary: "SUSE Bug 968395", url: "https://bugzilla.suse.com/968395", }, { category: "self", summary: "SUSE Bug 973782", url: "https://bugzilla.suse.com/973782", }, { category: "self", summary: "SUSE Bug 973783", url: "https://bugzilla.suse.com/973783", }, { category: "self", summary: "SUSE Bug 976553", url: "https://bugzilla.suse.com/976553", }, { category: "self", summary: "SUSE Bug 976556", url: "https://bugzilla.suse.com/976556", }, { category: "self", summary: "SUSE Bug 976708", url: "https://bugzilla.suse.com/976708", }, { category: "self", summary: "SUSE Bug 979008", url: "https://bugzilla.suse.com/979008", }, { category: "self", summary: "SUSE Bug 979009", url: "https://bugzilla.suse.com/979009", }, { category: "self", summary: "SUSE Bug 979010", url: "https://bugzilla.suse.com/979010", }, { category: "self", summary: "SUSE Bug 979011", url: "https://bugzilla.suse.com/979011", }, { category: "self", summary: "SUSE Bug 993299", url: "https://bugzilla.suse.com/993299", }, { category: "self", summary: "SUSE CVE CVE-2011-3205 page", url: "https://www.suse.com/security/cve/CVE-2011-3205/", }, { category: "self", summary: "SUSE CVE CVE-2011-4096 page", url: "https://www.suse.com/security/cve/CVE-2011-4096/", }, { category: "self", summary: "SUSE CVE CVE-2012-5643 page", url: "https://www.suse.com/security/cve/CVE-2012-5643/", }, { category: "self", summary: "SUSE CVE CVE-2013-0188 page", url: "https://www.suse.com/security/cve/CVE-2013-0188/", }, { category: "self", summary: "SUSE CVE CVE-2013-4115 page", url: "https://www.suse.com/security/cve/CVE-2013-4115/", }, { category: "self", summary: "SUSE CVE CVE-2014-0128 page", url: "https://www.suse.com/security/cve/CVE-2014-0128/", }, { category: "self", summary: "SUSE CVE CVE-2014-6270 page", url: "https://www.suse.com/security/cve/CVE-2014-6270/", }, { category: "self", summary: "SUSE CVE CVE-2014-7141 page", url: "https://www.suse.com/security/cve/CVE-2014-7141/", }, { category: "self", summary: "SUSE CVE CVE-2014-7142 page", url: "https://www.suse.com/security/cve/CVE-2014-7142/", }, { category: "self", summary: "SUSE CVE CVE-2015-5400 page", url: "https://www.suse.com/security/cve/CVE-2015-5400/", }, { category: "self", summary: "SUSE CVE CVE-2016-2390 page", url: "https://www.suse.com/security/cve/CVE-2016-2390/", }, { category: "self", summary: "SUSE CVE CVE-2016-2569 page", url: "https://www.suse.com/security/cve/CVE-2016-2569/", }, { category: "self", summary: "SUSE CVE CVE-2016-2570 page", url: "https://www.suse.com/security/cve/CVE-2016-2570/", }, { category: "self", summary: "SUSE CVE CVE-2016-2571 page", url: "https://www.suse.com/security/cve/CVE-2016-2571/", }, { category: "self", summary: "SUSE CVE CVE-2016-2572 page", url: "https://www.suse.com/security/cve/CVE-2016-2572/", }, { category: "self", summary: "SUSE CVE CVE-2016-3947 page", url: "https://www.suse.com/security/cve/CVE-2016-3947/", }, { category: "self", summary: "SUSE CVE CVE-2016-3948 page", url: "https://www.suse.com/security/cve/CVE-2016-3948/", }, { category: "self", summary: "SUSE CVE CVE-2016-4051 page", url: "https://www.suse.com/security/cve/CVE-2016-4051/", }, { category: "self", summary: "SUSE CVE CVE-2016-4052 page", url: "https://www.suse.com/security/cve/CVE-2016-4052/", }, { category: "self", summary: "SUSE CVE CVE-2016-4053 page", url: "https://www.suse.com/security/cve/CVE-2016-4053/", }, { category: "self", summary: "SUSE CVE CVE-2016-4054 page", url: "https://www.suse.com/security/cve/CVE-2016-4054/", }, { category: "self", summary: "SUSE CVE CVE-2016-4553 page", url: "https://www.suse.com/security/cve/CVE-2016-4553/", }, { category: "self", summary: "SUSE CVE CVE-2016-4554 page", url: "https://www.suse.com/security/cve/CVE-2016-4554/", }, { category: "self", summary: "SUSE CVE CVE-2016-4555 page", url: "https://www.suse.com/security/cve/CVE-2016-4555/", }, { category: "self", summary: "SUSE CVE CVE-2016-4556 page", url: "https://www.suse.com/security/cve/CVE-2016-4556/", }, ], title: "Security update for squid3", tracking: { current_release_date: "2016-08-16T12:56:03Z", generator: { date: "2016-08-16T12:56:03Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "SUSE-SU-2016:2089-1", initial_release_date: "2016-08-16T12:56:03Z", revision_history: [ { date: "2016-08-16T12:56:03Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "squid3-3.1.23-8.16.30.1.i586", product: { name: "squid3-3.1.23-8.16.30.1.i586", product_id: "squid3-3.1.23-8.16.30.1.i586", }, }, ], category: "architecture", name: "i586", }, { branches: [ { category: "product_version", name: "squid3-3.1.23-8.16.30.1.ia64", product: { name: "squid3-3.1.23-8.16.30.1.ia64", product_id: "squid3-3.1.23-8.16.30.1.ia64", }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "squid3-3.1.23-8.16.30.1.ppc64", product: { name: "squid3-3.1.23-8.16.30.1.ppc64", product_id: "squid3-3.1.23-8.16.30.1.ppc64", }, }, ], category: "architecture", name: "ppc64", }, { branches: [ { category: "product_version", name: "squid3-3.1.23-8.16.30.1.s390x", product: { name: "squid3-3.1.23-8.16.30.1.s390x", product_id: "squid3-3.1.23-8.16.30.1.s390x", }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "squid3-3.1.23-8.16.30.1.x86_64", product: { name: "squid3-3.1.23-8.16.30.1.x86_64", product_id: "squid3-3.1.23-8.16.30.1.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "SUSE Linux Enterprise Server 11 SP4", product: { name: "SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4", product_identification_helper: { cpe: "cpe:/o:suse:suse_sles:11:sp4", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", product: { name: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_identification_helper: { cpe: "cpe:/o:suse:sles_sap:11:sp4", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.i586 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", }, product_reference: "squid3-3.1.23-8.16.30.1.i586", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.ia64 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", }, product_reference: "squid3-3.1.23-8.16.30.1.ia64", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.ppc64 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", }, product_reference: "squid3-3.1.23-8.16.30.1.ppc64", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.s390x as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", }, product_reference: "squid3-3.1.23-8.16.30.1.s390x", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", }, product_reference: "squid3-3.1.23-8.16.30.1.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.i586 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", }, product_reference: "squid3-3.1.23-8.16.30.1.i586", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.ia64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", }, product_reference: "squid3-3.1.23-8.16.30.1.ia64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.ppc64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", }, product_reference: "squid3-3.1.23-8.16.30.1.ppc64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", }, product_reference: "squid3-3.1.23-8.16.30.1.s390x", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "squid3-3.1.23-8.16.30.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", }, product_reference: "squid3-3.1.23-8.16.30.1.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, ], }, vulnerabilities: [ { cve: "CVE-2011-3205", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2011-3205", }, ], notes: [ { category: "general", text: "Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2011-3205", url: "https://www.suse.com/security/cve/CVE-2011-3205", }, { category: "external", summary: "SUSE Bug 715171 for CVE-2011-3205", url: "https://bugzilla.suse.com/715171", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2011-3205", }, { cve: "CVE-2011-4096", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2011-4096", }, ], notes: [ { category: "general", text: "The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service (daemon abort) via a DNS reply containing a CNAME record that references another CNAME record that contains an empty A record.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2011-4096", url: "https://www.suse.com/security/cve/CVE-2011-4096", }, { category: "external", summary: "SUSE Bug 727492 for CVE-2011-4096", url: "https://bugzilla.suse.com/727492", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2011-4096", }, { cve: "CVE-2012-5643", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2012-5643", }, ], notes: [ { category: "general", text: "Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2012-5643", url: "https://www.suse.com/security/cve/CVE-2012-5643", }, { category: "external", summary: "SUSE Bug 794954 for CVE-2012-5643", url: "https://bugzilla.suse.com/794954", }, { category: "external", summary: "SUSE Bug 796999 for CVE-2012-5643", url: "https://bugzilla.suse.com/796999", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2012-5643", }, { cve: "CVE-2013-0188", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2013-0188", }, ], notes: [ { category: "general", text: "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-0189, CVE-2013-0191. Reason: this identifier was intended for one issue, but it was inadvertently associated with multiple issues. Notes: All CVE users should consult CVE-2013-0189 and CVE-2013-0191 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2013-0188", url: "https://www.suse.com/security/cve/CVE-2013-0188", }, { category: "external", summary: "SUSE Bug 794954 for CVE-2013-0188", url: "https://bugzilla.suse.com/794954", }, { category: "external", summary: "SUSE Bug 796999 for CVE-2013-0188", url: "https://bugzilla.suse.com/796999", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2013-0188", }, { cve: "CVE-2013-4115", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2013-4115", }, ], notes: [ { category: "general", text: "Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows remote attackers to cause a denial of service (memory corruption and server termination) via a long name in a DNS lookup request.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2013-4115", url: "https://www.suse.com/security/cve/CVE-2013-4115", }, { category: "external", summary: "SUSE Bug 829084 for CVE-2013-4115", url: "https://bugzilla.suse.com/829084", }, { category: "external", summary: "SUSE Bug 880233 for CVE-2013-4115", url: "https://bugzilla.suse.com/880233", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2013-4115", }, { cve: "CVE-2014-0128", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2014-0128", }, ], notes: [ { category: "general", text: "Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2014-0128", url: "https://www.suse.com/security/cve/CVE-2014-0128", }, { category: "external", summary: "SUSE Bug 867533 for CVE-2014-0128", url: "https://bugzilla.suse.com/867533", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2014-0128", }, { cve: "CVE-2014-6270", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2014-6270", }, ], notes: [ { category: "general", text: "Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted UDP SNMP request, which triggers a heap-based buffer overflow.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2014-6270", url: "https://www.suse.com/security/cve/CVE-2014-6270", }, { category: "external", summary: "SUSE Bug 895773 for CVE-2014-6270", url: "https://bugzilla.suse.com/895773", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2014-6270", }, { cve: "CVE-2014-7141", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2014-7141", }, ], notes: [ { category: "general", text: "The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2014-7141", url: "https://www.suse.com/security/cve/CVE-2014-7141", }, { category: "external", summary: "SUSE Bug 1040640 for CVE-2014-7141", url: "https://bugzilla.suse.com/1040640", }, { category: "external", summary: "SUSE Bug 891268 for CVE-2014-7141", url: "https://bugzilla.suse.com/891268", }, { category: "external", summary: "SUSE Bug 895773 for CVE-2014-7141", url: "https://bugzilla.suse.com/895773", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2014-7141", }, { cve: "CVE-2014-7142", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2014-7142", }, ], notes: [ { category: "general", text: "The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2014-7142", url: "https://www.suse.com/security/cve/CVE-2014-7142", }, { category: "external", summary: "SUSE Bug 895773 for CVE-2014-7142", url: "https://bugzilla.suse.com/895773", }, { category: "external", summary: "SUSE Bug 973782 for CVE-2014-7142", url: "https://bugzilla.suse.com/973782", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2014-7142", }, { cve: "CVE-2015-5400", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-5400", }, ], notes: [ { category: "general", text: "Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-5400", url: "https://www.suse.com/security/cve/CVE-2015-5400", }, { category: "external", summary: "SUSE Bug 938715 for CVE-2015-5400", url: "https://bugzilla.suse.com/938715", }, { category: "external", summary: "SUSE Bug 967073 for CVE-2015-5400", url: "https://bugzilla.suse.com/967073", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2015-5400", }, { cve: "CVE-2016-2390", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-2390", }, ], notes: [ { category: "general", text: "The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-2390", url: "https://www.suse.com/security/cve/CVE-2016-2390", }, { category: "external", summary: "SUSE Bug 967011 for CVE-2016-2390", url: "https://bugzilla.suse.com/967011", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2016-2390", }, { cve: "CVE-2016-2569", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-2569", }, ], notes: [ { category: "general", text: "Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-2569", url: "https://www.suse.com/security/cve/CVE-2016-2569", }, { category: "external", summary: "SUSE Bug 968392 for CVE-2016-2569", url: "https://bugzilla.suse.com/968392", }, { category: "external", summary: "SUSE Bug 968393 for CVE-2016-2569", url: "https://bugzilla.suse.com/968393", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-2569", }, { cve: "CVE-2016-2570", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-2570", }, ], notes: [ { category: "general", text: "The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-2570", url: "https://www.suse.com/security/cve/CVE-2016-2570", }, { category: "external", summary: "SUSE Bug 968392 for CVE-2016-2570", url: "https://bugzilla.suse.com/968392", }, { category: "external", summary: "SUSE Bug 968393 for CVE-2016-2570", url: "https://bugzilla.suse.com/968393", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-2570", }, { cve: "CVE-2016-2571", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-2571", }, ], notes: [ { category: "general", text: "http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-2571", url: "https://www.suse.com/security/cve/CVE-2016-2571", }, { category: "external", summary: "SUSE Bug 968394 for CVE-2016-2571", url: "https://bugzilla.suse.com/968394", }, { category: "external", summary: "SUSE Bug 968395 for CVE-2016-2571", url: "https://bugzilla.suse.com/968395", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-2571", }, { cve: "CVE-2016-2572", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-2572", }, ], notes: [ { category: "general", text: "http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-2572", url: "https://www.suse.com/security/cve/CVE-2016-2572", }, { category: "external", summary: "SUSE Bug 968394 for CVE-2016-2572", url: "https://bugzilla.suse.com/968394", }, { category: "external", summary: "SUSE Bug 968395 for CVE-2016-2572", url: "https://bugzilla.suse.com/968395", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-2572", }, { cve: "CVE-2016-3947", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-3947", }, ], notes: [ { category: "general", text: "Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 allows remote servers to cause a denial of service (performance degradation or transition failures) or write sensitive information to log files via an ICMPv6 packet.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-3947", url: "https://www.suse.com/security/cve/CVE-2016-3947", }, { category: "external", summary: "SUSE Bug 973782 for CVE-2016-3947", url: "https://bugzilla.suse.com/973782", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.2, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2016-3947", }, { cve: "CVE-2016-3948", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-3948", }, ], notes: [ { category: "general", text: "Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP response, related to Vary headers.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-3948", url: "https://www.suse.com/security/cve/CVE-2016-3948", }, { category: "external", summary: "SUSE Bug 973783 for CVE-2016-3948", url: "https://bugzilla.suse.com/973783", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2016-3948", }, { cve: "CVE-2016-4051", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4051", }, ], notes: [ { category: "general", text: "Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4051", url: "https://www.suse.com/security/cve/CVE-2016-4051", }, { category: "external", summary: "SUSE Bug 976553 for CVE-2016-4051", url: "https://bugzilla.suse.com/976553", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.8, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-4051", }, { cve: "CVE-2016-4052", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4052", }, ], notes: [ { category: "general", text: "Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4052", url: "https://www.suse.com/security/cve/CVE-2016-4052", }, { category: "external", summary: "SUSE Bug 976556 for CVE-2016-4052", url: "https://bugzilla.suse.com/976556", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.1, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-4052", }, { cve: "CVE-2016-4053", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4053", }, ], notes: [ { category: "general", text: "Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4053", url: "https://www.suse.com/security/cve/CVE-2016-4053", }, { category: "external", summary: "SUSE Bug 976556 for CVE-2016-4053", url: "https://bugzilla.suse.com/976556", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 3.7, baseSeverity: "LOW", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-4053", }, { cve: "CVE-2016-4054", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4054", }, ], notes: [ { category: "general", text: "Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4054", url: "https://www.suse.com/security/cve/CVE-2016-4054", }, { category: "external", summary: "SUSE Bug 976556 for CVE-2016-4054", url: "https://bugzilla.suse.com/976556", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.1, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "important", }, ], title: "CVE-2016-4054", }, { cve: "CVE-2016-4553", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4553", }, ], notes: [ { category: "general", text: "client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4553", url: "https://www.suse.com/security/cve/CVE-2016-4553", }, { category: "external", summary: "SUSE Bug 979009 for CVE-2016-4553", url: "https://bugzilla.suse.com/979009", }, { category: "external", summary: "SUSE Bug 990451 for CVE-2016-4553", url: "https://bugzilla.suse.com/990451", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.6, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2016-4553", }, { cve: "CVE-2016-4554", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4554", }, ], notes: [ { category: "general", text: "mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a \"header smuggling\" issue.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4554", url: "https://www.suse.com/security/cve/CVE-2016-4554", }, { category: "external", summary: "SUSE Bug 979010 for CVE-2016-4554", url: "https://bugzilla.suse.com/979010", }, { category: "external", summary: "SUSE Bug 990451 for CVE-2016-4554", url: "https://bugzilla.suse.com/990451", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.6, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2016-4554", }, { cve: "CVE-2016-4555", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4555", }, ], notes: [ { category: "general", text: "client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4555", url: "https://www.suse.com/security/cve/CVE-2016-4555", }, { category: "external", summary: "SUSE Bug 979008 for CVE-2016-4555", url: "https://bugzilla.suse.com/979008", }, { category: "external", summary: "SUSE Bug 979011 for CVE-2016-4555", url: "https://bugzilla.suse.com/979011", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2016-4555", }, { cve: "CVE-2016-4556", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-4556", }, ], notes: [ { category: "general", text: "Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-4556", url: "https://www.suse.com/security/cve/CVE-2016-4556", }, { category: "external", summary: "SUSE Bug 979008 for CVE-2016-4556", url: "https://bugzilla.suse.com/979008", }, { category: "external", summary: "SUSE Bug 979011 for CVE-2016-4556", url: "https://bugzilla.suse.com/979011", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-08-16T12:56:03Z", details: "moderate", }, ], title: "CVE-2016-4556", }, ], }
fkie_cve-2011-3205
Vulnerability from fkie_nvd
Published
2011-09-06 15:55
Modified
2025-04-11 00:51
Severity ?
Summary
Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable1:*:*:*:*:*:*:*", matchCriteriaId: "047EDDD6-02F5-4B53-8FCA-781962392080", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable2:*:*:*:*:*:*:*", matchCriteriaId: "01AD43AB-40BF-449F-A121-A8587E7AE449", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable3:*:*:*:*:*:*:*", matchCriteriaId: "3942285D-E20C-45C5-9EF8-821F6D782CB8", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable4:*:*:*:*:*:*:*", matchCriteriaId: "B3FDB45B-4D91-4427-9565-812919086E7E", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable5:*:*:*:*:*:*:*", matchCriteriaId: "86C3C8B5-C2A3-4454-9F89-38A860278366", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable6:*:*:*:*:*:*:*", matchCriteriaId: "8B37B7B4-2EAC-4C2A-9526-5C62CBA1DB8B", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable7:*:*:*:*:*:*:*", matchCriteriaId: "056EDEEE-A09C-47A2-9217-72E4B8387E00", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable8:*:*:*:*:*:*:*", matchCriteriaId: "2593CB12-03E2-4F98-9B89-C09D5EADE077", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable9:*:*:*:*:*:*:*", matchCriteriaId: "A44B7A4F-3070-4092-B9AF-3A1CD0897CC7", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable10:*:*:*:*:*:*:*", matchCriteriaId: "EF79D9A9-9C11-4E6D-81D1-32CA8CA95223", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable11:*:*:*:*:*:*:*", matchCriteriaId: "042FE60B-7239-45C7-8EE3-A036AC7778F8", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable11:rc1:*:*:*:*:*:*", matchCriteriaId: "FF5EE89A-720F-456A-BD26-FE46BBA29D9A", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable12:*:*:*:*:*:*:*", matchCriteriaId: "ADF61A74-9CF9-413E-B997-4FAE5BA28939", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable13:*:*:*:*:*:*:*", matchCriteriaId: "5605B00F-438B-45CC-A55D-E75E57BC4684", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable14:*:*:*:*:*:*:*", matchCriteriaId: "8316B22E-B016-4F0E-9A3F-383E9B1A85A4", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable15:*:*:*:*:*:*:*", matchCriteriaId: "49A2C5CB-E2F1-4A72-9EA3-912050AFEF7F", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable16:*:*:*:*:*:*:*", matchCriteriaId: "574C7DCC-B6E5-42A0-AA44-A0BCD67D1884", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable16:rc1:*:*:*:*:*:*", matchCriteriaId: "4D0DAD04-02C4-4FC4-BE08-3CAA3B85EB0B", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable17:*:*:*:*:*:*:*", matchCriteriaId: "A2B1F1A5-B435-4A5C-86DF-EC3F29D94417", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable18:*:*:*:*:*:*:*", matchCriteriaId: "113EF7A6-3B8D-4A50-8873-FD36FCBF284C", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable19:*:*:*:*:*:*:*", matchCriteriaId: "DC97E2DA-7378-486B-9178-3B38FF58589B", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable20:*:*:*:*:*:*:*", matchCriteriaId: "1F178890-2F7E-43F5-8D6D-5EFCD790E758", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable21:*:*:*:*:*:*:*", matchCriteriaId: "9FA231EB-0F06-4D13-B50D-76FC8393187A", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable22:*:*:*:*:*:*:*", matchCriteriaId: "31AB1D33-65EE-46DF-9D29-6B2BFACE7EC8", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable23:*:*:*:*:*:*:*", matchCriteriaId: "BDA4744F-5FB2-4DF8-A7B9-A33EAB004CBA", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable24:*:*:*:*:*:*:*", matchCriteriaId: "72023FB9-F081-4F0A-9E81-2AF0470EB278", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.0.stable25:*:*:*:*:*:*:*", matchCriteriaId: "2F7D973B-9D57-4F74-89B1-A18CDA388EF4", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:squid-cache:squid:3.1:*:*:*:*:*:*:*", matchCriteriaId: "6A8586AD-E820-4BAE-AAF9-AC7EF2316C06", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.1:*:*:*:*:*:*:*", matchCriteriaId: "802E3D2B-90B7-4725-854F-4174116BC314", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.2:*:*:*:*:*:*:*", matchCriteriaId: "7501697A-BCFD-4DC3-8D87-CC9A186D9589", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.3:*:*:*:*:*:*:*", matchCriteriaId: "0D6C4455-85F4-462D-9FF6-F830ED7D398E", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.4:*:*:*:*:*:*:*", matchCriteriaId: "B600BF4C-8169-4086-BFE6-F066BE5F5406", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.5:*:*:*:*:*:*:*", matchCriteriaId: "46272D1B-1468-48C0-B37A-7D06FAC39C47", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.6:*:*:*:*:*:*:*", matchCriteriaId: "DA782B4B-486F-4197-BD5D-ABF791D57211", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.7:*:*:*:*:*:*:*", matchCriteriaId: "558D8641-E097-4D91-9B6E-07433844BB82", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.8:*:*:*:*:*:*:*", matchCriteriaId: "0B46F5F1-38FC-4E25-8F04-CA2730561DF8", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.9:*:*:*:*:*:*:*", matchCriteriaId: "C69B0A4D-9619-4BEA-A846-C4438C2660F2", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.10:*:*:*:*:*:*:*", matchCriteriaId: "ED17FE35-6B2C-41BF-A7C7-2EECBDB5A934", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.11:*:*:*:*:*:*:*", matchCriteriaId: "78A50750-3A31-482C-B95C-019C8934850E", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.12:*:*:*:*:*:*:*", matchCriteriaId: "8FF6AC30-9570-4D4B-835E-CCADEB546F46", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.13:*:*:*:*:*:*:*", matchCriteriaId: "7FB84E4E-6A0A-41C8-9DDF-3C18F526F155", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.14:*:*:*:*:*:*:*", matchCriteriaId: "2E49E5C3-D01F-4DBC-B33A-5495D3EC44F8", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.15:*:*:*:*:*:*:*", matchCriteriaId: "79C53B22-9F33-43E7-8D1F-EEB0DEF4B503", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.16:*:*:*:*:*:*:*", matchCriteriaId: "25B60DB2-F50C-42F0-B6C9-B25C34B8F578", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.17:*:*:*:*:*:*:*", matchCriteriaId: "DE973F9E-8387-464F-AFA0-25215B340173", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.0.18:*:*:*:*:*:*:*", matchCriteriaId: "03D3F0E3-0C50-4A86-87F4-90FC82B312F5", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.1:*:*:*:*:*:*:*", matchCriteriaId: "CE26BEC0-B9C7-43F0-B0FB-E81870170B29", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.2:*:*:*:*:*:*:*", matchCriteriaId: "D0778579-A193-4C61-BB1A-6D2E733F3958", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.3:*:*:*:*:*:*:*", matchCriteriaId: "9ED5DC63-6E9D-4068-95DF-AF8FD9A0A7ED", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.4:*:*:*:*:*:*:*", matchCriteriaId: "8DE890F9-12C0-4D66-B6C1-6A5A87FAD5F0", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.5:*:*:*:*:*:*:*", matchCriteriaId: "FB414FE3-3567-474B-B5A7-D3EF5DD63AB8", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.5.1:*:*:*:*:*:*:*", matchCriteriaId: "AF450F17-12A2-4E33-875A-5F3C2CA4A5C1", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.6:*:*:*:*:*:*:*", matchCriteriaId: "E3AB229E-2C32-410B-BFE2-62DCA734C3F3", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.7:*:*:*:*:*:*:*", matchCriteriaId: "78A6D6B0-9BC0-418E-84EE-23697A0FEC19", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.8:*:*:*:*:*:*:*", matchCriteriaId: "5BF7AFE1-A45A-43B7-B3C7-45C060D046BC", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.9:*:*:*:*:*:*:*", matchCriteriaId: "41914354-D5BE-4B1F-BED3-0ECA43586537", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.10:*:*:*:*:*:*:*", matchCriteriaId: "AE9A3716-8670-4847-A6EB-F601184D369E", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.11:*:*:*:*:*:*:*", matchCriteriaId: "D0E88EE3-EC00-4F1F-BAEF-4F1F893C5C5F", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.12:*:*:*:*:*:*:*", matchCriteriaId: "A330DFA8-BF79-45CC-BF88-6CEA26D7BC9E", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.13:*:*:*:*:*:*:*", matchCriteriaId: "679A55F8-34B4-435A-8BCE-8F842F3FB269", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.1.14:*:*:*:*:*:*:*", matchCriteriaId: "898674F9-6BF7-469F-A74E-558EAFC2CD27", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.1:*:*:*:*:*:*:*", matchCriteriaId: "6DFAB3BA-BBE9-4CFB-BE6B-BDF3E7772E7F", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.2:*:*:*:*:*:*:*", matchCriteriaId: "C9F523B8-463E-4FB0-ACB6-E36AAAF85CD9", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.3:*:*:*:*:*:*:*", matchCriteriaId: "5BA593D9-907D-4051-A3F2-0F88F01A7C79", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.4:*:*:*:*:*:*:*", matchCriteriaId: "20D2B364-B98A-4484-A10A-86AF43774096", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.5:*:*:*:*:*:*:*", matchCriteriaId: "0B7BF076-0D43-407A-86DC-D1163922A787", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.6:*:*:*:*:*:*:*", matchCriteriaId: "AA576F49-A7F5-4013-89DF-F6C91C15B547", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.7:*:*:*:*:*:*:*", matchCriteriaId: "5D3F52FE-FFB3-4221-8DC7-3F5680A07429", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.8:*:*:*:*:*:*:*", matchCriteriaId: "604FEF42-ABA7-42C1-8A5F-C3AECFD68481", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.9:*:*:*:*:*:*:*", matchCriteriaId: "DC2568C1-89CB-41C1-9126-A8665614D0B1", vulnerable: true, }, { criteria: "cpe:2.3:a:squid-cache:squid:3.2.0.10:*:*:*:*:*:*:*", matchCriteriaId: "C18B5392-3FDB-49E6-89DB-7945D337FBFB", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.", }, { lang: "es", value: "Desbordamiento de búfer en la v3.0 anterior a v3.0.STABLE26, v3.1 anterior a v3.1.15, y v3.2 anterior a v3.2.0.11 permite a servidores remotos Gopher provocar una denegación de servicio (corrupción de memoria y reinicio del demonio) o posiblemente tener un impacto no especificado a través de una respuesta demasiado larga. NOTA: Este problema existe debido a una regresión de CVE-2005-0094.", }, ], id: "CVE-2011-3205", lastModified: "2025-04-11T00:51:21.963", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 6.8, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], }, published: "2011-09-06T15:55:08.383", references: [ { source: "secalert@redhat.com", url: "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html", }, { source: "secalert@redhat.com", url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html", }, { source: "secalert@redhat.com", url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html", }, { source: "secalert@redhat.com", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", }, { source: "secalert@redhat.com", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", }, { source: "secalert@redhat.com", url: "http://openwall.com/lists/oss-security/2011/08/29/2", }, { source: "secalert@redhat.com", url: "http://openwall.com/lists/oss-security/2011/08/30/4", }, { source: "secalert@redhat.com", url: "http://openwall.com/lists/oss-security/2011/08/30/8", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/45805", }, { source: "secalert@redhat.com", url: "http://secunia.com/advisories/45906", }, { source: "secalert@redhat.com", url: "http://secunia.com/advisories/45920", }, { source: "secalert@redhat.com", url: "http://secunia.com/advisories/45965", }, { source: "secalert@redhat.com", url: "http://secunia.com/advisories/46029", }, { source: "secalert@redhat.com", url: "http://securitytracker.com/id?1025981", }, { source: "secalert@redhat.com", url: "http://www.debian.org/security/2011/dsa-2304", }, { source: "secalert@redhat.com", url: "http://www.mandriva.com/security/advisories?name=MDVSA-2011:150", }, { source: "secalert@redhat.com", url: "http://www.osvdb.org/74847", }, { source: "secalert@redhat.com", url: "http://www.redhat.com/support/errata/RHSA-2011-1293.html", }, { source: "secalert@redhat.com", url: "http://www.securityfocus.com/bid/49356", }, { source: "secalert@redhat.com", url: "http://www.squid-cache.org/Advisories/SQUID-2011_3.txt", }, { source: "secalert@redhat.com", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch", }, { source: "secalert@redhat.com", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch", }, { source: "secalert@redhat.com", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch", }, { source: "secalert@redhat.com", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch", }, { source: "secalert@redhat.com", tags: [ "Patch", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://openwall.com/lists/oss-security/2011/08/29/2", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://openwall.com/lists/oss-security/2011/08/30/4", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://openwall.com/lists/oss-security/2011/08/30/8", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/45805", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/45906", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/45920", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/45965", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/46029", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://securitytracker.com/id?1025981", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.debian.org/security/2011/dsa-2304", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.mandriva.com/security/advisories?name=MDVSA-2011:150", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.osvdb.org/74847", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.redhat.com/support/errata/RHSA-2011-1293.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securityfocus.com/bid/49356", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.squid-cache.org/Advisories/SQUID-2011_3.txt", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", }, ], sourceIdentifier: "secalert@redhat.com", vulnStatus: "Deferred", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-Other", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
gsd-2011-3205
Vulnerability from gsd
Modified
2023-12-13 01:19
Details
Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.
Aliases
Aliases
{ GSD: { alias: "CVE-2011-3205", description: "Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.", id: "GSD-2011-3205", references: [ "https://www.suse.com/security/cve/CVE-2011-3205.html", "https://www.debian.org/security/2011/dsa-2304", "https://access.redhat.com/errata/RHSA-2011:1293", "https://linux.oracle.com/cve/CVE-2011-3205.html", ], }, gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { aliases: [ "CVE-2011-3205", ], details: "Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.", id: "GSD-2011-3205", modified: "2023-12-13T01:19:09.924076Z", schema_version: "1.4.0", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "secalert@redhat.com", ID: "CVE-2011-3205", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_affected: "=", version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html", refsource: "MISC", url: "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html", }, { name: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html", refsource: "MISC", url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html", }, { name: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html", refsource: "MISC", url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html", }, { name: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", refsource: "MISC", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", }, { name: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", refsource: "MISC", url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", }, { name: "http://openwall.com/lists/oss-security/2011/08/29/2", refsource: "MISC", url: "http://openwall.com/lists/oss-security/2011/08/29/2", }, { name: "http://openwall.com/lists/oss-security/2011/08/30/4", refsource: "MISC", url: "http://openwall.com/lists/oss-security/2011/08/30/4", }, { name: "http://openwall.com/lists/oss-security/2011/08/30/8", refsource: "MISC", url: "http://openwall.com/lists/oss-security/2011/08/30/8", }, { name: "http://secunia.com/advisories/45805", refsource: "MISC", url: "http://secunia.com/advisories/45805", }, { name: "http://secunia.com/advisories/45906", refsource: "MISC", url: "http://secunia.com/advisories/45906", }, { name: "http://secunia.com/advisories/45920", refsource: "MISC", url: "http://secunia.com/advisories/45920", }, { name: "http://secunia.com/advisories/45965", refsource: "MISC", url: "http://secunia.com/advisories/45965", }, { name: "http://secunia.com/advisories/46029", refsource: "MISC", url: "http://secunia.com/advisories/46029", }, { name: "http://securitytracker.com/id?1025981", refsource: "MISC", url: "http://securitytracker.com/id?1025981", }, { name: "http://www.debian.org/security/2011/dsa-2304", refsource: "MISC", url: "http://www.debian.org/security/2011/dsa-2304", }, { name: "http://www.mandriva.com/security/advisories?name=MDVSA-2011:150", refsource: "MISC", url: "http://www.mandriva.com/security/advisories?name=MDVSA-2011:150", }, { name: "http://www.osvdb.org/74847", refsource: "MISC", url: "http://www.osvdb.org/74847", }, { name: "http://www.redhat.com/support/errata/RHSA-2011-1293.html", refsource: "MISC", url: "http://www.redhat.com/support/errata/RHSA-2011-1293.html", }, { name: "http://www.securityfocus.com/bid/49356", refsource: "MISC", url: "http://www.securityfocus.com/bid/49356", }, { name: "http://www.squid-cache.org/Advisories/SQUID-2011_3.txt", refsource: "MISC", url: "http://www.squid-cache.org/Advisories/SQUID-2011_3.txt", }, { name: "http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch", refsource: "MISC", url: "http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch", }, { name: "http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch", refsource: "MISC", url: "http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch", }, { name: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch", refsource: "MISC", url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch", }, { name: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch", refsource: "MISC", url: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch", }, { name: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", refsource: "MISC", url: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", }, ], }, }, "nvd.nist.gov": { configurations: { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable13:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable9:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable20:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable14:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable24:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable16:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable16:rc1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable11:rc1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable18:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable6:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable15:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable5:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable21:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable17:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable11:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable10:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable8:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable12:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable25:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable23:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable22:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable7:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.0.stable19:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.18:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.13:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.7:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.14:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.12:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.14:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.8:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.6:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.9:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.15:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.13:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.12:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.10:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.5:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.7:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.6:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.16:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.11:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.8:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.5:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.5.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.10:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.9:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.11:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.1.0.17:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.9:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.6:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.10:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.7:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.8:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:squid-cache:squid:3.2.0.5:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, cve: { CVE_data_meta: { ASSIGNER: "secalert@redhat.com", ID: "CVE-2011-3205", }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "en", value: "Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "en", value: "NVD-CWE-Other", }, ], }, ], }, references: { reference_data: [ { name: "[oss-security] 20110829 CVE-request(?): squid: buffer overflow in Gopher reply parser", refsource: "MLIST", tags: [], url: "http://openwall.com/lists/oss-security/2011/08/29/2", }, { name: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", refsource: "CONFIRM", tags: [ "Patch", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=734583", }, { name: "http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch", refsource: "CONFIRM", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch", }, { name: "74847", refsource: "OSVDB", tags: [], url: "http://www.osvdb.org/74847", }, { name: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch", refsource: "CONFIRM", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch", }, { name: "49356", refsource: "BID", tags: [], url: "http://www.securityfocus.com/bid/49356", }, { name: "http://www.squid-cache.org/Advisories/SQUID-2011_3.txt", refsource: "CONFIRM", tags: [], url: "http://www.squid-cache.org/Advisories/SQUID-2011_3.txt", }, { name: "45805", refsource: "SECUNIA", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/45805", }, { name: "[oss-security] 20110830 Re: CVE-request(?): squid: buffer overflow in Gopher reply parser", refsource: "MLIST", tags: [], url: "http://openwall.com/lists/oss-security/2011/08/30/8", }, { name: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch", refsource: "CONFIRM", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch", }, { name: "1025981", refsource: "SECTRACK", tags: [], url: "http://securitytracker.com/id?1025981", }, { name: "http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch", refsource: "CONFIRM", tags: [ "Patch", ], url: "http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch", }, { name: "[oss-security] 20110830 Re: CVE-request(?): squid: buffer overflow in Gopher reply parser", refsource: "MLIST", tags: [], url: "http://openwall.com/lists/oss-security/2011/08/30/4", }, { name: "46029", refsource: "SECUNIA", tags: [], url: "http://secunia.com/advisories/46029", }, { name: "45920", refsource: "SECUNIA", tags: [], url: "http://secunia.com/advisories/45920", }, { name: "FEDORA-2011-11854", refsource: "FEDORA", tags: [], url: "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html", }, { name: "45965", refsource: "SECUNIA", tags: [], url: "http://secunia.com/advisories/45965", }, { name: "openSUSE-SU-2011:1018", refsource: "SUSE", tags: [], url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html", }, { name: "SUSE-SU-2011:1019", refsource: "SUSE", tags: [], url: "http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html", }, { name: "DSA-2304", refsource: "DEBIAN", tags: [], url: "http://www.debian.org/security/2011/dsa-2304", }, { name: "45906", refsource: "SECUNIA", tags: [], url: "http://secunia.com/advisories/45906", }, { name: "RHSA-2011:1293", refsource: "REDHAT", tags: [], url: "http://www.redhat.com/support/errata/RHSA-2011-1293.html", }, { name: "MDVSA-2011:150", refsource: "MANDRIVA", tags: [], url: "http://www.mandriva.com/security/advisories?name=MDVSA-2011:150", }, { name: "SUSE-SU-2016:2089", refsource: "SUSE", tags: [], url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html", }, { name: "SUSE-SU-2016:1996", refsource: "SUSE", tags: [], url: "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html", }, ], }, }, impact: { baseMetricV2: { cvssV2: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 6.8, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "MEDIUM", userInteractionRequired: false, }, }, lastModifiedDate: "2023-02-13T00:19Z", publishedDate: "2011-09-06T15:55Z", }, }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.