squid: multiple vulnerabilities
| Package(s): | squid | CVE #(s): | CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 25, 2016 | Updated: | August 4, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2016-4051 (denial of service): Due to incorrect buffer management Squid cachemgr.cgi tool is vulnerable to a buffer overflow when processing remotely supplied inputs relayed to it from Squid. - CVE-2016-4052 (denial of service): Due to buffer overflow issues Squid is vulnerable to a denial of service attack when processing ESI responses. - CVE-2016-4053 (information disclosure): Due to incorrect input validation Squid is vulnerable to public information disclosure of the server stack layout when processing ESI responses. - CVE-2016-4054 (arbitrary code execution): Due to incorrect input validation and buffer overflow Squid is vulnerable to remote code execution when processing ESI responses. A remote attacker is able to execute arbitrary code, disclose sensitive information or perform a denial of service attack via multiple vulnerabilities. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||