Mageia alert MGASA-2018-0458 (squid)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
             
 
updates-announce@ml.mageia.org 
Subject:
             
 
[updates-announce] MGASA-2018-0458: Updated squid packages fix security vulnerabilities 
Date:
             
 
Sat, 17 Nov 2018 23:24:19 +0100
Message-ID:
             
 
<20181117222419.7E0E19FEE1@duvel.mageia.org>
MGASA-2018-0458 - Updated squid packages fix security vulnerabilities

Publication date: 17 Nov 2018
URL: https://advisories.mageia.org/MGASA-2018-0458.html
Type: security
Affected Mageia releases: 6
CVE: CVE-2018-19131,
     CVE-2018-19132

Description:
Due to incorrect input handling, Squid is vulnerable to a Cross-Site
Scripting vulnerability when generating HTTPS response messages about
TLS errors (CVE-2018-19131).

Due to a memory leak in SNMP query rejection code, Squid is vulnerable
to a denial of service attack (CVE-2018-19132).

References:
- https://bugs.mageia.org/show_bug.cgi?id=23780
- http://www.squid-cache.org/Advisories/SQUID-2018_4.txt
- http://www.squid-cache.org/Advisories/SQUID-2018_5.txt
- https://www.openwall.com/lists/oss-security/2018/11/09/1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1...

SRPMS:
- 6/core/squid-3.5.26-1.2.mga6