Buffer overflow in Squid - CVE-2016-4054
Published: April 25, 2016 / Updated: July 28, 2020
Vulnerability identifier: #VU32300
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2016-4054
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Squid-cache.org
Affected software:
Squid
Squid
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.
How to mitigate CVE-2016-4054
Install update from vendor's website.
Sources
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
- http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
- http://www.debian.org/security/2016/dsa-3625
- http://www.openwall.com/lists/oss-security/2016/04/20/6
- http://www.openwall.com/lists/oss-security/2016/04/20/9
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.securityfocus.com/bid/86788
- http://www.securitytracker.com/id/1035647
- http://www.squid-cache.org/Advisories/SQUID-2016_6.txt
- http://www.ubuntu.com/usn/USN-2995-1
- https://access.redhat.com/errata/RHSA-2016:1138
- https://access.redhat.com/errata/RHSA-2016:1139
- https://access.redhat.com/errata/RHSA-2016:1140
- https://security.gentoo.org/glsa/201607-01