Bugzilla – Bug 968395
VUL-0: CVE-2016-2572: squid, squid3: Multiple DoS issues in HTTP Response processing
Last modified: 2019-07-16 16:36:33 UTC
http://www.squid-cache.org/Advisories/SQUID-2016_2.txt Error handling for malformed HTTP responses can lead to a second assertion with the same effects as the first issue. It is not easily triggered in Squid-3 or normally in Squid-4. However fixing the String issue makes it become easily triggerable in Squid-4, and we do have a history of the assertion itself being reported as occuring already but been unable to identify the vectors code path to replicate it yet. So believe it can be achieved independent of the String issues, even if we are unable so far to identify how. Patch URLs for this are: http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13990.patch http://www.squid-cache.org/Versions/v4/changesets/squid-4-14548.patch ---------------- For 'Do not use parsing leftovers, such as HTTP response status code' in squid-4-14548.patch, use CVE-2016-2572. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2572 http://seclists.org/oss-sec/2016/q1/442
bugbot adjusting priority
SUSE-SU-2016:1996-1: An update that fixes 25 vulnerabilities is now available. Category: security (important) Bug References: 895773,902197,938715,963539,967011,968392,968393,968394,968395,973782,973783,976553,976556,976708,979008,979009,979010,979011 CVE References: CVE-2011-3205,CVE-2011-4096,CVE-2012-5643,CVE-2013-0188,CVE-2013-4115,CVE-2014-0128,CVE-2014-6270,CVE-2014-7141,CVE-2014-7142,CVE-2015-5400,CVE-2016-2390,CVE-2016-2569,CVE-2016-2570,CVE-2016-2571,CVE-2016-2572,CVE-2016-3947,CVE-2016-3948,CVE-2016-4051,CVE-2016-4052,CVE-2016-4053,CVE-2016-4054,CVE-2016-4553,CVE-2016-4554,CVE-2016-4555,CVE-2016-4556 Sources used: SUSE Linux Enterprise Server 11-SP4 (src): squid3-3.1.23-8.16.27.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): squid3-3.1.23-8.16.27.1
SUSE-SU-2016:2008-1: An update that solves 16 vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 902197,929493,938715,955783,959290,963539,968392,968393,968394,968395,973782,973783,976553,976556,979008,979009,979010,979011 CVE References: CVE-2015-3455,CVE-2015-5400,CVE-2016-2569,CVE-2016-2570,CVE-2016-2571,CVE-2016-2572,CVE-2016-3947,CVE-2016-3948,CVE-2016-4051,CVE-2016-4052,CVE-2016-4053,CVE-2016-4054,CVE-2016-4553,CVE-2016-4554,CVE-2016-4555,CVE-2016-4556 Sources used: SUSE Linux Enterprise Server 12-SP1 (src): squid-3.3.14-20.2
openSUSE-SU-2016:2081-1: An update that solves 16 vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 902197,929493,938715,955783,959290,963539,968392,968393,968394,968395,973782,973783,976553,976556,979008,979009,979010,979011 CVE References: CVE-2015-3455,CVE-2015-5400,CVE-2016-2569,CVE-2016-2570,CVE-2016-2571,CVE-2016-2572,CVE-2016-3947,CVE-2016-3948,CVE-2016-4051,CVE-2016-4052,CVE-2016-4053,CVE-2016-4054,CVE-2016-4553,CVE-2016-4554,CVE-2016-4555,CVE-2016-4556 Sources used: openSUSE Leap 42.1 (src): squid-3.3.14-6.1
SUSE-SU-2016:2089-1: An update that fixes 25 vulnerabilities is now available. Category: security (important) Bug References: 895773,902197,938715,963539,967011,968392,968393,968394,968395,973782,973783,976553,976556,976708,979008,979009,979010,979011,993299 CVE References: CVE-2011-3205,CVE-2011-4096,CVE-2012-5643,CVE-2013-0188,CVE-2013-4115,CVE-2014-0128,CVE-2014-6270,CVE-2014-7141,CVE-2014-7142,CVE-2015-5400,CVE-2016-2390,CVE-2016-2569,CVE-2016-2570,CVE-2016-2571,CVE-2016-2572,CVE-2016-3947,CVE-2016-3948,CVE-2016-4051,CVE-2016-4052,CVE-2016-4053,CVE-2016-4054,CVE-2016-4553,CVE-2016-4554,CVE-2016-4555,CVE-2016-4556 Sources used: SUSE Linux Enterprise Server 11-SP4 (src): squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): squid3-3.1.23-8.16.30.1
released
This is an autogenerated message for OBS integration: This bug (968395) was mentioned in https://build.opensuse.org/request/show/701549 Factory / squid