Package "squid3"

Name: squid3


Transitional package

Latest version: 3.5.27-1ubuntu1.3
Release: bionic (18.04)
Level: security
Repository: main
Homepage: http://www.squid-cache.org


Save this URL for the latest version of "squid3": https://www.ubuntuupdates.org/squid3

Download "squid3"

Other versions of "squid3" in Bionic

Repository Area Version
base main 3.5.27-1ubuntu1
base universe 3.5.27-1ubuntu1
security universe 3.5.27-1ubuntu1.3
updates main 3.5.27-1ubuntu1.3
updates universe 3.5.27-1ubuntu1.3

Packages in group

Deleted packages are displayed in grey.


Version: 3.5.27-1ubuntu1.3 2019-07-18 19:07:13 UTC

  squid3 (3.5.27-1ubuntu1.3) bionic-security; urgency=medium

  * SECURITY UPDATE: incorrect digest auth parameter parsing
    - debian/patches/CVE-2019-12525.patch: check length in
    - CVE-2019-12525
  * SECURITY UPDATE: basic auth uudecode length issue
    - debian/patches/CVE-2019-12529.patch: replace uudecode with libnettle
      base64 decoder in lib/Makefile.*, src/auth/basic/Config.cc,
      include/uudecode.h, lib/uudecode.c.
    - CVE-2019-12529

 -- Marc Deslauriers <email address hidden> Tue, 16 Jul 2019 11:49:31 -0400

Source diff to previous version
CVE-2019-12525 An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the heade
CVE-2019-12529 An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authenticati

Version: 3.5.27-1ubuntu1.2 2019-07-15 16:06:29 UTC

  squid3 (3.5.27-1ubuntu1.2) bionic-security; urgency=medium

  * SECURITY UPDATE: DoS via SNMP memory leak
    - debian/patches/CVE-2018-19132.patch: fix leak in src/snmp_core.cc.
    - CVE-2018-19132
  * SECURITY UPDATE: XSS issues in cachemgr.cgi
    - debian/patches/CVE-2019-13345.patch: properly escape values in
    - CVE-2019-13345

 -- Marc Deslauriers <email address hidden> Thu, 11 Jul 2019 12:59:25 -0400

CVE-2018-19132 Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.
CVE-2019-13345 The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.

About   -   Send Feedback to @ubuntu_updates