UbuntuUpdates.org

Package "squid"

Name: squid

Description:

Full featured Web Proxy cache (HTTP proxy)

Latest version: 4.4-1ubuntu2.3
Release: disco (19.04)
Level: updates
Repository: main
Homepage: http://www.squid-cache.org

Links

Save this URL for the latest version of "squid": https://www.ubuntuupdates.org/squid


Download "squid"


Other versions of "squid" in Disco

Repository Area Version
base universe 4.4-1ubuntu2
base main 4.4-1ubuntu2
security universe 4.4-1ubuntu2.3
security main 4.4-1ubuntu2.3
updates universe 4.4-1ubuntu2.3

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 4.4-1ubuntu2.3 2019-12-05 01:07:29 UTC

  squid (4.4-1ubuntu2.3) disco-security; urgency=medium

  * SECURITY UPDATE: Multiple issues in URI processing
    - debian/patches/CVE-2019-12523.patch: Update URI parser to use SBuf
      parsing APIs in src/Downloader.cc, src/HttpRequest.cc,
      src/HttpRequest.h, src/Makefile.am, src/acl/Asn.cc,
      src/adaptation/ecap/MessageRep.cc, src/anyp/ProtocolType.h,
      src/anyp/Uri.cc, src/anyp/Uri.h, src/anyp/UriScheme.cc,
      src/anyp/UriScheme.h, src/client_side_request.cc, src/htcp.cc,
      src/icmp/net_db.cc, src/icp_v2.cc, src/mgr/Inquirer.cc,
      src/mime.cc, src/neighbors.cc, src/peer_digest.cc,
      src/servers/FtpServer.cc, src/servers/Http1Server.cc,
      src/store_digest.cc, src/tests/stub_HttpRequest.cc,
      src/tests/stub_libanyp.cc, src/tests/testHttpRequest.cc,
      src/urn.cc.
    - CVE-2019-12523
    - CVE-2019-18676
  * SECURITY UPDATE: Heap Overflow issue in URN processing
    - debian/patches/CVE-2019-12526.patch: fix URN response handling in
      src/urn.cc.
    - CVE-2019-12526
  * SECURITY UPDATE: DoS via incorrect string termination
    - debian/patches/CVE-2019-12854.patch: fix string termination in
      tools/cachemgr.cc.
    - CVE-2019-12854
  * SECURITY UPDATE: CSRF issue in HTTP Request processing
    - debian/patches/CVE-2019-18677.patch: prevent truncation for large
      origin-relative domains in src/anyp/Uri.cc, src/anyp/Uri.h,
      src/internal.cc.
    - CVE-2019-18677
  * SECURITY UPDATE: HTTP Request Splitting in HTTP message processing
    - debian/patches/CVE-2019-18678.patch: server MUST reject messages with
      BWS after field-name in src/HttpHeader.cc, src/HttpHeader.h.
    - CVE-2019-18678
    - CVE-2019-18679

 -- Marc Deslauriers <email address hidden> Tue, 19 Nov 2019 13:27:56 -0500

Source diff to previous version
CVE-2019-18679 An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when pro
CVE-2019-18678 An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance
CVE-2019-18677 An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly inte
CVE-2019-12854 Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, thi
CVE-2019-12526 An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a rem
CVE-2019-18676 An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in
CVE-2019-12523 An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through

Version: 4.4-1ubuntu2.2 2019-07-18 21:07:09 UTC

  squid (4.4-1ubuntu2.2) disco-security; urgency=medium

  * SECURITY UPDATE: incorrect digest auth parameter parsing
    - debian/patches/CVE-2019-12525.patch: check length in
      src/auth/digest/Config.cc.
    - CVE-2019-12525
  * SECURITY UPDATE: buffer overflow in basic auth decoding
    - debian/patches/CVE-2019-12527.patch: switch to SBuf in
      src/HttpHeader.cc, src/HttpHeader.h, src/cache_manager.cc,
      src/clients/FtpGateway.cc.
    - CVE-2019-12527
  * SECURITY UPDATE: basic auth uudecode length issue
    - debian/patches/CVE-2019-12529.patch: replace uudecode with libnettle
      base64 decoder in lib/Makefile.*, src/auth/basic/Config.cc,
      include/uudecode.h, lib/uudecode.c.
    - CVE-2019-12529

 -- Marc Deslauriers <email address hidden> Tue, 16 Jul 2019 11:43:17 -0400

Source diff to previous version
CVE-2019-12525 An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the heade
CVE-2019-12527 An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store
CVE-2019-12529 An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authenticati

Version: 4.4-1ubuntu2.1 2019-07-15 17:07:07 UTC

  squid (4.4-1ubuntu2.1) disco-security; urgency=medium

  * SECURITY UPDATE: XSS issues in cachemgr.cgi
    - debian/patches/CVE-2019-13345.patch: properly escape values in
      tools/cachemgr.cc.
    - CVE-2019-13345

 -- Marc Deslauriers <email address hidden> Thu, 11 Jul 2019 13:07:14 -0400

CVE-2019-13345 The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.



About   -   Send Feedback to @ubuntu_updates