UbuntuUpdates.org

Package "squid3"

Name: squid3

Description:

Dummy transitional package.

Latest version: 3.5.12-1ubuntu7.9
Release: xenial (16.04)
Level: security
Repository: main
Homepage: http://www.squid-cache.org

Links

Save this URL for the latest version of "squid3": https://www.ubuntuupdates.org/squid3


Download "squid3"


Other versions of "squid3" in Xenial

Repository Area Version
base main 3.5.12-1ubuntu7
base universe 3.5.12-1ubuntu7
security universe 3.5.12-1ubuntu7.9
updates main 3.5.12-1ubuntu7.9
updates universe 3.5.12-1ubuntu7.9

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 3.5.12-1ubuntu7.9 2019-12-05 14:07:07 UTC

  squid3 (3.5.12-1ubuntu7.9) xenial-security; urgency=medium

  * SECURITY UPDATE: Heap Overflow issue in URN processing
    - debian/patches/CVE-2019-12526.patch: fix URN response handling in
      src/urn.cc.
    - CVE-2019-12526
  * SECURITY UPDATE: CSRF issue in HTTP Request processing
    - debian/patches/CVE-2019-18677.patch: prevent truncation for large
      origin-relative domains in src/URL.h, src/internal.cc, src/url.cc.
    - CVE-2019-18677
  * SECURITY UPDATE: HTTP Request Splitting in HTTP message processing
    - debian/patches/CVE-2019-18678.patch: server MUST reject messages with
      BWS after field-name in src/HttpHeader.cc, src/HttpHeader.h.
    - CVE-2019-18678
    - CVE-2019-18679

 -- Marc Deslauriers <email address hidden> Wed, 20 Nov 2019 07:11:17 -0500

Source diff to previous version
CVE-2019-12526 An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a rem
CVE-2019-18677 An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly inte
CVE-2019-18678 An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance
CVE-2019-18679 An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when pro

Version: 3.5.12-1ubuntu7.8 2019-07-18 19:07:11 UTC

  squid3 (3.5.12-1ubuntu7.8) xenial-security; urgency=medium

  * SECURITY UPDATE: incorrect digest auth parameter parsing
    - debian/patches/CVE-2019-12525.patch: check length in
      src/auth/digest/Config.cc.
    - CVE-2019-12525
  * SECURITY UPDATE: basic auth uudecode length issue
    - debian/patches/CVE-2019-12529.patch: replace uudecode with libnettle
      base64 decoder in lib/Makefile.*, src/auth/basic/Config.cc,
      include/uudecode.h, lib/uudecode.c.
    - CVE-2019-12529

 -- Marc Deslauriers <email address hidden> Tue, 16 Jul 2019 14:49:40 -0400

Source diff to previous version
CVE-2019-12525 An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the heade
CVE-2019-12529 An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authenticati

Version: 3.5.12-1ubuntu7.7 2019-07-15 16:06:24 UTC

  squid3 (3.5.12-1ubuntu7.7) xenial-security; urgency=medium

  * SECURITY UPDATE: DoS via SNMP memory leak
    - debian/patches/CVE-2018-19132.patch: fix leak in src/snmp_core.cc.
    - CVE-2018-19132
  * SECURITY UPDATE: XSS issues in cachemgr.cgi
    - debian/patches/CVE-2019-13345.patch: properly escape values in
      tools/cachemgr.cc.
    - CVE-2019-13345

 -- Marc Deslauriers <email address hidden> Thu, 11 Jul 2019 13:03:44 -0400

Source diff to previous version
CVE-2018-19132 Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.
CVE-2019-13345 The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.

Version: 3.5.12-1ubuntu7.5 2018-02-05 20:06:28 UTC

  squid3 (3.5.12-1ubuntu7.5) xenial-security; urgency=medium

  * SECURITY UPDATE: various denial of service issues
    - debian/patches/CVE-2016-25xx-1.patch: better handling of huge
      response headers in src/http.cc.
    - debian/patches/CVE-2016-25xx-2.patch: throw instead of asserting on
      some String overflows in src/SquidString.h, src/StrList.cc,
      src/String.cc, src/clients/Client.cc, src/clients/Client.h,
      src/clients/FtpClient.cc, src/http.cc.
    - debian/patches/CVE-2016-25xx-3.patch: fix assertion in custom ESI
      parser in src/esi/CustomParser.cc, src/esi/CustomParser.h.
    - debian/patches/CVE-2016-25xx-4.patch: fix assertion in
      src/FwdState.cc, src/FwdState.h, src/clients/Client.h, src/comm.cc,
      src/comm.h, src/http.cc.
    - CVE-2016-2569
    - CVE-2016-2570
    - CVE-2016-2571
  * SECURITY UPDATE: denial of service via crafted HTTP response
    - debian/patches/CVE-2016-3948.patch: convert Vary handling to SBuf in
      src/HttpRequest.cc, src/HttpRequest.h, src/MemObject.cc,
      src/MemObject.h, src/MemStore.cc, src/StoreMetaVary.cc,
      src/client_side.cc, src/client_side_reply.cc, src/http.cc,
      src/http.h, src/store.cc, src/store_key_md5.cc,
      src/store_swapmeta.cc, src/tests/stub_MemObject.cc,
      src/tests/stub_http.cc.
    - CVE-2016-3948
  * SECURITY UPDATE: denial of service in ESI Response processing
    - debian/patches/CVE-2018-1000024.patch: make sure endofName never
      exceeds tagEnd in src/esi/CustomParser.cc.
    - CVE-2018-1000024
  * SECURITY UPDATE: denial of service in in HTTP Message processing
    - debian/patches/CVE-2018-1000027.patch: fix indirect IP logging for
      transactions without a client connection in
      src/client_side_request.cc.
    - CVE-2018-1000027

 -- Marc Deslauriers <email address hidden> Thu, 01 Feb 2018 09:56:31 -0500

Source diff to previous version
CVE-2016-2569 Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of servic
CVE-2016-2570 The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows rem
CVE-2016-2571 http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remo
CVE-2016-3948 Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a cra

Version: 3.5.12-1ubuntu7.3 2017-02-06 19:06:46 UTC

  squid3 (3.5.12-1ubuntu7.3) xenial-security; urgency=medium

  * SECURITY UPDATE: cookie data leak via If-Not-Modified HTTP conditional
    - debian/patches/CVE-2016-10002.patch: properly handle combination of
      If-Match and a Cache Hit in src/LogTags.h, src/client_side.cc,
      src/client_side_reply.cc, src/client_side_reply.h.
    - CVE-2016-10002
  * SECURITY UPDATE: incorrect HTTP Request header comparison
    - debian/patches/CVE-2016-10003.patch: don't share private responses
      with collapsed client in src/client_side_reply.cc.
    - CVE-2016-10003

 -- Marc Deslauriers <email address hidden> Fri, 03 Feb 2017 14:09:18 -0500

CVE-2016-1000 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.



About   -   Send Feedback to @ubuntu_updates