CVE-2016-2570

NameCVE-2016-2570
DescriptionThe Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs816011

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
squid (PTS)buster4.6-1+deb10u7fixed
buster (security)4.6-1+deb10u10fixed
bullseye4.13-10+deb11u2fixed
bullseye (security)4.13-10+deb11u3fixed
bookworm5.7-2fixed
bookworm (security)5.7-2+deb12u1fixed
sid, trixie6.9-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
squidsource(unstable)(not affected)
squid3source(unstable)3.5.15-1816011

Notes

[wheezy] - squid3 <no-dsa> (Minor issue, needs substantial backporting; too intrusive to backport)
- squid <not-affected> (Vulnerable code not present)
http://www.squid-cache.org/Advisories/SQUID-2016_2.txt
http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13993.patch
http://bugs.squid-cache.org/show_bug.cgi?id=3870
http://www.squid-cache.org/Versions/v4/changesets/squid-4-14549.patch
Upstream confirmed it does not affect squid 2.7.x
It's maybe too instrusive to fix in 3.1 (squeeze and wheezy).

Search for package or bug name: Reporting problems