CVE-2016-4054

NameCVE-2016-4054
DescriptionBuffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-478-1, DSA-3625-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
squid (PTS)bullseye (security), bullseye4.13-10+deb11u3fixed
bookworm, bookworm (security)5.7-2+deb12u2fixed
sid, trixie6.12-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
squidsource(unstable)(not affected)
squid3sourcewheezy3.1.20-2.2+deb7u5DLA-478-1
squid3sourcejessie3.4.8-6+deb8u3DSA-3625-1
squid3source(unstable)3.5.17-1

Notes

- squid <not-affected> (Squid 2.x are not vulnerable)
http://www.squid-cache.org/Advisories/SQUID-2016_6.txt
http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11841.patch (Squid 3.2)
http://www.squid-cache.org/Versions/v3/3.3/changesets/squid-3.3-12697.patch (Squid 3.3)
http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13235.patch (Squid 3.4)
http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14034.patch (Squid 3.5)

Search for package or bug name: Reporting problems