CVE-2019-12519

NameCVE-2019-12519
DescriptionAn issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack won't overflow.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4682-1
NVD severityhigh

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
squid (PTS)buster4.6-1+deb10u1vulnerable
buster (security)4.6-1+deb10u2fixed
bullseye4.11-2fixed
sid4.11-5fixed
squid3 (PTS)jessie3.4.8-6+deb8u5vulnerable
jessie (security)3.4.8-6+deb8u9vulnerable
stretch (security), stretch3.5.23-5+deb9u1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
squidsource(unstable)4.11-1
squidsourcebuster4.6-1+deb10u2DSA-4682-1
squid3source(unstable)(unfixed)

Notes

http://www.squid-cache.org/Advisories/SQUID-2019_12.txt
Squid 4: http://www.squid-cache.org/Versions/v4/changesets/squid-4-fdd4123629320aa1ee4c3481bb392437c90d188d.patch

Search for package or bug name: Reporting problems