CVE-2019-12526

NameCVE-2019-12526
DescriptionAn issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2028-1, DLA-2278-1, DSA-4682-1
NVD severityhigh

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
squid (PTS)buster, buster (security)4.6-1+deb10u3fixed
bullseye, sid4.12-1fixed
squid3 (PTS)stretch3.5.23-5+deb9u1vulnerable
stretch (security)3.5.23-5+deb9u2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
squidsourcebuster4.6-1+deb10u2DSA-4682-1
squidsource(unstable)4.9-1
squid3sourcejessie3.4.8-6+deb8u9DLA-2028-1
squid3sourcestretch3.5.23-5+deb9u2DLA-2278-1
squid3source(unstable)(unfixed)

Notes

Squid 4: http://www.squid-cache.org/Versions/v4/changesets/squid-4-7aa0184a720fd216191474e079f4fe87de7c4f5a.patch
http://www.squid-cache.org/Advisories/SQUID-2019_7.txt

Search for package or bug name: Reporting problems