UbuntuUpdates.org

Package "squid-common"

Name: squid-common

Description:

Full featured Web Proxy cache (HTTP proxy) - common files
Latest version: 3.5.12-1ubuntu7.16
Release: xenial (16.04)
Level: updates
Repository: main
Head package: squid3
Homepage: http://www.squid-cache.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "squid-common"

All arch deb package
APT INSTALL

Other versions of "squid-common" in Xenial

Repository Area Version
base main 3.5.12-1ubuntu7
security main 3.5.12-1ubuntu7.16

Changelog

Version: 3.5.12-1ubuntu7.11 2020-05-13 14:07:25 UTC

  squid3 (3.5.12-1ubuntu7.11) xenial-security; urgency=medium

  * SECURITY UPDATE: multiple ESI issues
    - debian/patches/CVE-2019-12519_12521.patch: convert parse exceptions
      into 500 status response in src/esi/Context.h, src/esi/Esi.cc,
      src/esi/Esi.h, src/esi/Expression.cc.
    - CVE-2019-12519
    - CVE-2019-12521
  * SECURITY UPDATE: hostname parameter mishandling in cachemgr.cgi
    - debian/patches/CVE-2019-18860.patch: add validation for hostname
      parameter in src/base/CharacterSet.cc, tools/Makefile.am,
      tools/cachemgr.cc.
    - CVE-2019-18860
  * SECURITY UPDATE: Digest Authentication nonce replay issue
    - debian/patches/CVE-2020-11945.patch: fix auth digest refcount integer
      overflow in src/auth/digest/Config.cc.
    - CVE-2020-11945

 -- Marc Deslauriers <email address hidden> Thu, 07 May 2020 10:05:12 -0400
Source diff to previous version
CVE-2019-12519 An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function
CVE-2019-12521 An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for ho
CVE-2019-18860 Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi.
CVE-2020-11945 An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that ar

Version: 3.5.12-1ubuntu7.10 2020-02-20 15:06:35 UTC

  squid3 (3.5.12-1ubuntu7.10) xenial-security; urgency=medium

  * SECURITY UPDATE: info disclosure via FTP server
    - debian/patches/CVE-2019-12528.patch: fix FTP buffers handling in
      src/clients/FtpGateway.cc.
    - CVE-2019-12528
  * SECURITY UPDATE: incorrect input validation and buffer management
    - debian/patches/CVE-2020-84xx-1.patch: ignore malformed Host header in
      intercept and reverse proxy mode in src/client_side.cc.
    - debian/patches/CVE-2020-84xx-2.patch: fix request URL generation in
      reverse proxy configurations in src/client_side.cc.
    - debian/patches/CVE-2020-84xx-3.patch: fix security patch in
      src/client_side.cc.
    - CVE-2020-8449
    - CVE-2020-8450
  * SECURITY UPDATE: DoS in NTLM authentication
    - debian/patches/CVE-2020-8517.patch: improved username handling in
      helpers/external_acl/LM_group/ext_lm_group_acl.cc.
    - CVE-2020-8517

 -- Marc Deslauriers <email address hidden> Wed, 19 Feb 2020 13:06:13 -0500
Source diff to previous version
CVE-2019-12528 An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as
CVE-2020-8449 An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access
CVE-2020-8450 An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance act
CVE-2020-8517 An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may w

Version: 3.5.12-1ubuntu7.9 2019-12-05 01:07:17 UTC

  squid3 (3.5.12-1ubuntu7.9) xenial-security; urgency=medium

  * SECURITY UPDATE: Heap Overflow issue in URN processing
    - debian/patches/CVE-2019-12526.patch: fix URN response handling in
      src/urn.cc.
    - CVE-2019-12526
  * SECURITY UPDATE: CSRF issue in HTTP Request processing
    - debian/patches/CVE-2019-18677.patch: prevent truncation for large
      origin-relative domains in src/URL.h, src/internal.cc, src/url.cc.
    - CVE-2019-18677
  * SECURITY UPDATE: HTTP Request Splitting in HTTP message processing
    - debian/patches/CVE-2019-18678.patch: server MUST reject messages with
      BWS after field-name in src/HttpHeader.cc, src/HttpHeader.h.
    - CVE-2019-18678
    - CVE-2019-18679

 -- Marc Deslauriers <email address hidden> Wed, 20 Nov 2019 07:11:17 -0500
Source diff to previous version
CVE-2019-12526 An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a rem
CVE-2019-18677 An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly inte
CVE-2019-18678 An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance
CVE-2019-18679 An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when pro

Version: 3.5.12-1ubuntu7.8 2019-07-18 20:07:12 UTC

  squid3 (3.5.12-1ubuntu7.8) xenial-security; urgency=medium

  * SECURITY UPDATE: incorrect digest auth parameter parsing
    - debian/patches/CVE-2019-12525.patch: check length in
      src/auth/digest/Config.cc.
    - CVE-2019-12525
  * SECURITY UPDATE: basic auth uudecode length issue
    - debian/patches/CVE-2019-12529.patch: replace uudecode with libnettle
      base64 decoder in lib/Makefile.*, src/auth/basic/Config.cc,
      include/uudecode.h, lib/uudecode.c.
    - CVE-2019-12529

 -- Marc Deslauriers <email address hidden> Tue, 16 Jul 2019 14:49:40 -0400
Source diff to previous version
CVE-2019-12525 An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the heade
CVE-2019-12529 An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authenticati

Version: 3.5.12-1ubuntu7.7 2019-07-15 17:07:01 UTC

  squid3 (3.5.12-1ubuntu7.7) xenial-security; urgency=medium

  * SECURITY UPDATE: DoS via SNMP memory leak
    - debian/patches/CVE-2018-19132.patch: fix leak in src/snmp_core.cc.
    - CVE-2018-19132
  * SECURITY UPDATE: XSS issues in cachemgr.cgi
    - debian/patches/CVE-2019-13345.patch: properly escape values in
      tools/cachemgr.cc.
    - CVE-2019-13345

 -- Marc Deslauriers <email address hidden> Thu, 11 Jul 2019 13:03:44 -0400
CVE-2018-19132 Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.
CVE-2019-13345 The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.


About   -   Send Feedback to @ubuntu_updates