Skip to content
OpenAdvisories
High ELSA-2023-7465 3 CVEs

Important: squid security update (Oracle Linux 9)

Published Nov 28, 2023 · Updated Nov 28, 2023

Ecosystem: Oracle Linux

Summary

[- 7:5.5-6.2]
- Fix: squid: DoS against HTTP and HTTPS (CVE-2023-5824)

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 squid 7:5.5-6.el9_3.2

Vulnerabilities 3

  • Critical 9.3
    CVE-2025-54574 Public exploit EPSS 22%

    Squid's URN Handling can lead to Buffer Overflow

    Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux
  • High 8.6
    CVE-2023-49288

    Denial of Service in HTTP Collapsed Forwarding in Squid

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and includ…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2023-5824

    Squid: dos against http and https

    A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a l…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux