Skip to content
OpenAdvisories
Medium ELSA-2024-4861 2 CVEs

Moderate: squid security update (Oracle Linux 9)

Published Jul 25, 2024 · Updated Jul 25, 2024

Ecosystem: Oracle Linux

Summary

[7:5.5-13]
- Resolves: RHEL-45056 - squid: Out-of-bounds write error may lead to Denial of
Service (CVE-2024-37894)
- Resolves: RHEL-45643 - squid: vulnerable to a Denial of Service attack against
Cache Manager error responses (CVE-2024-23638)

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 squid 7:5.5-13.el9_4

Vulnerabilities 2

  • Medium 6.5
    CVE-2024-23638 EPSS 60%

    SQUID-2023:11 Denial of Service in Cache Manager

    Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2024-37894

    Squid vulnerable to heap corruption in ESI assign

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux