Skip to content
OpenAdvisories
High ELSA-2025-14414 2 CVEs

Important: squid security update (Oracle Linux 7)

Published Sep 29, 2025 · Updated Sep 29, 2025

Ecosystem: Oracle Linux

Summary

[7:3.5.20-17.0.7.13]
- Fixes CVE-2025-54574, add URN access disabling config options [Orabug: 38350105]

[7:3.5.20-17.0.5.13]
- Fixed cve 2023-46846 for http and icap request/response smuggling [Orabug: 37326730]

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 7 squid 7:3.5.20-17.0.7.el7_9.13
Oracle Linux · 7 squid-migration-script 7:3.5.20-17.0.7.el7_9.13
Oracle Linux · 7 squid-sysvinit 7:3.5.20-17.0.7.el7_9.13

Vulnerabilities 2

  • Critical 9.3
    CVE-2025-54574 Public exploit EPSS 22%

    Squid's URN Handling can lead to Buffer Overflow

    Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2021-28651

    An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial o…

    squid squid3 squid squid Debian Ubuntu Alpine