Skip to content
OpenAdvisories
Unscored USN-3557-1 6 CVEs

squid3 vulnerabilities

Published Feb 5, 2018 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Mathias Fischer discovered that Squid incorrectly handled certain long
strings in headers. A malicious remote server could possibly cause Squid to
crash, resulting in a denial of service. This issue was only addressed in
Ubuntu 16.04 LTS. (CVE-2016-2569)

William Lima discovered that Squid incorrectly handled XML parsing when
processing Edge Side Includes (ESI). A malicious remote server could
possibly cause Squid to crash, resulting in a denial of service. This issue
was only addressed in Ubuntu 16.04 LTS. (CVE-2016-2570)

Alex Rousskov discovered that Squid incorrectly handled response-parsing
failures. A malicious remote server could possibly cause Squid to crash,
resulting in a denial of service. This issue only applied to Ubuntu 16.04
LTS. (CVE-2016-2571)

Santiago Ruano Rincón discovered that Squid incorrectly handled certain
Vary headers. A remote attacker could possibly use this issue to cause
Squid to crash, resulting in a denial of service. This issue was only
addressed in Ubuntu 16.04 LTS. (CVE-2016-3948)

Louis Dion-Marcil discovered that Squid incorrectly handled certain Edge
Side Includes (ESI) responses. A malicious remote server could possibly
cause Squid to crash, resulting in a denial of service. (CVE-2018-1000024)

Louis Dion-Marcil discovered that Squid incorrectly handled certain Edge
Side Includes (ESI) responses. A malicious remote server could possibly
cause Squid to crash, resulting in a denial of service. (CVE-2018-1000027)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS squid3 3.3.8-1ubuntu6.11
Ubuntu · 16.04 LTS 16.04:LTS squid3 3.5.12-1ubuntu7.5

Vulnerabilities 6

  • Unscored —
    CVE-2016-2569 Public exploit EPSS 31%

    Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote serve…

    squid3 Ubuntu
  • Unscored —
    CVE-2016-2570

    The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during…

    squid3 Ubuntu
  • Unscored —
    CVE-2016-2571

    http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-pars…

    squid3 Ubuntu
  • Unscored —
    CVE-2016-3948 EPSS 35%

    Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause…

    squid squid3 Debian Ubuntu
  • Unscored —
    CVE-2018-1000024

    The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointe…

    squid squid3 squid Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-1000027 EPSS 13%

    The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Derefere…

    squid squid3 squid Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2016-2569
  • report
    https://ubuntu.com/security/CVE-2016-2570
  • report
    https://ubuntu.com/security/CVE-2016-2571
  • report
    https://ubuntu.com/security/CVE-2016-3948
  • report
    https://ubuntu.com/security/CVE-2018-1000024
  • report
    https://ubuntu.com/security/CVE-2018-1000027