Bug 580656

Summary:	<net-proxy/squid-3.5.17: multiple buffer overflows + information disclosure (CVE-2016-{4051,4052,4053,4054})
Product:	Gentoo Security	Reporter:	Hanno Böck <hanno>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	eras
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B2 [glsa cve]
Package list:		Runtime testing required:	---
Bug Depends on:	582814
Bug Blocks:	578970

Description Hanno Böck gentoo-dev

2016-04-20 15:59:58 UTC

squid 3.5.16 and below (and also 4.0.8 and below) is affected by multiple security vulnerabilities, see oss-security:
http://www.openwall.com/lists/oss-security/2016/04/20/6

Please bump to 3.5.17. Seems for 4.x there is no fixed upstream release yet.

Comment 1 Eray Aslan gentoo-dev

2016-04-20 19:13:01 UTC

Arches, please test and mark stable
=net-proxy/squid-3.5.17

Target Keywords = alpha amd64 arm hppa ia64 ~mips ppc ppc64 sparc x86 ~x86-fbsd

Comment 2 Jeroen Roovers (RETIRED) gentoo-dev

2016-04-23 10:20:22 UTC

Stable for HPPA PPC64.

Comment 3 Agostino Sarubbo gentoo-dev

2016-04-26 11:20:30 UTC

amd64 stable

Comment 4 Markus Meier gentoo-dev

2016-04-26 17:34:28 UTC

arm stable

Comment 5 Tobias Klausmann (RETIRED) gentoo-dev

2016-05-20 18:27:02 UTC

Stable on alpha.

Comment 6 Eray Aslan gentoo-dev

2016-05-24 07:04:31 UTC

Stabilization continued on security bug #582814

Comment 7 GLSAMaker/CVETool Bot gentoo-dev

2016-06-20 10:03:33 UTC

CVE-2016-4054 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4054):
  Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows
  remote attackers to execute arbitrary code via crafted Edge Side Includes
  (ESI) responses.

CVE-2016-4053 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4053):
  Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to
  obtain sensitive stack layout information via crafted Edge Side Includes
  (ESI) responses, related to incorrect use of assert and compiler
  optimization.

CVE-2016-4052 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4052):
  Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x
  before 4.0.9 allow remote HTTP servers to cause a denial of service or
  execute arbitrary code via crafted Edge Side Includes (ESI) responses.

CVE-2016-4051 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4051):
  Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x
  before 4.0.9 might allow remote attackers to cause a denial of service or
  execute arbitrary code by seeding manager reports with crafted data.

Comment 8 Aaron Bauman (RETIRED) gentoo-dev

2016-06-20 10:08:16 UTC

Added to existing GLSA.

Comment 9 GLSAMaker/CVETool Bot gentoo-dev

2016-07-09 01:52:21 UTC

This issue was resolved and addressed in
 GLSA 201607-01 at https://security.gentoo.org/glsa/201607-01
by GLSA coordinator Aaron Bauman (b-man).