Squid vulnerabilities

A double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.

The mime_header.cc file in Squid before version 3.5.18 contains a vulnerability that allows remote attackers to bypass intended same-origin restrictions and potentially conduct cache-poisoning attacks via a crafted HTTP Host header, known as a 'header smuggling' issue.

The client_side.cc file in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when an absolute URI is provided, allowing remote attackers to conduct cache-poisoning attacks.

A buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.

Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses.

Squid versions 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, allowing remote attackers to cause a denial of service via a crafted HTTP response related to Vary headers.

In Squid 3.x before version 3.5.15 and 4.x before version 4.0.7, http.cc continues to store data after a response-parsing failure. This allows remote HTTP servers to cause a denial of service by sending a malformed response.

Squid versions 3.x before 3.5.15 and 4.x before 4.0.7 do not properly append data to String objects, allowing remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to improper enforcement of behavioral workflow, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding, accepting the prohibited 'Transfer-Encoding: identity' form.

Squid versions prior to 7.5 contain a heap Use-After-Free vulnerability in ICP traffic handling, allowing a remote attacker to perform a reliable and repeatable Denial of Service attack. The attack requires ICP support enabled (non-zero `icp_port`) and cannot be mitigated by `icp_access` rules.

Squid versions prior to 7.5 have a vulnerability due to premature resource release and heap Use-After-Free bugs, allowing a DoS attack via ICP traffic. This affects only deployments with ICP explicitly enabled (non-zero `icp_port`).

In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. A script can bypass browser security protections and learn the credentials a trusted client uses to authenticate, potentially allowing a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. The vulnerability does not require Squid to be configured with HTTP authentication and is fixed in version 7.2.

Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.

Squid versions prior to 7.6 contain a heap-based buffer overflow vulnerability in cache digest reply handling. The flaw is due to improper input validation of the on-the-wire size of a cache digest, which may exceed the declared mask_size.

Squid versions prior to 7.6 have an out-of-bounds read vulnerability in the FTP gateway. Improper validation of directory listing date syntax may allow a trusted client to read memory from unrelated transactions.