Security update for squid SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2016:2081-1 Final 1 1 2016-08-16T09:13:13Z current 2016-08-16T09:13:13Z 2016-08-16T09:13:13Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for squid The Squid HTTP proxy has been updated to version 3.3.14, fixing the following security issues: - Fixed multiple Denial of Service issues in HTTP Response processing. (CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393, bsc#968394, bsc#968395) - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6 processing. (bsc#973782) - CVE-2015-5400: Improper protection of alternate path. (bsc#938715) - CVE-2015-3455: Squid http proxy configured with client-first SSL bumping did not correctly validate server certificate. (bsc#929493) - CVE-2016-3948: Fixed denial of service in HTTP Response processing (bsc#973783) - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553) - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054: Fixed multiple issues in ESI processing (bsc#976556) - CVE-2016-4553: Fixed cache poisoning issue in HTTP Request handling (bsc#979009) - CVE-2016-4554: Fixed header smuggling issue in HTTP Request processing (bsc#979010) - Fixed multiple Denial of Service issues in ESI Response processing. (CVE-2016-4555, CVE-2016-4556, bsc#979011, bsc#979008) Additionally, the following non-security issues have been fixed: - Fix header size in script unsquid.pl. (bsc#902197) - Add external helper ext_session_acl to package. (bsc#959290) - Update forward_max_tries to permit 25 server paths With cloud sites becoming more popular more CDN servers are producing long lists of IPv6 and IPv4 addresses. If there are not enough paths selected the IPv4 ones may never be reached. - squid.init: wait that squid really dies when we kill it on upgrade instead of proclaiming its demise prematurely (bnc#963539) This update was imported from the SUSE:SLE-12:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html E-Mail link for openSUSE-SU-2016:2081-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.1 squid-3.3.14-6.1 squid-3.3.14-6.1 as a component of openSUSE Leap 42.1 Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate. CVE-2015-3455 openSUSE Leap 42.1:squid-3.3.14-6.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2015-3455.html CVE-2015-3455 https://bugzilla.suse.com/929493 SUSE Bug 929493 Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request. CVE-2015-5400 openSUSE Leap 42.1:squid-3.3.14-6.1 moderate 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2015-5400.html CVE-2015-5400 https://bugzilla.suse.com/938715 SUSE Bug 938715 https://bugzilla.suse.com/967073 SUSE Bug 967073 Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header. CVE-2016-2569 openSUSE Leap 42.1:squid-3.3.14-6.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2016-2569.html CVE-2016-2569 https://bugzilla.suse.com/968392 SUSE Bug 968392 https://bugzilla.suse.com/968393 SUSE Bug 968393 The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h. CVE-2016-2570 openSUSE Leap 42.1:squid-3.3.14-6.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2016-2570.html CVE-2016-2570 https://bugzilla.suse.com/968392 SUSE Bug 968392 https://bugzilla.suse.com/968393 SUSE Bug 968393 http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response. CVE-2016-2571 openSUSE Leap 42.1:squid-3.3.14-6.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2016-2571.html CVE-2016-2571 https://bugzilla.suse.com/968394 SUSE Bug 968394 https://bugzilla.suse.com/968395 SUSE Bug 968395 http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response. CVE-2016-2572 openSUSE Leap 42.1:squid-3.3.14-6.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2016-2572.html CVE-2016-2572 https://bugzilla.suse.com/968394 SUSE Bug 968394 https://bugzilla.suse.com/968395 SUSE Bug 968395 Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 allows remote servers to cause a denial of service (performance degradation or transition failures) or write sensitive information to log files via an ICMPv6 packet. CVE-2016-3947 openSUSE Leap 42.1:squid-3.3.14-6.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2016-3947.html CVE-2016-3947 https://bugzilla.suse.com/973782 SUSE Bug 973782 Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP response, related to Vary headers. CVE-2016-3948 openSUSE Leap 42.1:squid-3.3.14-6.1 moderate 2.9 AV:A/AC:M/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2016-3948.html CVE-2016-3948 https://bugzilla.suse.com/973783 SUSE Bug 973783 Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data. CVE-2016-4051 openSUSE Leap 42.1:squid-3.3.14-6.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2016-4051.html CVE-2016-4051 https://bugzilla.suse.com/976553 SUSE Bug 976553 Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses. CVE-2016-4052 openSUSE Leap 42.1:squid-3.3.14-6.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2016-4052.html CVE-2016-4052 https://bugzilla.suse.com/976556 SUSE Bug 976556 Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization. CVE-2016-4053 openSUSE Leap 42.1:squid-3.3.14-6.1 important 5 AV:N/AC:L/Au:N/C:P/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2016-4053.html CVE-2016-4053 https://bugzilla.suse.com/976556 SUSE Bug 976556 Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses. CVE-2016-4054 openSUSE Leap 42.1:squid-3.3.14-6.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2016-4054.html CVE-2016-4054 https://bugzilla.suse.com/976556 SUSE Bug 976556 client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request. CVE-2016-4553 openSUSE Leap 42.1:squid-3.3.14-6.1 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2016-4553.html CVE-2016-4553 https://bugzilla.suse.com/979009 SUSE Bug 979009 https://bugzilla.suse.com/990451 SUSE Bug 990451 mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue. CVE-2016-4554 openSUSE Leap 42.1:squid-3.3.14-6.1 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2016-4554.html CVE-2016-4554 https://bugzilla.suse.com/979010 SUSE Bug 979010 https://bugzilla.suse.com/990451 SUSE Bug 990451 client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses. CVE-2016-4555 openSUSE Leap 42.1:squid-3.3.14-6.1 moderate 6 AV:N/AC:M/Au:S/C:P/I:P/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2016-4555.html CVE-2016-4555 https://bugzilla.suse.com/979008 SUSE Bug 979008 https://bugzilla.suse.com/979011 SUSE Bug 979011 Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response. CVE-2016-4556 openSUSE Leap 42.1:squid-3.3.14-6.1 moderate 6 AV:N/AC:M/Au:S/C:P/I:P/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html https://www.suse.com/security/cve/CVE-2016-4556.html CVE-2016-4556 https://bugzilla.suse.com/979008 SUSE Bug 979008 https://bugzilla.suse.com/979011 SUSE Bug 979011