Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE-request(?): squid: buffer overflow in Gopher reply parser
From: Vincent Danen <vdanen () redhat com>
Date: Tue, 30 Aug 2011 12:11:46 -0600

* [2011-08-29 13:48:17 +0200] Matthias Weckbecker wrote:


squid 3.x seems to have re-introduced a security issue found by Ben Hawkes of
the Google Security Team in 2005,

 2011: http://www.squid-cache.org/Advisories/SQUID-2011_3.txt
 2005: http://www.squid-cache.org/Advisories/SQUID-2005_1.txt (CVE-2005-0094)

Will there be a new CVE required? Not quite sure how such "special" cases are
handled usually.

Does anyone know when this was re-introduced?  The upstream advisory
indicates all 3.0 releases are affected, but doesn't indicate if 2.x
(after 2.5.STABLE7) was at any point vulnerable.

Vincent Danen / Red Hat Security Response Team

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]