high7.5
CVE-2019-12854
Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory.
Impact
Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Squid-Cache | Squid | from 4.0 through 4.7 |
| Debian | Debian Linux | Version 10.0 |
| Fedoraproject | Fedora | Version 29 |
| Canonical | Ubuntu Linux | Versions 16.04, 18.04, 19.04, 19.10 |
| Opensuse | Leap | Versions 15.0, 15.1 |
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html
- http://www.squid-cache.org/Advisories/SQUID-2019_1.txt
- http://www.squid-cache.org/Versions/v4/changesets/squid-4-2981a957716c61ff7e21eee1d7d6eb5a237e466d.patch
- https://bugs.squid-cache.org/show_bug.cgi?id=4937
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ/
- https://seclists.org/bugtraq/2019/Aug/42
- https://usn.ubuntu.com/4213-1/
- https://www.debian.org/security/2019/dsa-4507
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html
- http://www.squid-cache.org/Advisories/SQUID-2019_1.txt
- http://www.squid-cache.org/Versions/v4/changesets/squid-4-2981a957716c61ff7e21eee1d7d6eb5a237e466d.patch
- https://bugs.squid-cache.org/show_bug.cgi?id=4937
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ/
- https://seclists.org/bugtraq/2019/Aug/42
- https://usn.ubuntu.com/4213-1/
- https://www.debian.org/security/2019/dsa-4507