Fedora 31: FEDORA-2019-9538783033 Moderate: Squid Buffer Overflow Issues

Squid is a high-performance proxy caching server for Web clients,

supporting FTP, gopher, and HTTP data objects. Unlike traditional

caching software, Squid handles all requests in a single,

non-blocking, I/O-driven process. Squid keeps meta data and especially

hot objects cached in RAM, caches DNS lookups, supports non-blocking

DNS lookups, and implements negative caching of failed requests.

Squid consists of a main server program squid, a Domain Name System

lookup program (dnsserver), a program for retrieving FTP data

(ftpget), and some management and client tools.

New version update - squid 4.9

* Mon Nov 11 2019 Lubos Uhliarik - 7:4.9-2

- new version 4.9

- verify src taball signature by default in prep section

* Tue Oct 8 2019 Lubos Uhliarik - 7:4.8-6

- Resolves: #1741342 - Do not call autoconf at build time

* Tue Oct 8 2019 Lubos Uhliarik - 7:4.8-5

- Resolves: #1716950 - Drop "sleep 1" from logrotate fragment

* Thu Aug 22 2019 Lubomir Rintel - 7:4.8-4

- Move the NetworkManager dispatcher script out of /etc

[ 1 ] Bug #1770350 - CVE-2019-18678 squid: HTTP Request Splitting issue in HTTP message processing [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1770350

[ 2 ] Bug #1770367 - CVE-2019-18677 squid: Cross-Site Request Forgery issue in HTTP Request processing [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1770367

[ 3 ] Bug #1770361 - CVE-2019-18679 squid: Information Disclosure issue in HTTP Digest Authentication [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1770361

[ 4 ] Bug #1770376 - CVE-2019-18676 squid: Buffer overflow in URI processor [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1770376

[ 5 ] Bug #1770357 - CVE-2019-12526 squid: Heap overflow issue in URN processing [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1770357

[ 6 ] Bug #1770372 - CVE-2019-12523 squid: Improper input validation in URI processor [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1770372

su -c 'dnf upgrade --advisory FEDORA-2019-9538783033' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/