Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -3 articles for you...
217
security advisoryDoS threatsquid updateOracle Linux 9 ELSA-2022-5527: Important Squid DoS Security Fix
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2022-5527 https://linux.oracle.com/errata/ELSA-2022-5527.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: squid-5.2-1.el9_0.1.x86_64.rpm aarch64: squid-5.2-1.el9_0.1.aarch64.rpm SRPMS: https://oss.oracle.com:443/ol9/SRPMS-updates/squid-5.2-1.el9_0.1.src.rpm Related CVEs: CVE-2021-46784 Description of changes: [7:5.2-1.1] - Resolves: #2100784 - CVE-2021-46784 squid: DoS when processing gopher server responses _______________________________________________ El-errata mailing list
Jul 07, 2022
•Important
Oracle
100
security advisorycritical issuesoftware patchSUSE Linux Enterprise Server 12-SP5: Critical Squid Vulnerability Advisory
An update that fixes four vulnerabilities is now available. . SUSE Security Update: Security update for squid ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:2443-1 Rating: critical References: #1173455 #1175664 #1175665 #1175671 Cross-References: CVE-2020-15049 CVE-2020-15810 CVE-2020-15811 CVE-2020-24606 Affected Products: SUSE Linux Enterprise Server 12-SP5 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for squid fixes the following issues: squid was updated to version 4.13: - CVE-2020-24606: Fix livelocking in peerDigestHandleReply (bsc#1175671). - CVE-2020-15811: Improve Transfer-Encoding handling (bsc#1175665). - CVE-2020-15810: Enforce token characters for field-name (bsc#1175664). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP5: zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-2443=1 Package List: - SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64): squid-4.13-4.15.1 squid-debuginfo-4.13-4.15.1 squid-debugsource-4.13-4.15.1 References: https://www.suse.com/security/cve/CVE-2020-15049.html https://www.suse.com/security/cve/CVE-2020-15810.html https://www.suse.com/security/cve/CVE-2020-15811.html https://www.suse.com/security/cve/CVE-2020-24606.html https://bugzilla.suse.com/1173455 https://bugzilla.suse.com/1175664 https://bugzilla.suse.com/1175665 https://bugzilla.suse.com/1175671 _______________________________________________ sle-security-updates mailinglist
Sep 02, 2020
•Critical
SuSE
98
security advisorybuffer overflowRed Hat Enterprise LinuxRed Hat Enterprise Linux 6 RHSA-2011-1293-01 Messaging: Squid Bug Fix
An updated squid package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: squid security update Advisory ID: RHSA-2011:1293-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2011:1293.html Issue date: 2011-09-14 CVE Names: CVE-2011-3205 ==================================================================== 1. Summary: An updated squid package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 3. Description: Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. A buffer overflow flaw was found in the way Squid parsed replies from remote Gopher servers. A remote user allowed to send Gopher requests to a Squid proxy could possibly use this flaw to cause the squid child process to crash or execute arbitrary code with the privileges of the squid user, by making Squid perform a request to an attacker-controlled Gopher server. (CVE-2011-3205) Users of squid should upgrade to this updated package, which contains a backported patch to correct this issue. After installing this update, the squid service will be restarted automatically. 4. Solution: Before applying this update, makesure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 734583 - CVE-2011-3205 squid: buffer overflow flaw in Squid's Gopher reply parser (SQUID-2011:3) 6. Package List: Red Hat Enterprise Linux Server (v. 6): Source: i386: squid-3.1.10-1.el6_1.1.i686.rpm squid-debuginfo-3.1.10-1.el6_1.1.i686.rpm ppc64: squid-3.1.10-1.el6_1.1.ppc64.rpm squid-debuginfo-3.1.10-1.el6_1.1.ppc64.rpm s390x: squid-3.1.10-1.el6_1.1.s390x.rpm squid-debuginfo-3.1.10-1.el6_1.1.s390x.rpm x86_64: squid-3.1.10-1.el6_1.1.x86_64.rpm squid-debuginfo-3.1.10-1.el6_1.1.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: i386: squid-3.1.10-1.el6_1.1.i686.rpm squid-debuginfo-3.1.10-1.el6_1.1.i686.rpm x86_64: squid-3.1.10-1.el6_1.1.x86_64.rpm squid-debuginfo-3.1.10-1.el6_1.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2011-3205 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFOcPqzXlSAg2UNWIIRAutlAJ9nlG0w3FNBVqFtxSNe10FKir/WkACeNQAA rDOr/svPTfi23jLvkODeYbk=0hIH -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Sep 14, 2011
Red Hat
98
security advisorysecurity issueRed HatRed Hat 7: RHSA-2022:4567-02 Important: Apache Security Vulnerability
An updated squid package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Moderate: squid security update Advisory ID: RHSA-2011:1293-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2011:1293.html Issue date: 2011-09-14 CVE Names: CVE-2011-3205 ==================================================================== 1. Summary: An updated squid package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 3. Description: Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. A buffer overflow flaw was found in the way Squid parsed replies from remote Gopher servers. A remote user allowed to send Gopher requests to a Squid proxy could possibly use this flaw to cause the squid child process to crash or execute arbitrary code with the privileges of the squid user, by making Squid perform a request to an attacker-controlled Gopher server. (CVE-2011-3205) Users of squid should upgrade to this updated package, which contains a backported patch to correct this issue. After installing this update, the squid service will be restarted automatically. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via theRed Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 734583 - CVE-2011-3205 squid: buffer overflow flaw in Squid's Gopher reply parser (SQUID-2011:3) 6. Package List: Red Hat Enterprise Linux Server (v. 6): Source: i386: squid-3.1.10-1.el6_1.1.i686.rpm squid-debuginfo-3.1.10-1.el6_1.1.i686.rpm ppc64: squid-3.1.10-1.el6_1.1.ppc64.rpm squid-debuginfo-3.1.10-1.el6_1.1.ppc64.rpm s390x: squid-3.1.10-1.el6_1.1.s390x.rpm squid-debuginfo-3.1.10-1.el6_1.1.s390x.rpm x86_64: squid-3.1.10-1.el6_1.1.x86_64.rpm squid-debuginfo-3.1.10-1.el6_1.1.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: i386: squid-3.1.10-1.el6_1.1.i686.rpm squid-debuginfo-3.1.10-1.el6_1.1.i686.rpm x86_64: squid-3.1.10-1.el6_1.1.x86_64.rpm squid-debuginfo-3.1.10-1.el6_1.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2011-3205 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2011 Red Hat, Inc. . Get informed on the latest Red Hat advisory regarding a significant Squid update addressing a potential buffer overflow vulnerability. Ensure your systems remain secure!. Red Hat, Squid Update, Buffer Overflow Fix, Security Advisory, Software Patch. . LinuxSecurity.com Team
Sep 14, 2011
Red Hat
98
security advisoryDoS issuebug fixRed Hat: RHSA-2011-0545 Low Severity Squid DoS Vulnerability Fixed
An updated squid package that fixes one security issue and two bugs is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Low: squid security and bug fix update Advisory ID: RHSA-2011:0545-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2011:0545.html Issue date: 2011-05-19 CVE Names: CVE-2010-3072 ==================================================================== 1. Summary: An updated squid package that fixes one security issue and two bugs is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 3. Description: Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. It was found that string comparison functions in Squid did not properly handle the comparisons of NULL and empty strings. A remote, trusted web client could use this flaw to cause the squid daemon to crash via a specially-crafted request. (CVE-2010-3072) This update also fixes the following bugs: * A small memory leak in Squid caused multiple "ctx: enter level" messages to be logged to "/var/log/squid/cache.log". This update resolves the memory leak. (BZ#666533) * This erratum upgrades Squid to upstream version 3.1.10. This upgraded version supports the Google Instant service and introducesvarious code improvements. (BZ#639365) Users of squid should upgrade to this updated package, which resolves these issues. After installing this update, the squid service will be restarted automatically. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 630444 - CVE-2010-3072 Squid: Denial of service due internal error in string handling (SQUID-2010:3) 639365 - Rebase squid to version 3.1.10 666533 - small memleak in squid-3.1.4 6. Package List: Red Hat Enterprise Linux Server (v. 6): Source: i386: squid-3.1.10-1.el6.i686.rpm squid-debuginfo-3.1.10-1.el6.i686.rpm ppc64: squid-3.1.10-1.el6.ppc64.rpm squid-debuginfo-3.1.10-1.el6.ppc64.rpm s390x: squid-3.1.10-1.el6.s390x.rpm squid-debuginfo-3.1.10-1.el6.s390x.rpm x86_64: squid-3.1.10-1.el6.x86_64.rpm squid-debuginfo-3.1.10-1.el6.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: i386: squid-3.1.10-1.el6.i686.rpm squid-debuginfo-3.1.10-1.el6.i686.rpm x86_64: squid-3.1.10-1.el6.x86_64.rpm squid-debuginfo-3.1.10-1.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2010-3072 https://access.redhat.com/security/updates/classification/#low 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFN1QoVXlSAg2UNWIIRAus+AJ9KG64p9VxJTdV0rL1nV2EmGfd1dgCeJv+d n0b5YLJ5FOoorECMonve9XE=r2vM -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
May 19, 2011
•Low
Red Hat
98
security advisoryRed Hat LinuxDoS issueRed Hat Linux 7.2 RHSA-2002:029-09 Critical: Squid DoS Issues
New squid packages are available that fix various vulnerabilities. Some ofthese vulnerabilities could be used to perform a denial of service (DoS)attack or allow remote users to execute code as the user squid.. ` --------------------------------------------------------------------- Red Hat, Inc. Red Hat Security Advisory Synopsis: New squid packages available Advisory ID: RHSA-2002:029-09 Issue date: 2002-02-19 Updated on: 2002-02-26 Product: Red Hat Linux Keywords: squid ftp htcp snmp Cross references: Obsoletes: RHSA-2001:113 --------------------------------------------------------------------- 1. Topic: New squid packages are available that fix various vulnerabilities. Some of these vulnerabilities could be used to perform a denial of service (DoS) attack or allow remote users to execute code as the user squid. 2. Relevant releases/architectures: Red Hat Linux 6.2 - alpha, i386, sparc Red Hat Linux 7.0 - alpha, i386 Red Hat Linux 7.1 - alpha, i386, ia64 Red Hat Linux 7.2 - i386, ia64 3. Problem description: Squid is a high-performance proxy caching server. Various security issues have been found in Squid up to and including version 2.4.STABLE2. These were: - a memory leak in the SNMP code - a crash on specially-formatted data in FTP URL parsing - HTCP would still be active, even if it was disabled in the config file These errata pacakges contain Squid version 2.4.STABLE3, which is not vulnerable to these issues. It is recommended that all users of Squid update to the fixed packages. Note: SNMP support is disabled in the default configuration of these packages (it was previously enabled). If you need SNMP support, edit your squid configuration and change the 'snmp_port' option; the default port for SNMP enabled-squid is 3401. Thanks go to Jouko Pynnonen for notifying us of the FTP vulnerability and to the Squid team for providing patches. The Common Vulnerabilities and Exposures project (cve.mitre.org)has assigned the names CAN-2002-0067, CAN-2002-0068, CAN-2002-0069 to these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed ( for more info): 6. RPMs required: Red Hat Linux 6.2: SRPMS: alpha: i386: sparc: Red Hat Linux 7.0: SRPMS: alpha: i386: Red Hat Linux 7.1: SRPMS: alpha: i386: ia64: Red Hat Linux 7.2: SRPMS: i386: ia64: 7. Verification: MD5 sum Package Name -------------------------------------------------------------------------- b3d4d0c9e53b01c19f700df9ce17d0e5 6.2/en/os/SRPMS/squid-2.4.STABLE3-1.6.2.src.rpm 17ef449e9a97d10cdbc3d120fdb50f2c 6.2/en/os/alpha/squid-2.4.STABLE3-1.6.2.alpha.rpm c84cd128b04cb373fe32d7b2288db841 6.2/en/os/i386/squid-2.4.STABLE3-1.6.2.i386.rpm 9264d770d126b5b33cf9dd428bf1db14 6.2/en/os/sparc/squid-2.4.STABLE3-1.6.2.sparc.rpm 21dfdf2375a15cddcc51a2aaec7ca651 7.0/en/os/SRPMS/squid-2.4.STABLE3-1.7.0.src.rpm 40996e76071a5d4680a1d90335dd87e2 7.0/en/os/alpha/squid-2.4.STABLE3-1.7.0.alpha.rpm 0417cdb61da2d5d28da0d995976dce1d 7.0/en/os/i386/squid-2.4.STABLE3-1.7.0.i386.rpm 953d1e9e04b2a9efb94e4e74a99167a37.1/en/os/SRPMS/squid-2.4.STABLE3-1.7.1.src.rpm 61ad76cb69e47540ffe127b7dff99e5a 7.1/en/os/alpha/squid-2.4.STABLE3-1.7.1.alpha.rpm 7061c04ab2a0e97a284ced5a98bd2877 7.1/en/os/i386/squid-2.4.STABLE3-1.7.1.i386.rpm ae562f0cc3db33cfb6c1a64612aa26bb 7.1/en/os/ia64/squid-2.4.STABLE3-1.7.1.ia64.rpm 72d271f03bf9fee7dc9ba2d4f94269d4 7.2/en/os/SRPMS/squid-2.4.STABLE3-1.7.2.src.rpm 0f8a1132399b4f149426c34f9203030f 7.2/en/os/i386/squid-2.4.STABLE3-1.7.2.i386.rpm bdaa724f704c4f0f0530a19dd7081cac 7.2/en/os/ia64/squid-2.4.STABLE3-1.7.2.ia64.rpm These packages are GPG signed by Red Hat, Inc. for security. Our key is available at: About You can verify each package with the following command: rpm --checksig If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg 8. References: Squid-2.4 Patches CVE -CVE-2002-0067 CVE -CVE-2002-0068 CVE -CVE-2002-0069 Copyright(c) 2000, 2001 Red Hat, Inc. `. Red Hat announces new versions of squid software, addressing multiple vulnerabilities that might lead to service disruptions and allow unauthorized remote code execution.. Red Hat Security, Squid Update, DoS Issues, Remote Code Exploits, Security Patches. . Severity: Critical. LinuxSecurity.com Team
Feb 26, 2002
•Critical
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!