CVE-2016-4053
Fixed in a distro release EPSS 14%
Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.
Products: squid-cache squid, oracle linux, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 7 | squid3 | 3.1.20-2.2+deb7u5 |
| Debian 8 | squid3 | 3.4.8-6+deb8u3 |
| Red Hat Enterprise Linux 6 | squid | 7:3.1.23-16.el6_8.4 |
| Red Hat Enterprise Linux 6 | squid-debuginfo | 7:3.1.23-16.el6_8.4 |
| Red Hat Enterprise Linux 6 | squid34 | 7:3.4.14-9.el6_8.3 |
| Red Hat Enterprise Linux 6 | squid34-debuginfo | 7:3.4.14-9.el6_8.3 |
| Red Hat Enterprise Linux 7 | squid | 7:3.3.8-26.el7_2.3 |
| Red Hat Enterprise Linux 7 | squid-debuginfo | 7:3.3.8-26.el7_2.3 |
| Red Hat Enterprise Linux 7 | squid-sysvinit | 7:3.3.8-26.el7_2.3 |
| SUSE Linux Enterprise Server 11 SP4 | squid3 | 3.1.23-8.16.30.1 |
| SUSE Linux Enterprise Server 12 SP1 | squid | 3.3.14-20.2 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | squid3 | 3.1.23-8.16.30.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | squid | 3.3.14-20.2 |
| Ubuntu 14.04 LTS | squid3 | 3.3.8-1ubuntu6.8 |
| Ubuntu 16.04 LTS | squid3 | 3.5.12-1ubuntu7.2 |