CVE-2007-6239 The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP header...
MediumCVSS 5.0
EPSS 26.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| squid web proxy cache | = 2.0_patch2 | No fix listed |
| squid web proxy cache | = 2.1_patch2 | No fix listed |
| squid web proxy cache | = 2.3.stable4 | No fix listed |
| squid web proxy cache | = 2.3.stable5 | No fix listed |
| squid web proxy cache | = 2.4_stable2 | No fix listed |
| squid web proxy cache | = 2.4_stable4 | No fix listed |
| squid web proxy cache | = 2.4_stable6 | No fix listed |
| squid web proxy cache | = 2.4_stable7 | No fix listed |
| squid web proxy cache | = 2.5.stable11 | No fix listed |
| squid web proxy cache | = 2.5.stable12 | No fix listed |
| squid web proxy cache | = 2.5.stable13 | No fix listed |
| squid web proxy cache | = 2.5.stable14 | No fix listed |
| squid web proxy cache | = 2.5_.stable9 | No fix listed |
| squid web proxy cache | = 2.5_stable1 | No fix listed |
| squid web proxy cache | = 2.5_stable3 | No fix listed |
| squid web proxy cache | = 2.5_stable4 | No fix listed |
| squid web proxy cache | = 2.5_stable5 | No fix listed |
| squid web proxy cache | = 2.5_stable6 | No fix listed |
| squid web proxy cache | = 2.5_stable7 | No fix listed |
| squid web proxy cache | = 2.5_stable8 | No fix listed |
| squid web proxy cache | = 2.5_stable10 | No fix listed |
| squid web proxy cache | = 2.6 | No fix listed |
| squid web proxy cache | = 2.6.stable1 | No fix listed |
| squid web proxy cache | = 2.6.stable2 | No fix listed |
| squid web proxy cache | = 2.6.stable3 | No fix listed |
Show 16 more
| Product | Affected versions | Fixed in |
|---|---|---|
| squid web proxy cache | = 2.6.stable4 | No fix listed |
| squid web proxy cache | = 2.6.stable5 | No fix listed |
| squid web proxy cache | = 2.6.stable6 | No fix listed |
| squid web proxy cache | = 2.6.stable7 | No fix listed |
| squid web proxy cache | = 2.6.stable12 | No fix listed |
| squid web proxy cache | = 2.6.stable13 | No fix listed |
| squid web proxy cache | = 2.6.stable14 | No fix listed |
| squid web proxy cache | = 2.6.stable15 | No fix listed |
| squid web proxy cache | = 2.6.stable16 | No fix listed |
| squid web proxy cache | = 3.0 | No fix listed |
| squid web proxy cache | = 3.0_pre1 | No fix listed |
| squid web proxy cache | = 3.0_pre2 | No fix listed |
| squid web proxy cache | = 3.0_pre3 | No fix listed |
| debian/squid(Debian:12) | < 2.6.17-1 | 2.6.17-1 |
| debian/squid(Debian:13) | < 2.6.17-1 | 2.6.17-1 |
| debian/squid(Debian:14) | < 2.6.17-1 | 2.6.17-1 |
References
- bugs.gentoo.org
- SUSE-SR:2008:001 vendor-advisory
- 27910 patch third-party-advisory vendor-advisory
- 28091 third-party-advisory vendor-advisory
- 28109 third-party-advisory vendor-advisory
- 28350 third-party-advisory vendor-advisory
- 28381 third-party-advisory vendor-advisory
- 28403 third-party-advisory vendor-advisory
- 28412 third-party-advisory vendor-advisory
- 28814 third-party-advisory vendor-advisory
- 34467 third-party-advisory vendor-advisory
- GLSA-200801-05 vendor-advisory
- GLSA-200903-38 vendor-advisory
- DSA-1482 patch vendor-advisory
- VU#232881 third-party-advisory us-government-resource
- MDVSA-2008:002 vendor-advisory
- RHSA-2007:1130 patch vendor-advisory
- 26687 patch vdb-entry
- 1019036 vdb-entry
- www.squid-cache.org patch vendor-advisory
- www.squid-cache.org exploit vendor-advisory
- USN-565-1 vendor-advisory
- ADV-2007-4066 vdb-entry vendor-advisory
- bugzilla.redhat.com
- oval:org.mitre.oval:def:10915 signature vdb-entry
- FEDORA-2007-4170 vendor-advisory
- FEDORA-2007-4161 vendor-advisory
- Debian Security Tracker CVE-2007-6239 vendor-advisory
- bugs.debian.org issue-tracking