CVE-2008-1612 The arrayShrink function (lib/Array.c) in Squid 2.6.STABLE17 allows attackers to cause a denial of service (process exit) via unknown vectors that cause an array to shrink to 0 entries, which triggers...
MediumCVSS 4.3
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The arrayShrink function (lib/Array.c) in Squid 2.6.STABLE17 allows attackers to cause a denial of service (process exit) via unknown vectors that cause an array to shrink to 0 entries, which triggers an assert error. NOTE: this issue is due to an incorrect fix for CVE-2007-6239.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| squid | = 2.6.stable17 | No fix listed |
| debian/squid(Debian:12) | < 2.6.18-1 | 2.6.18-1 |
| debian/squid(Debian:13) | < 2.6.18-1 | 2.6.18-1 |
| debian/squid(Debian:14) | < 2.6.18-1 | 2.6.18-1 |
References
- SUSE-SR:2008:011 vendor-advisory
- [squid-announce[ 20080322 Advisory Squid-2007:2 updated mailing-list
- 27477 third-party-advisory
- 29813 third-party-advisory
- 30032 third-party-advisory
- 32109 third-party-advisory
- 34467 third-party-advisory
- GLSA-200903-38 vendor-advisory
- DSA-1646 vendor-advisory
- MDVSA-2008:134 vendor-advisory
- [oss-security] 20080401 CVE id request: squid mailing-list
- RHSA-2008:0214 vendor-advisory
- 28693 vdb-entry
- www.squid-cache.org patch
- www.squid-cache.org exploit
- USN-601-1 vendor-advisory
- squid-arrayshrink-dos(41586) vdb-entry
- oval:org.mitre.oval:def:11376 signature vdb-entry
- FEDORA-2008-2740 vendor-advisory
- Debian Security Tracker CVE-2008-1612 vendor-advisory