此 squid3 更新可修正下列問題：

- pinger ICMP 處理過程中的多個問題。
 (CVE-2014-7141、CVE-2014-7142)

- CVE-2016-3947：pinger ICMPv6 處理過程中存在緩衝區滿溢問題。(bsc#973782)

- CVE-2016-4554：修正 HTTP 要求處理過程中的標頭走私問題 (bsc#979010)

- 修正 HTTP 回應處理過程中的多個拒絕服務問題。(CVE-2016-2569、CVE-2016-2570、CVE-2016-2571、CVE-2016-2572、bsc#968392、bsc#968393、bsc#968394、bsc#968395)

- CVE-2016-3948：修正 HTTP 回應處理過程中的拒絕服務 (bsc#973783)

- CVE-2016-4051：已修正 cachemgr.cgi 中的緩衝區溢位 (bsc#976553)

- CVE-2016-4052、CVE-2016-4053、CVE-2016-4054：

- 修正 ESI 處理過程中的多個問題 (bsc#976556)

- CVE-2016-4556：修正 Esi.cc 中的重複釋放弱點 (bsc#979008)

- CVE-2015-5400：不當保護替代路徑 (bsc#938715)

- CVE-2014-6270：修正 snmp 子系統中的差一問題 (bsc#895773)

- 使用 external_acl 時 squid3 中發生的記憶體洩漏 (bsc#976708)

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

Versions of Squid 3.5.x prior to 3.5.17 are affected by multiple vulnerabilities :

 - A flaw in 'esi/Esi.cc' is triggered as input is not properly validated when handling ESI responses. This may allow a remote attacker to disclose the server stack layout.
 - An overflow condition in 'esi/Esi.cc' is triggered as user-supplied input is not properly validated when handling ESI responses. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - An assertion flaw in 'esi/Esi.cc' is triggered as input is not properly validated when handling ESI responses. This may allow a remote attacker to terminate the service.
 - An overflow condition is triggered as user-supplied input is not properly validated when processing the length of content lines in reports by the 'cachemgr.cgi' tool. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.

The specific version of Squid that the system is running is reportedly affected by the following vulnerabilities:

- Squid contains a flaw in esi/Esi.cc that is triggered as input is not properly validated when handling ESI responses. This may allow a remote attacker to disclose the server stack layout. (CVE-2016-4053)

- Squid contains an overflow condition in esi/Esi.cc that is triggered as user-supplied input is not properly validated when handling ESI responses. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-4054)

- Squid contains an assertion flaw in esi/Esi.cc that is triggered as input is not properly validated when handling ESI responses. This may allow a remote attacker to terminate the service. (CVE-2016-4052)

- Squid contains an overflow condition that is triggered as user-supplied input is not properly validated when processing the length of content lines in reports by the cachemgr.cgi tool. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-4051)

ID	名稱	產品	系列	已發布	已更新	嚴重性
93271	SUSE SLES11 安全性更新：squid3 (SUSE-SU-2016:1996-1)	Nessus	SuSE Local Security Checks	2016/9/2	2021/1/19	high
9775	Squid 3.5.x < 3.5.17 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2016/11/11	2019/3/6	medium
802013	Squid < 3.5.17, 4.0.9 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	2016/8/29		high

偵測

搜尋 Plugin

high

medium

high