VulnerabilityModified
CVE-2016-4053
Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.
LOW 3.7EPSS 14.4%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 14.4%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.
- CVSS 3.0
- 3.7 LOWCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 14.36% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- squid-cache/squid · oracle/linux · canonical/ubuntu linux
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
- http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
- http://www.debian.org/security/2016/dsa-3625
- http://www.openwall.com/lists/oss-security/2016/04/20/6Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/04/20/9Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlThird Party Advisory
- http://www.securityfocus.com/bid/86788
- http://www.securityfocus.com/bid/91787Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1035647Third Party Advisory, VDB Entry
- http://www.squid-cache.org/Advisories/SQUID-2016_6.txtVendor Advisory
- http://www.ubuntu.com/usn/USN-2995-1Third Party Advisory
- https://access.redhat.com/errata/RHSA-2016:1138
- https://access.redhat.com/errata/RHSA-2016:1139
- https://access.redhat.com/errata/RHSA-2016:1140
- https://security.gentoo.org/glsa/201607-01
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
- http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
- http://www.debian.org/security/2016/dsa-3625
- http://www.openwall.com/lists/oss-security/2016/04/20/6Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/04/20/9Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlThird Party Advisory
- http://www.securityfocus.com/bid/86788
- http://www.securityfocus.com/bid/91787Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1035647Third Party Advisory, VDB Entry
- http://www.squid-cache.org/Advisories/SQUID-2016_6.txtVendor Advisory
- http://www.ubuntu.com/usn/USN-2995-1Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.