CVE-2012-5643

Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.

Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.

Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.

Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.

Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.

Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.

These are all security issues fixed in the squid-3.5.22-1.1 package on the GA media of openSUSE Tumbleweed.

This update for squid3 fixes the following issues:

• Multiple issues in pinger ICMP processing. (CVE-2014-7141, CVE-2014-7142)

• CVE-2016-3947: Buffer overrun issue in pinger ICMPv6 processing. (bsc#973782)

• CVE-2016-4554: fix header smuggling issue in HTTP Request processing (bsc#979010)

• Fix multiple Denial of Service issues in HTTP Response processing. (CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393, bsc#968394, bsc#968395)

• Regression caused by the DoS fixes above (bsc#993299)

• CVE-2016-3948: Fix denial of service in HTTP Response processing (bsc#973783)

• CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553)

• CVE-2016-4052, CVE-2016-4053, CVE-2016-4054:

  • fixes multiple issues in ESI processing (bsc#976556)

• CVE-2016-4556: fixes double free vulnerability in Esi.cc (bsc#979008)

• CVE-2015-5400: Improper Protection of Alternate Path (bsc#938715)

• CVE-2014-6270: fix off-by-one in snmp subsystem (bsc#895773)

• Memory leak in squid3 when using external_acl (bsc#976708)