CVE-2014-7142
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or...
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
Exploit likelihood
What each source reports
NVD Score used
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
- Record
CVE-2014-7142- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
- Record
CVE-2014-7142- Updated
- 2026-11-02
EUVDEUVD-2014-7021 No score
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
- Record
EUVD-2014-7021- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rrff-4cvp-7q5p No score
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or...
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
- Record
GHSA-rrff-4cvp-7q5p- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
- Record
CVE-2014-7142- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-7142 No score
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
- Record
DEBIAN-CVE-2014-7142- Updated
- 2026-11-02
Show 5 moreShow less
OSVMGASA-2014-0396 No score
Updated squid packages fix security vulnerabilities
Updated squid packages fix security vulnerabilities:
Due to incorrect buffer management Squid can be caused by an attacker to write outside its allocated SNMP buffer (CVE-2014-6270).
Due to incorrect bounds checking Squid pinger binary is vulnerable to denial of service or information leak attack when processing larger than normal ICMP or ICMPv6 packets (CVE-2014-7141).
Due to incorrect input validation Squid pinger binary is vulnerable to denial of service or information leak attacks when processing ICMP or ICMPv6 packets (CVE-2014-7142).
- Record
MGASA-2014-0396- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10307-1 No score
squid-3.5.22-1.1 on GA media
These are all security issues fixed in the squid-3.5.22-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10307-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:2089-1 No score
Security update for squid3
This update for squid3 fixes the following issues:
-
Multiple issues in pinger ICMP processing. (CVE-2014-7141, CVE-2014-7142)
-
CVE-2016-3947: Buffer overrun issue in pinger ICMPv6 processing. (bsc#973782)
-
CVE-2016-4554: fix header smuggling issue in HTTP Request processing (bsc#979010)
-
Fix multiple Denial of Service issues in HTTP Response processing. (CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393, bsc#968394, bsc#968395)
-
Regression caused by the DoS fixes above (bsc#993299)
-
CVE-2016-3948: Fix denial of service in HTTP Response processing (bsc#973783)
-
CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553)
-
CVE-2016-4052, CVE-2016-4053, CVE-2016-4054:
- fixes multiple issues in ESI processing (bsc#976556)
-
CVE-2016-4556: fixes double free vulnerability in Esi.cc (bsc#979008)
-
CVE-2015-5400: Improper Protection of Alternate Path (bsc#938715)
-
CVE-2014-6270: fix off-by-one in snmp subsystem (bsc#895773)
-
Memory leak in squid3 when using external_acl (bsc#976708)
- Record
SUSE-SU-2016:2089-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-7142 No score
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.
- Record
UBUNTU-CVE-2014-7142- Updated
- 2026-11-02
OSVUSN-2422-1 No score
squid3 vulnerabilities
Sebastian Krahmer discovered that the Squid pinger incorrectly handled certain malformed ICMP packets. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service.
- Record
USN-2422-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squidDebian:12 |
before 4.1-1 | 4.1-1 |
squidDebian:13 |
before 4.1-1 | 4.1-1 |
squidDebian:14 |
before 4.1-1 | 4.1-1 |
squidMageia:3 From an advisory covering 3 CVEs |
before 3.2.10-1.8.mga3 | 3.2.10-1.8.mga3 |
squidMageia:4 From an advisory covering 3 CVEs |
before 3.3.13-1.1.mga4 | 3.3.13-1.1.mga4 |
squid3SUSE:Linux Enterprise Server 11 SP4 From an advisory covering 25 CVEs |
before 3.1.23-8.16.30.1 | 3.1.23-8.16.30.1 |
squid3SUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 25 CVEs |
before 3.1.23-8.16.30.1 | 3.1.23-8.16.30.1 |
squid3Ubuntu:14.04:LTS |
before 3.3.8-1ubuntu6.2, plus listed versions 3.3.8-1ubuntu33.3.8-1ubuntu43.3.8-1ubuntu53.3.8-1ubuntu63.3.8-1ubuntu6.1 |
3.3.8-1ubuntu6.2 |
squid3Ubuntu:14.04:LTS From an advisory covering 2 CVEs |
before 3.3.8-1ubuntu6.2, plus listed versions 3.3.8-1ubuntu33.3.8-1ubuntu43.3.8-1ubuntu53.3.8-1ubuntu63.3.8-1ubuntu6.1 |
3.3.8-1ubuntu6.2 |
squidopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 3.5.22-1.1 | 3.5.22-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-7142 is a medium vulnerability (CVSS 6.4) in Squid-cache Squid, published September 23, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 24.9%, the 97th percentile. Fixed in squid 4.1-1.
References
squid-cache.org/Advisories/SQUID-2014_4.txt
lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
secunia.com/advisories/60242
bugzilla.novell.com/show_bug.cgi?id=891268
seclists.org/oss-sec/2014/q3/613
Show 60 moreShow less
securityfocus.com/bid/70022
ubuntu.com/usn/usn-2422-1
nvd.nist.gov/vuln/detail/CVE-2014-7142
github.com/advisories/GHSA-rrff-4cvp-7q5p
security-tracker.debian.org/tracker/CVE-2014-7142
advisories.mageia.org/MGASA-2014-0396.html
bugs.mageia.org/show_bug.cgi?id=14150
suse.com/support/update/announcement/2016/suse-su-20162089-1
bugzilla.suse.com/895773
cve.org/CVERecord?id=CVE-2014-7142