Every CVE Search/ Get API key

CVE-2014-9749

Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow...

4.0 Medium

Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."

Exploit likelihood

11.4%Up 10.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.0

Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."

Record
CVE-2014-9749
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:N/I:P/A:N
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."

Record
CVE-2014-9749
Updated
2026-11-02
EUVDEUVD-2014-9555 No score

Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."

Record
EUVD-2014-9555
Updated
2026-11-03
GitHub AdvisoriesGHSA-4g27-gq63-x5mg No score

Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow...

Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."

Record
GHSA-4g27-gq63-x5mg
Updated
2026-11-02
OSVSUSE-SU-2015:1983-1 No score

Security update for squid

squid was updated to fix two security issues.

These security issues were fixed:

  • CVE-2014-6270: Fixed an off by one in snmp subsystem (bsc#895773).
  • CVE-2014-9749: Fixed a nonce replay vulnerability in Digest authentication (bsc#949942).
Record
SUSE-SU-2015:1983-1
Updated
2026-11-02
OSVSUSE-SU-2017:0110-1 No score

Security update for squid3

This update for squid3 fixes the following issues:

  • CVE-2016-10002: Fixed incorrect processing of responses to If-None-Modified HTTP conditional requests. This allowed responses containing private data to clients it should not have reached (bsc#1016168)
  • CVE-2014-9749: Prevent nonce replay in Digest authentication, preventing the reuse of stale auth tokens (bsc#949942)
Record
SUSE-SU-2017:0110-1
Updated
2026-11-02
OSVSUSE-SU-2017:0116-1 No score

Security update for squid

This update for squid fixes the following issues:

  • CVE-2016-10002: Fixed incorrect processing of responses to If-None-Modified HTTP conditional requests. This allowed responses containing private data to clients it should not have reached (bsc#1016168)
  • CVE-2014-9749: Prevent nonce replay in Digest authentication, preventing the reuse of stale auth tokens (bsc#949942)
Record
SUSE-SU-2017:0116-1
Updated
2026-11-02
OSVSUSE-SU-2017:0128-1 No score

Security update for squid

This update for squid fixes the following issues:

  • CVE-2016-10003: Prevent incorrect forwarding of cached private responses when Collapsed Forwarding feature is enabled. This allowed remote attacker (proxy user) to discover private and sensitive information about another user (bsc#1016169).
  • CVE-2016-10002: Fixed incorrect processing of responses to If-None-Modified HTTP conditional requests. This allowed responses containing private data to clients it should not have reached (bsc#1016168).
  • CVE-2014-9749: Prevent nonce replay in Digest authentication, preventing the reuse of stale auth tokens (bsc#949942).
Record
SUSE-SU-2017:0128-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
squid
SUSE:Linux Enterprise Server 11 SP3
From an advisory covering 2 CVEs
 before 2.7.STABLE5-2.12.24.2
2.7.STABLE5-2.12.24.2
squid
SUSE:Linux Enterprise Server 11 SP3-TERADATA
From an advisory covering 2 CVEs
 before 2.7.STABLE5-2.12.24.2
2.7.STABLE5-2.12.24.2
squid
SUSE:Linux Enterprise Server for SAP Applications 11 SP3
From an advisory covering 2 CVEs
 before 2.7.STABLE5-2.12.24.2
2.7.STABLE5-2.12.24.2
squid
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 2 CVEs
 before 2.7.STABLE5-2.12.24.2
2.7.STABLE5-2.12.24.2
squid
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 2 CVEs
 before 2.7.STABLE5-2.12.24.2
2.7.STABLE5-2.12.24.2
squid3
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 2 CVEs
 before 3.1.23-8.16.36.1
3.1.23-8.16.36.1
squid3
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 2 CVEs
 before 3.1.23-8.16.36.1
3.1.23-8.16.36.1
squid
SUSE:Linux Enterprise Server 12 SP1
From an advisory covering 2 CVEs
 before 3.3.14-22.6.1
3.3.14-22.6.1
squid
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 2 CVEs
 before 3.3.14-22.6.1
3.3.14-22.6.1
squid
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
From an advisory covering 3 CVEs
 before 3.5.21-25.1
3.5.21-25.1
squid
SUSE:Linux Enterprise Server 12 SP2
From an advisory covering 3 CVEs
 before 3.5.21-25.1
3.5.21-25.1
squid
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 3 CVEs
 before 3.5.21-25.1
3.5.21-25.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9749 is a medium vulnerability (CVSS 4.0) in Squid-cache Squid, published November 6, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.4%, the 96th percentile. No source names a fixed version.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open