CVE-2010-3072
The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2...
CVE-2010-3072 is a medium vulnerability (CVSS 5.0) in Squid-cache Squid, published September 19, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 59.9%, the 99th percentile. Fixed in squid3 3.0.STABLE8-3+lenny4.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 59.9%EPSS, 99th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.0.STABLE8-3+lenny4squid3 +4 more
Description
The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squid3Debian:5.0 | before 3.0.STABLE8-3+lenny4, plus listed versions 3.0.STABLE8-23.0.STABLE8-33.0.STABLE8-3+lenny13.0.STABLE8-3+lenny23.0.STABLE8-3+lenny3 | 3.0.STABLE8-3+lenny4 |
squidRed Hat:enterprise_linux:6::server | before 7:3.1.10-1.el6 | 7:3.1.10-1.el6 |
squid-debuginfoRed Hat:enterprise_linux:6::server | before 7:3.1.10-1.el6 | 7:3.1.10-1.el6 |
squidRed Hat:enterprise_linux:6::workstation | before 7:3.1.10-1.el6 | 7:3.1.10-1.el6 |
squid-debuginfoRed Hat:enterprise_linux:6::workstation | before 7:3.1.10-1.el6 | 7:3.1.10-1.el6 |
What each source reports
NVD Score used
The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
- Record
CVE-2010-3072- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE ListNo score
The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
- Record
CVE-2010-3072- Updated
- 2026-11-02
EUVDEUVD-2010-3074No score
The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
- Record
EUVD-2010-3074- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-744h-wcjj-gwrfNo score
The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2...
The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
- Record
GHSA-744h-wcjj-gwrf- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.fedoraproject.org/pipermail/package-announce/2010-September/047820.html
openwall.com/lists/oss-security/2010/09/05/2
bugzilla.redhat.com/show_bug.cgi?id=630444
secunia.com/advisories/41298
vupen.com/english/advisories/2010/2433
Show 18 moreShow less
squid-cache.org/Advisories/SQUID-2010_3.txt
debian.org/security/2010/dsa-2111
securityfocus.com/bid/42982
lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
nvd.nist.gov/vuln/detail/CVE-2010-3072
github.com/advisories/GHSA-744h-wcjj-gwrf
access.redhat.com/errata/RHSA-2011:0545
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0545.json
cve.org/CVERecord?id=CVE-2010-3072