CVE-2012-5643
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3...
CVE-2012-5643 is a medium vulnerability (CVSS 5.0) in Squid-cache Squid, published December 20, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 23.0%, the 97th percentile. Fixed in squid 2.7.STABLE9-2.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 23.0%EPSS, 97th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.7.STABLE9-2squid +10 more
Description
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squidDebian:12 | before 2.7.STABLE9-2 | 2.7.STABLE9-2 |
squidDebian:13 | before 2.7.STABLE9-2 | 2.7.STABLE9-2 |
squidDebian:14 | before 2.7.STABLE9-2 | 2.7.STABLE9-2 |
squid3Debian:6.0 From an advisory covering 2 CVEs | before 3.1.6-1.2+squeeze3, plus listed versions 3.1.6-1.23.1.6-1.2+squeeze13.1.6-1.2+squeeze2 | 3.1.6-1.2+squeeze3 |
squidRed Hat:enterprise_linux:6::server | before 7:3.1.10-16.el6 | 7:3.1.10-16.el6 |
squid-debuginfoRed Hat:enterprise_linux:6::server | before 7:3.1.10-16.el6 | 7:3.1.10-16.el6 |
squidRed Hat:enterprise_linux:6::workstation | before 7:3.1.10-16.el6 | 7:3.1.10-16.el6 |
squid-debuginfoRed Hat:enterprise_linux:6::workstation | before 7:3.1.10-16.el6 | 7:3.1.10-16.el6 |
squid3SUSE:Linux Enterprise Server 11 SP4 From an advisory covering 25 CVEs | before 3.1.23-8.16.30.1 | 3.1.23-8.16.30.1 |
squid3SUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 25 CVEs | before 3.1.23-8.16.30.1 | 3.1.23-8.16.30.1 |
squidopenSUSE:Tumbleweed From an advisory covering 4 CVEs | before 3.5.22-1.1 | 3.5.22-1.1 |
What each source reports
NVD Score used
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
- Record
CVE-2012-5643- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
- Record
CVE-2012-5643- Updated
- 2026-11-02
EUVDEUVD-2012-5527No score
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
- Record
EUVD-2012-5527- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pq8w-rcmc-8xgjNo score
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3...
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
- Record
GHSA-pq8w-rcmc-8xgj- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVNo score
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
- Record
CVE-2012-5643- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-5643No score
Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
- Record
DEBIAN-CVE-2012-5643- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10307-1No score
squid-3.5.22-1.1 on GA media
These are all security issues fixed in the squid-3.5.22-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10307-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:2089-1No score
Security update for squid3
This update for squid3 fixes the following issues:
Multiple issues in pinger ICMP processing. (CVE-2014-7141, CVE-2014-7142)
CVE-2016-3947: Buffer overrun issue in pinger ICMPv6 processing. (bsc#973782)
CVE-2016-4554: fix header smuggling issue in HTTP Request processing (bsc#979010)
Fix multiple Denial of Service issues in HTTP Response processing. (CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393, bsc#968394, bsc#968395)
Regression caused by the DoS fixes above (bsc#993299)
CVE-2016-3948: Fix denial of service in HTTP Response processing (bsc#973783)
CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553)
CVE-2016-4052, CVE-2016-4053, CVE-2016-4054:
- fixes multiple issues in ESI processing (bsc#976556)
CVE-2016-4556: fixes double free vulnerability in Esi.cc (bsc#979008)
CVE-2015-5400: Improper Protection of Alternate Path (bsc#938715)
CVE-2014-6270: fix off-by-one in snmp subsystem (bsc#895773)
Memory leak in squid3 when using external_acl (bsc#976708)
- Record
SUSE-SU-2016:2089-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
debian.org/security/2013/dsa-2631
rhn.redhat.com/errata/RHSA-2013-0505.html
mandriva.com/security/advisories?name=MDVSA-2013:129
securitytracker.com/id?1027890
squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10479.patch
lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
Show 74 moreShow less
openwall.com/lists/oss-security/2012/12/17/4
secunia.com/advisories/52024
bugzilla.redhat.com/show_bug.cgi?id=887962
bugs.gentoo.org/show_bug.cgi?id=447596
wiki.mageia.org/en/Support/Advisories/MGASA-2012-0368
ubuntu.com/usn/usn-1713-1
nvd.nist.gov/vuln/detail/CVE-2012-5643
access.redhat.com/errata/RHSA-2013:0505
github.com/advisories/GHSA-pq8w-rcmc-8xgj
security-tracker.debian.org/tracker/CVE-2012-5643
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0505.json
cve.org/CVERecord?id=CVE-2012-5643
suse.com/support/update/announcement/2016/suse-su-20162089-1
bugzilla.suse.com/895773