{"id":"CVE-2011-3205","aliases":["DEBIAN-CVE-2011-3205","DSA-2304-1","EUVD-2011-3169","GHSA-xv7f-73w8-27qj","RHSA-2011:1293","SUSE-SU-2016:2089-1"],"status":"published","title":"Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0...","description":"Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response.  NOTE: This issue exists because of a CVE-2005-0094 regression.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.27454,"percentile":0.98082,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2011-09-06T15:00:00Z","modified":"2026-06-16T23:32:52Z","fixes":[{"ecosystem":"Debian:6.0","package":"squid3","fixed_in":["3.1.6-1.2+squeeze1"],"sources":["osv"]},{"ecosystem":"Debian:5.0","package":"squid3","fixed_in":["3.0.STABLE8-3+lenny5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"squid","fixed_in":["7:3.1.10-1.el6_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"squid-debuginfo","fixed_in":["7:3.1.10-1.el6_1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-1.2+squeeze1"}]}],"versions":["3.1.6-1.2"]},{"source":"osv","ecosystem":"Debian:5.0","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.STABLE8-3+lenny5"}]}],"versions":["3.0.STABLE8-2","3.0.STABLE8-3","3.0.STABLE8-3+lenny1","3.0.STABLE8-3+lenny2","3.0.STABLE8-3+lenny3","3.0.STABLE8-3+lenny4"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.1.10-1.el6_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.1.10-1.el6_1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.23-8.16.30.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.23-8.16.30.1"}]}],"bundled":25}],"products":[{"vendor":"squid-cache","product":"squid"}],"references":[{"url":"http://www.redhat.com/support/errata/RHSA-2011-1293.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://secunia.com/advisories/46029","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/45906","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065534.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00013.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://securitytracker.com/id?1025981","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9193.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10363.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://www.squid-cache.org/Versions/v2/2.HEAD/changesets/12710.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://secunia.com/advisories/45965","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/45805","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.debian.org/security/2011/dsa-2304","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://openwall.com/lists/oss-security/2011/08/30/8","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.squid-cache.org/Advisories/SQUID-2011_3.txt","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00012.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://openwall.com/lists/oss-security/2011/08/29/2","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=734583","tags":["x_refsource_CONFIRM","x_transferred","Patch","report"]},{"url":"http://openwall.com/lists/oss-security/2011/08/30/4","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11294.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://www.securityfocus.com/bid/49356","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.osvdb.org/74847","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://secunia.com/advisories/45920","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2011:150","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-3205","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xv7f-73w8-27qj"},{"url":"https://access.redhat.com/errata/RHSA-2011:1293","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1293.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-3205","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-3205","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/895773","tags":["report"]},{"url":"https://bugzilla.suse.com/902197","tags":["report"]},{"url":"https://bugzilla.suse.com/938715","tags":["report"]},{"url":"https://bugzilla.suse.com/963539","tags":["report"]},{"url":"https://bugzilla.suse.com/967011","tags":["report"]},{"url":"https://bugzilla.suse.com/968392","tags":["report"]},{"url":"https://bugzilla.suse.com/968393","tags":["report"]},{"url":"https://bugzilla.suse.com/968394","tags":["report"]},{"url":"https://bugzilla.suse.com/968395","tags":["report"]},{"url":"https://bugzilla.suse.com/973782","tags":["report"]},{"url":"https://bugzilla.suse.com/973783","tags":["report"]},{"url":"https://bugzilla.suse.com/976553","tags":["report"]},{"url":"https://bugzilla.suse.com/976556","tags":["report"]},{"url":"https://bugzilla.suse.com/976708","tags":["report"]},{"url":"https://bugzilla.suse.com/979008","tags":["report"]},{"url":"https://bugzilla.suse.com/979009","tags":["report"]},{"url":"https://bugzilla.suse.com/979010","tags":["report"]},{"url":"https://bugzilla.suse.com/979011","tags":["report"]},{"url":"https://bugzilla.suse.com/993299","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4556","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2011-3205","description":"Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response.  NOTE: This issue exists because of a CVE-2005-0094 regression.","status":"published","published":"2011-09-06T15:00:00Z","modified":"2024-08-06T23:29:55.437Z","updated_at":"2026-11-02T14:35:37.324501Z"}],"euvd":[{"id":"EUVD-2011-3169","description":"Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response.  NOTE: This issue exists because of a CVE-2005-0094 regression.","status":"published","published":"2011-09-06T15:00:00Z","modified":"2024-08-06T23:29:55Z","updated_at":"2026-11-03T01:39:52.582864Z"}],"ghsa":[{"id":"GHSA-xv7f-73w8-27qj","title":"Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0...","description":"Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response.  NOTE: This issue exists because of a CVE-2005-0094 regression.","status":"published","published":"2022-05-17T03:46:34Z","modified":"2023-01-27T05:08:37Z","updated_at":"2026-11-02T14:43:19.500885Z"}],"nvd":[{"id":"CVE-2011-3205","description":"Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response.  NOTE: This issue exists because of a CVE-2005-0094 regression.","status":"published","published":"2011-09-06T15:55:08.383Z","modified":"2026-06-16T23:32:52.45Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:09.988332Z"}],"osv":[{"id":"DSA-2304-1","title":"squid3 - buffer overflow","status":"published","published":"2011-09-11T00:00:00Z","modified":"2026-03-09T01:20:18.732354Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"RHSA-2011:1293","title":"Red Hat Security Advisory: squid security update","status":"published","published":"2024-09-15T19:26:23Z","modified":"2025-11-22T10:33:15Z","updated_at":"2026-11-02T15:53:01.003286Z"},{"id":"SUSE-SU-2016:2089-1","title":"Security update for squid3","description":"\n\nThis update for squid3 fixes the following issues:\n\n- Multiple issues in pinger ICMP processing.  (CVE-2014-7141, CVE-2014-7142) \n\n- CVE-2016-3947: Buffer overrun issue in pinger\n    ICMPv6 processing. (bsc#973782)\n\n-  CVE-2016-4554: fix header smuggling issue in HTTP Request processing (bsc#979010)\n\n- Fix multiple Denial of Service issues in HTTP Response processing.\n    (CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572,\n     bsc#968392, bsc#968393, bsc#968394, bsc#968395)\n- Regression caused by the DoS fixes above (bsc#993299)\n\n- CVE-2016-3948: Fix denial of service in HTTP Response processing (bsc#973783)\n\n- CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553)\n\n- CVE-2016-4052, CVE-2016-4053, CVE-2016-4054:\n  * fixes multiple issues in ESI processing (bsc#976556)\n\n- CVE-2016-4556: fixes double free vulnerability in Esi.cc (bsc#979008)\n\n- CVE-2015-5400: Improper Protection of Alternate Path (bsc#938715)\n\n- CVE-2014-6270: fix off-by-one in snmp subsystem (bsc#895773)\n\n- Memory leak in squid3 when using external_acl (bsc#976708)\n","status":"published","published":"2016-08-16T12:56:03Z","modified":"2026-02-04T03:13:42.545823Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}