{"id":"CVE-2019-12527","aliases":["ALSA-2019:2593","DEBIAN-CVE-2019-12527","DSA-4507-1","EUVD-2019-4122","GHSA-8x4r-gffh-rx7f","MGASA-2019-0266","RHSA-2019:2593","RLSA-2019:2593","SUSE-SU-2019:2975-1","openSUSE-SU-2019:2540-1","openSUSE-SU-2019:2541-1","openSUSE-SU-2024:11403-1"],"status":"published","title":"An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with...","description":"An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.50299,"percentile":0.9892,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2019-07-11T18:10:16Z","modified":"2026-10-29T11:00:07Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"libecap","fixed_in":["1.0.1-2.module_el8.6.0+2741+01592ae8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libecap-devel","fixed_in":["1.0.1-2.module_el8.6.0+2741+01592ae8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"squid","fixed_in":["4.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"squid","fixed_in":["4.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"squid","fixed_in":["4.8-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap","fixed_in":["0:1.0.1-2.module+el8.0.0+4045+70edde92"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-debuginfo","fixed_in":["0:1.0.1-2.module+el8.0.0+4045+70edde92"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-debugsource","fixed_in":["0:1.0.1-2.module+el8.0.0+4045+70edde92"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-devel","fixed_in":["0:1.0.1-2.module+el8.0.0+4045+70edde92"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid","fixed_in":["7:4.4-5.module+el8.0.0+4045+70edde92"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid-debuginfo","fixed_in":["7:4.4-5.module+el8.0.0+4045+70edde92"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid-debugsource","fixed_in":["7:4.4-5.module+el8.0.0+4045+70edde92"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libecap","fixed_in":["0:1.0.1-2.module+el8.4.0+404+316a0dc5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"libecap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2.module_el8.6.0+2741+01592ae8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libecap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2.module_el8.6.0+2741+01592ae8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u1"}]}],"versions":["4.6-1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:7","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-1.mga7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.0.0+4045+70edde92"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.0.0+4045+70edde92"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.0.0+4045+70edde92"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.0.0+4045+70edde92"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4-5.module+el8.0.0+4045+70edde92"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4-5.module+el8.0.0+4045+70edde92"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4-5.module+el8.0.0+4045+70edde92"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libecap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.4.0+404+316a0dc5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-5.11.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-5.11.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-lp150.13.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-lp151.2.7.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16-1.5"}]}],"bundled":40}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"squid-cache","product":"squid"}],"references":[{"url":"http://www.squid-cache.org/Versions/v4/changesets/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/squid-cache/squid/commits/v4","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.squid-cache.org/Versions/v4/changesets/squid-4-7f73e9c5d17664b882ed32590e6af310c247f320.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/109143","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://usn.ubuntu.com/4065-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.debian.org/security/2019/dsa-4507","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Aug/42","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2593","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12527","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ/"},{"url":"https://github.com/advisories/GHSA-8x4r-gffh-rx7f"},{"url":"https://errata.almalinux.org/8/ALSA-2019-2593.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-12527","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-12527","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0266.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25110","tags":["report"]},{"url":"https://usn.ubuntu.com/4059-1/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1730533","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2593.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-12527","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12527","tags":["advisory"]},{"url":"http://www.squid-cache.org/Advisories/SQUID-2019_5.txt","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2019:2593","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192975-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1133089","tags":["report"]},{"url":"https://bugzilla.suse.com/1140738","tags":["report"]},{"url":"https://bugzilla.suse.com/1141329","tags":["report"]},{"url":"https://bugzilla.suse.com/1141330","tags":["report"]},{"url":"https://bugzilla.suse.com/1141332","tags":["report"]},{"url":"https://bugzilla.suse.com/1141442","tags":["report"]},{"url":"https://bugzilla.suse.com/1156323","tags":["report"]},{"url":"https://bugzilla.suse.com/1156324","tags":["report"]},{"url":"https://bugzilla.suse.com/1156326","tags":["report"]},{"url":"https://bugzilla.suse.com/1156328","tags":["report"]},{"url":"https://bugzilla.suse.com/1156329","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3688","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5B7VIBHEUXO2VYU6NZTEL6I7K4WUKD7G/#5B7VIBHEUXO2VYU6NZTEL6I7K4WUKD7G","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2PLGSQEPKZX62EREA7UHDNEMHR3Z23A6/#2PLGSQEPKZX62EREA7UHDNEMHR3Z23A6","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31806","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-12527","description":"An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.","status":"published","published":"2019-07-11T18:10:16Z","modified":"2024-08-04T23:24:38.676Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-4122","description":"An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.","status":"published","published":"2019-07-11T18:10:16Z","modified":"2024-08-04T23:24:38Z","updated_at":"2026-11-03T02:40:45.434408Z"}],"ghsa":[{"id":"GHSA-8x4r-gffh-rx7f","title":"An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with...","description":"An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.","status":"published","published":"2022-05-24T16:50:06Z","modified":"2023-03-08T05:05:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:54:17.182344Z"}],"nvd":[{"id":"CVE-2019-12527","description":"An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.","status":"published","published":"2019-07-11T19:15:13.097Z","modified":"2026-06-17T02:14:49.787Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:05:19.195714Z"}],"osv":[{"id":"CVE-2019-12527","description":"An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.","status":"published","published":"2019-07-11T19:15:13.097Z","modified":"2026-10-20T10:51:36.674801259Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"DEBIAN-CVE-2019-12527","description":"An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.","status":"published","published":"2019-07-11T19:15:13.097Z","modified":"2026-09-21T07:01:48.050108492Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"RHSA-2019:2593","title":"Red Hat Security Advisory: squid:4 security update","status":"published","published":"2024-09-16T02:51:19Z","modified":"2025-11-22T11:47:27Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RLSA-2019:2593","title":"Important: squid:4 security update","description":"Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nSecurity Fix(es):\n\n* squid: heap-based buffer overflow in HttpHeader::getAuth (CVE-2019-12527)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2019-09-02T10:22:04Z","modified":"2026-02-05T08:15:12.003988Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"ALSA-2019:2593","title":"Important: squid:4 security update","description":"Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nSecurity Fix(es):\n\n* squid: heap-based buffer overflow in HttpHeader::getAuth (CVE-2019-12527)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2019-09-02T10:22:04Z","modified":"2026-10-29T11:00:07.718061421Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DSA-4507-1","title":"squid - security update","status":"published","published":"2019-08-24T00:00:00Z","modified":"2026-03-09T02:10:22.063474Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0266","title":"Updated squid packages fix security vulnerabilities","description":"Updated squid packages fix security vulnerabilities:\n\nIt was discovered that Squid incorrectly handled Digest authentication.\nA remote attacker could possibly use this issue to cause Squid to crash,\nresulting in a denial of service (CVE-2019-12525).\n\nIt was discovered that Squid incorrectly handled Basic authentication.\nA remote attacker could use this issue to cause Squid to crash, resulting\nin a denial of service, or possibly execute arbitrary code (CVE-2019-12527).\n\nIt was discovered that Squid incorrectly handled Basic authentication.\nA remote attacker could possibly use this issue to cause Squid to crash,\nresulting in a denial of service (CVE-2019-12529).\n\nDue to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7\nmay access unallocated memory. On systems with memory access protections,\nthis can cause the CGI process to terminate unexpectedly, resulting in a\ndenial of service for all clients using it (CVE-2019-12854).\n\nIt was discovered that Squid incorrectly handled the cachemgr.cgi web\nmodule. A remote attacker could possibly use this issue to conduct\ncross-site scripting (XSS) attacks (CVE-2019-13345).\n\nThe squid package has been updated to version 4.8, fixing these issues and\nother bugs.\n","status":"published","published":"2019-09-12T19:09:52Z","modified":"2026-04-16T04:44:43.56211036Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:2540-1","title":"Security update for squid","description":"This update for squid to version 4.9 fixes the following issues:\n\nSecurity issues fixed: \n\n- CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).\n- CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).\n- CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).\n- CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).\n- CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).\n- CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).\n\nOther issues addressed:\n\n * Fixed DNS failures when peer name was configured with any upper case characters\n * Fixed several rock cache_dir corruption issues\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-11-21T13:25:53Z","modified":"2026-02-04T03:02:00.221686Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2019:2541-1","title":"Security update for squid","description":"This update for squid to version 4.9 fixes the following issues:\n\nSecurity issues fixed: \n\n- CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).\n- CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).\n- CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).\n- CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).\n- CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).\n- CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).\n\nOther issues addressed:\n\n * Fixed DNS failures when peer name was configured with any upper case characters\n * Fixed several rock cache_dir corruption issues\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-11-21T13:26:12Z","modified":"2026-02-04T03:23:00.068716Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11403-1","title":"squid-4.16-1.5 on GA media","description":"These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:28:26.444707Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:2975-1","title":"Security update for squid","description":"This update for squid to version 4.9 fixes the following issues:\n\nSecurity issues fixed: \n\n- CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).\n- CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).\n- CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).\n- CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).\n- CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).\n- CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).\n\nOther issues addressed:\n\n * Fixed DNS failures when peer name was configured with any upper case characters\n * Fixed several rock cache_dir corruption issues\n","status":"published","published":"2019-11-14T16:02:41Z","modified":"2026-02-04T03:09:27.896801Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}