1. Home
  2. Security Advisories
  3. SUSE
  4. SUSE-SU-2016:2008-1

[SUSE-SU-2016:2008-1] Security update for squid

Severity Moderate
Affected Packages 3
CVEs 16
Info Packages References Vulnerabilities

Security update for squid

The Squid HTTP proxy has been updated to version 3.3.14, fixing the following
security issues:

  • Fixed multiple Denial of Service issues in HTTP Response processing. (CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393, bsc#968394, bsc#968395)
  • CVE-2016-3947: Buffer overrun issue in pinger ICMPv6 processing. (bsc#973782)
  • CVE-2015-5400: Improper protection of alternate path. (bsc#938715)
  • CVE-2015-3455: Squid http proxy configured with client-first SSL bumping did not correctly validate server certificate. (bsc#929493)
  • CVE-2016-3948: Fixed denial of service in HTTP Response processing (bsc#973783)
  • CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553)
  • CVE-2016-4052, CVE-2016-4053, CVE-2016-4054: Fixed multiple issues in ESI processing (bsc#976556)
  • CVE-2016-4553: Fixed cache poisoning issue in HTTP Request handling (bsc#979009)
  • CVE-2016-4554: Fixed header smuggling issue in HTTP Request processing (bsc#979010)
  • Fixed multiple Denial of Service issues in ESI Response processing. (CVE-2016-4555, CVE-2016-4556, bsc#979011, bsc#979008)

Additionally, the following non-security issues have been fixed:

  • Fix header size in script unsquid.pl. (bsc#902197)
  • Add external helper ext_session_acl to package. (bsc#959290)
  • Update forward_max_tries to permit 25 server paths With cloud sites becoming more popular more CDN servers are producing long lists of IPv6 and IPv4 addresses. If there are not enough paths selected the IPv4 ones may never be reached.
  • squid.init: wait that squid really dies when we kill it on upgrade instead of proclaiming its demise prematurely (bnc#963539)
Package Affected Version
pkg:rpm/suse/squid?arch=x86_64&distro=sles-12&sp=1 < 3.3.14-20.2
pkg:rpm/suse/squid?arch=s390x&distro=sles-12&sp=1 < 3.3.14-20.2
pkg:rpm/suse/squid?arch=ppc64le&distro=sles-12&sp=1 < 3.3.14-20.2
ID
SUSE-SU-2016:2008-1
Severity
moderate
URL
https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/
Published
2016-08-09T11:32:29
(8 years ago)
Modified
2016-08-09T11:32:29
(8 years ago)
Rights
Copyright 2024 SUSE LLC. All rights reserved.
Other Advisories
Source # ID Name URL
Suse SUSE ratings https://www.suse.com/support/security/rating/
Suse URL of this CSAF notice https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_2008-1.json
Suse URL for SUSE-SU-2016:2008-1 https://www.suse.com/support/update/announcement/2016/suse-su-20162008-1/
Suse E-Mail link for SUSE-SU-2016:2008-1 https://lists.suse.com/pipermail/sle-security-updates/2016-August/002194.html
Bugzilla SUSE Bug 902197 https://bugzilla.suse.com/902197
Bugzilla SUSE Bug 929493 https://bugzilla.suse.com/929493
Bugzilla SUSE Bug 938715 https://bugzilla.suse.com/938715
Bugzilla SUSE Bug 955783 https://bugzilla.suse.com/955783
Bugzilla SUSE Bug 959290 https://bugzilla.suse.com/959290
Bugzilla SUSE Bug 963539 https://bugzilla.suse.com/963539
Bugzilla SUSE Bug 968392 https://bugzilla.suse.com/968392
Bugzilla SUSE Bug 968393 https://bugzilla.suse.com/968393
Bugzilla SUSE Bug 968394 https://bugzilla.suse.com/968394
Bugzilla SUSE Bug 968395 https://bugzilla.suse.com/968395
Bugzilla SUSE Bug 973782 https://bugzilla.suse.com/973782
Bugzilla SUSE Bug 973783 https://bugzilla.suse.com/973783
Bugzilla SUSE Bug 976553 https://bugzilla.suse.com/976553
Bugzilla SUSE Bug 976556 https://bugzilla.suse.com/976556
Bugzilla SUSE Bug 979008 https://bugzilla.suse.com/979008
Bugzilla SUSE Bug 979009 https://bugzilla.suse.com/979009
Bugzilla SUSE Bug 979010 https://bugzilla.suse.com/979010
Bugzilla SUSE Bug 979011 https://bugzilla.suse.com/979011
CVE SUSE CVE CVE-2015-3455 page https://www.suse.com/security/cve/CVE-2015-3455/
CVE SUSE CVE CVE-2015-5400 page https://www.suse.com/security/cve/CVE-2015-5400/
CVE SUSE CVE CVE-2016-2569 page https://www.suse.com/security/cve/CVE-2016-2569/
CVE SUSE CVE CVE-2016-2570 page https://www.suse.com/security/cve/CVE-2016-2570/
CVE SUSE CVE CVE-2016-2571 page https://www.suse.com/security/cve/CVE-2016-2571/
CVE SUSE CVE CVE-2016-2572 page https://www.suse.com/security/cve/CVE-2016-2572/
CVE SUSE CVE CVE-2016-3947 page https://www.suse.com/security/cve/CVE-2016-3947/
CVE SUSE CVE CVE-2016-3948 page https://www.suse.com/security/cve/CVE-2016-3948/
CVE SUSE CVE CVE-2016-4051 page https://www.suse.com/security/cve/CVE-2016-4051/
CVE SUSE CVE CVE-2016-4052 page https://www.suse.com/security/cve/CVE-2016-4052/
CVE SUSE CVE CVE-2016-4053 page https://www.suse.com/security/cve/CVE-2016-4053/
CVE SUSE CVE CVE-2016-4054 page https://www.suse.com/security/cve/CVE-2016-4054/
CVE SUSE CVE CVE-2016-4553 page https://www.suse.com/security/cve/CVE-2016-4553/
CVE SUSE CVE CVE-2016-4554 page https://www.suse.com/security/cve/CVE-2016-4554/
CVE SUSE CVE CVE-2016-4555 page https://www.suse.com/security/cve/CVE-2016-4555/
CVE SUSE CVE CVE-2016-4556 page https://www.suse.com/security/cve/CVE-2016-4556/
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/suse/squid?arch=x86_64&distro=sles-12&sp=1 suse squid < 3.3.14-20.2 sles-12 x86_64
Affected pkg:rpm/suse/squid?arch=s390x&distro=sles-12&sp=1 suse squid < 3.3.14-20.2 sles-12 s390x
Affected pkg:rpm/suse/squid?arch=ppc64le&distro=sles-12&sp=1 suse squid < 3.3.14-20.2 sles-12 ppc64le
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date