Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | alpine-linux-upgrade-squid | Aug 30, 2017 | Apr 7, 2016 |
| Amazon_linux | — | amazon-linux-upgrade-squid | Jun 15, 2016 | Apr 25, 2016 |
| Centos_linux | — | centos-upgrade-squidcentos-upgrade-squid-sysvinitcentos-upgrade-squid34 | May 31, 2016 | Apr 25, 2016 |
| Debian | debian-upgrade-squid3 | Jul 22, 2016 | Apr 25, 2016 | |
| Freebsd | freebsd-upgrade-package-squid | Dec 10, 2025 | Apr 21, 2016 | |
| Gentoo Linux | gentoo-linux-upgrade-net-proxy-squid | Oct 30, 2017 | Apr 25, 2016 | |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-squid | Nov 30, 2017 | Apr 25, 2016 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-entire-11-4-11-4-0-0-1-15-0 | Oct 19, 2018 | Apr 25, 2016 | |
| Oracle_linux | — | oracle-linux-upgrade-squidoracle-linux-upgrade-squid34oracle-linux-upgrade-squid-sysvinit | May 31, 2016 | Apr 25, 2016 |
| Redhat_linux | — | redhat-upgrade-squidredhat-upgrade-squid-debuginforedhat-upgrade-squid-sysvinitredhat-upgrade-squid34redhat-upgrade-squid34-debuginfo | Jun 1, 2016 | Apr 25, 2016 |
| Suse | — | suse-upgrade-squidsuse-upgrade-squid3 | Aug 26, 2016 | Apr 25, 2016 |
| Ubuntu | ubuntu-upgrade-squid-cgiubuntu-upgrade-squid3 | Jun 9, 2016 | Apr 25, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub