CVE-2019-12854

Description

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.

References

http://www.squid-cache.org/Versions/v4/changesets/squid-4-2981a957716c61ff7e21eee1d7d6eb5a237e466d.patch

https://bugs.squid-cache.org/show_bug.cgi?id=4937

https://lists.fedoraproject.org/archives/list/[email protected]/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ/

http://www.squid-cache.org/Advisories/SQUID-2019_1.txt

https://www.debian.org/security/2019/dsa-4507

https://seclists.org/bugtraq/2019/Aug/42

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html

https://usn.ubuntu.com/4213-1/

Details

Risk Information

CVSS v2

CVSS v3