squid-3.5.20-2.el7
エラータID: AXSA:2016-905:02
Squid is a high-performance proxy caching server for Web clients,
supporting FTP, gopher, and HTTP data objects. Unlike traditional
caching software, Squid handles all requests in a single,
non-blocking, I/O-driven process. Squid keeps meta data and especially
hot objects cached in RAM, caches DNS lookups, supports non-blocking
DNS lookups, and implements negative caching of failed requests.
Squid consists of a main server program squid, a Domain Name System
lookup program (dnsserver), a program for retrieving FTP data
(ftpget), and some management and client tools.
Security issues fixed with this release:
CVE-2016-2569
Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append
data to String objects, which allows remote servers to cause a denial
of service (assertion failure and daemon exit) via a long string, as
demonstrated by a crafted HTTP Vary header.
CVE-2016-2570
The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x
before 4.0.7 does not check buffer limits during XML parsing, which
allows remote HTTP servers to cause a denial of service (assertion
failure and daemon exit) via a crafted XML document, related to
esi/CustomParser.cc and esi/CustomParser.h.
CVE-2016-2571
http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with
the storage of certain data after a response-parsing failure, which
allows remote HTTP servers to cause a denial of service (assertion
failure and daemon exit) via a malformed response.
CVE-2016-2572
http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after
a response-parsing failure, which allows remote HTTP servers to cause
a denial of service (assertion failure and daemon exit) via a
malformed response.
CVE-2016-3948
Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds
checking, which allows remote attackers to cause a denial of service
via a crafted HTTP response, related to Vary headers.
The following packages have been upgraded to a newer upstream version: squid (3.5.20).
Additional Changes:
Update packages.
Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.
The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h.
http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.
http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.
Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP response, related to Vary headers.
N/A
SRPMS
- squid-3.5.20-2.el7.src.rpm
MD5: 81008a21bd4238627ce7b08d25019f95
SHA-256: 5df10a89f0567d2eeaed2015b5aa0f9ee9ac5f0af394f8cba136af398c88c08c
Size: 2.29 MB
Asianux Server 7 for x86_64
- squid-3.5.20-2.el7.x86_64.rpm
MD5: 64fe8717a21286df2a84dacb5090e6f1
SHA-256: e9b47d34d90afdffe459fd5d4d6cefb562f656c00106d5db1db113375b9b2c85
Size: 2.96 MB - squid-migration-script-3.5.20-2.el7.x86_64.rpm
MD5: 595b8d70780591ab4b846f009ccac078
SHA-256: 7c054751101fc47fa5e754a01bb026024ff81854b1d3a4f057277184e40e9dd6
Size: 46.43 kB
日本語