CVE-2016-4054: Buffer Overflow
Published Apr 25, 2016
·Updated
Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.
Affected Software
146 affected components
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=15.10
Canonical Ubuntu Linux=16.04
Squid-Cache Squid=3.0
Squid-Cache Squid=3.1
Squid-Cache Squid=3.1.0.1
Squid-Cache Squid=3.1.0.2
Squid-Cache Squid=3.1.0.3
Squid-Cache Squid=3.1.0.4
Squid-Cache Squid=3.1.0.5
Squid-Cache Squid=3.1.0.6
Squid-Cache Squid=3.1.0.7
Squid-Cache Squid=3.1.0.8
Squid-Cache Squid=3.1.0.9
Squid-Cache Squid=3.1.0.10
Squid-Cache Squid=3.1.0.11
Squid-Cache Squid=3.1.0.12
Squid-Cache Squid=3.1.0.13
Squid-Cache Squid=3.1.0.14
Squid-Cache Squid=3.1.0.15
Squid-Cache Squid=3.1.0.16
Squid-Cache Squid=3.1.0.17
Squid-Cache Squid=3.1.0.18
Squid-Cache Squid=3.1.1
Squid-Cache Squid=3.1.2
Squid-Cache Squid=3.1.3
Squid-Cache Squid=3.1.4
Squid-Cache Squid=3.1.5
Squid-Cache Squid=3.1.5.1
Squid-Cache Squid=3.1.6
Squid-Cache Squid=3.1.7
Squid-Cache Squid=3.1.8
Squid-Cache Squid=3.1.9
Squid-Cache Squid=3.1.10
Squid-Cache Squid=3.1.11
Squid-Cache Squid=3.1.12
Squid-Cache Squid=3.1.12.1
Squid-Cache Squid=3.1.12.2
Squid-Cache Squid=3.1.12.3
Squid-Cache Squid=3.1.13
Squid-Cache Squid=3.1.14
Squid-Cache Squid=3.1.15
Squid-Cache Squid=3.1.16
Squid-Cache Squid=3.1.17
Squid-Cache Squid=3.1.18
Squid-Cache Squid=3.1.19
Squid-Cache Squid=3.1.20
Squid-Cache Squid=3.1.21
Squid-Cache Squid=3.1.22
Squid-Cache Squid=3.2.0.1
Squid-Cache Squid=3.2.0.2
Squid-Cache Squid=3.2.0.3
Squid-Cache Squid=3.2.0.4
Squid-Cache Squid=3.2.0.5
Squid-Cache Squid=3.2.0.6
Squid-Cache Squid=3.2.0.7
Squid-Cache Squid=3.2.0.8
Squid-Cache Squid=3.2.0.9
Squid-Cache Squid=3.2.0.10
Squid-Cache Squid=3.2.0.11
Squid-Cache Squid=3.2.0.12
Squid-Cache Squid=3.2.0.13
Squid-Cache Squid=3.2.0.14
Squid-Cache Squid=3.2.0.15
Squid-Cache Squid=3.2.0.16
Squid-Cache Squid=3.2.0.17
Squid-Cache Squid=3.2.0.18
Squid-Cache Squid=3.2.0.19
Squid-Cache Squid=3.2.1
Squid-Cache Squid=3.2.2
Squid-Cache Squid=3.2.3
Squid-Cache Squid=3.2.4
Squid-Cache Squid=3.2.5
Squid-Cache Squid=3.2.6
Squid-Cache Squid=3.2.7
Squid-Cache Squid=3.2.8
Squid-Cache Squid=3.2.9
Squid-Cache Squid=3.2.10
Squid-Cache Squid=3.2.11
Squid-Cache Squid=3.2.12
Squid-Cache Squid=3.2.13
Squid-Cache Squid=3.3.0
Squid-Cache Squid=3.3.0.1
Squid-Cache Squid=3.3.0.2
Squid-Cache Squid=3.3.0.3
Squid-Cache Squid=3.3.1
Squid-Cache Squid=3.3.2
Squid-Cache Squid=3.3.3
Squid-Cache Squid=3.3.4
Squid-Cache Squid=3.3.5
Squid-Cache Squid=3.3.6
Squid-Cache Squid=3.3.7
Squid-Cache Squid=3.3.8
Squid-Cache Squid=3.3.9
Squid-Cache Squid=3.3.10
Squid-Cache Squid=3.3.11
Squid-Cache Squid=3.3.12
Squid-Cache Squid=3.3.13
Squid-Cache Squid=3.3.14
Squid-Cache Squid=3.4.0.1
Squid-Cache Squid=3.4.0.2
Squid-Cache Squid=3.4.0.3
Squid-Cache Squid=3.4.1
Squid-Cache Squid=3.4.2
Squid-Cache Squid=3.4.3
Squid-Cache Squid=3.4.4
Squid-Cache Squid=3.4.4.1
Squid-Cache Squid=3.4.4.2
Squid-Cache Squid=3.4.8
Squid-Cache Squid=3.4.9
Squid-Cache Squid=3.4.10
Squid-Cache Squid=3.4.11
Squid-Cache Squid=3.4.12
Squid-Cache Squid=3.4.13
Squid-Cache Squid=3.4.14
Squid-Cache Squid=3.5.0.1
Squid-Cache Squid=3.5.0.2
Squid-Cache Squid=3.5.0.3
Squid-Cache Squid=3.5.0.4
Squid-Cache Squid=3.5.1
Squid-Cache Squid=3.5.2
Squid-Cache Squid=3.5.3
Squid-Cache Squid=3.5.4
Squid-Cache Squid=3.5.5
Squid-Cache Squid=3.5.6
Squid-Cache Squid=3.5.7
Squid-Cache Squid=3.5.8
Squid-Cache Squid=3.5.9
Squid-Cache Squid=3.5.10
Squid-Cache Squid=3.5.11
Squid-Cache Squid=3.5.12
Squid-Cache Squid=3.5.13
Squid-Cache Squid=3.5.14
Squid-Cache Squid=3.5.15
Squid-Cache Squid=3.5.16
Squid-Cache Squid=4.0.1
Squid-Cache Squid=4.0.2
Squid-Cache Squid=4.0.3
Squid-Cache Squid=4.0.4
Squid-Cache Squid=4.0.5
Squid-Cache Squid=4.0.6
Squid-Cache Squid=4.0.7
Squid-Cache Squid=4.0.8
Oracle Linux=6
Oracle Linux=7
Event History
Apr 25, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-4054?
CVE-2016-4054 has been classified as a medium severity vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2016-4054?
To fix CVE-2016-4054, upgrade Squid to version 3.5.17 or 4.0.9 or later.
3
What causes CVE-2016-4054?
CVE-2016-4054 is caused by a buffer overflow in Squid due to mishandling of crafted Edge Side Includes (ESI) responses.
4
Which versions are affected by CVE-2016-4054?
CVE-2016-4054 affects Squid versions 3.x before 3.5.17 and 4.x before 4.0.9.
5
Can CVE-2016-4054 be exploited remotely?
Yes, CVE-2016-4054 can be exploited remotely, allowing attackers to execute arbitrary code.