CVE-2016-4555: Input Validation
clientsiderequest.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.
Other sources
Due to incorrect pointer handling Squid is vulnerable to a denial of service attack when processing ESI responses.
External references:
http://www.squid-cache.org/Advisories/SQUID-20169.txt
Upstream fixes:
Squid 3.5:
http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-20169.patch
Squid 3.4:
http://www.squid-cache.org/Versions/v3/3.4/changesets/SQUID-20169.patch
NOTE: For For the other related CVE, CVE-2016-4556, see Bug 1334786
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4555?
CVE-2016-4555 has a severity rating of medium as it allows a remote denial of service through crafted responses.
How do I fix CVE-2016-4555?
The vulnerability CVE-2016-4555 can be fixed by upgrading to Squid versions 3.5.18 and above or 4.0.10 and above.
What systems are affected by CVE-2016-4555?
CVE-2016-4555 affects Squid versions prior to 3.5.18 and 4.0.10 across various operating systems.
Can CVE-2016-4555 be exploited remotely?
Yes, CVE-2016-4555 can be exploited remotely, leading to a denial of service by sending specially crafted requests.
What is the impact of CVE-2016-4555 on Squid performance?
CVE-2016-4555 can lead to crashes in the Squid server when processing specially crafted Edge Side Includes (ESI) responses.