Branch p8 update bulletin.

Package squid updated to version 3.5.19-alt1 for branch p8 in task 164463.

Published: 2016-05-10
Modified: 2024-11-21

CVE-2016-4553

client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.

Severity: HIGH (8.6) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References:

Published: 2016-05-10
Modified: 2024-11-21

CVE-2016-4554

mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue.

Severity: HIGH (8.6) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References:

Published: 2016-05-10
Modified: 2024-11-21

CVE-2016-4555

client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Published: 2016-05-10
Modified: 2024-11-21

CVE-2016-4556

Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Package apt-repo updated to version 1.3.5-alt1 for branch p8 in task 164476.

1.2.0-alt1 добавляет несуществующий репозитарий "x86_64-i586 task"

Version: 2.1.0

Branch p8 update on 2016-05-11

ALT-BU-2016-2757-1

ALT-PU-2016-1464-1

Closed vulnerabilities

CVE-2016-4553

CVE-2016-4554

CVE-2016-4555

CVE-2016-4556

ALT-PU-2016-1466-1

Closed bugs

Bug #31577