CVE-2016-3948

A double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.

The mime_header.cc file in Squid before version 3.5.18 contains a vulnerability that allows remote attackers to bypass intended same-origin restrictions and potentially conduct cache-poisoning attacks via a crafted HTTP Host header, known as a 'header smuggling' issue.

The client_side.cc file in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when an absolute URI is provided, allowing remote attackers to conduct cache-poisoning attacks.

A buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.

Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses.

In Squid 3.x before version 3.5.15 and 4.x before version 4.0.7, http.cc continues to store data after a response-parsing failure. This allows remote HTTP servers to cause a denial of service by sending a malformed response.

Squid versions 3.x before 3.5.15 and 4.x before 4.0.7 do not properly append data to String objects, allowing remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.

Squid versions prior to 7.5 contain a heap Use-After-Free vulnerability in ICP traffic handling, allowing a remote attacker to perform a reliable and repeatable Denial of Service attack. The attack requires ICP support enabled (non-zero `icp_port`) and cannot be mitigated by `icp_access` rules.

Squid versions prior to 7.5 have a vulnerability due to premature resource release and heap Use-After-Free bugs, allowing a DoS attack via ICP traffic. This affects only deployments with ICP explicitly enabled (non-zero `icp_port`).

Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.