Security update for squid3 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2089-1 Final 1 1 2016-08-16T12:56:03Z current 2016-08-16T12:56:03Z 2016-08-16T12:56:03Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for squid3 This update for squid3 fixes the following issues: - Multiple issues in pinger ICMP processing. (CVE-2014-7141, CVE-2014-7142) - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6 processing. (bsc#973782) - CVE-2016-4554: fix header smuggling issue in HTTP Request processing (bsc#979010) - Fix multiple Denial of Service issues in HTTP Response processing. (CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393, bsc#968394, bsc#968395) - Regression caused by the DoS fixes above (bsc#993299) - CVE-2016-3948: Fix denial of service in HTTP Response processing (bsc#973783) - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553) - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054: * fixes multiple issues in ESI processing (bsc#976556) - CVE-2016-4556: fixes double free vulnerability in Esi.cc (bsc#979008) - CVE-2015-5400: Improper Protection of Alternate Path (bsc#938715) - CVE-2014-6270: fix off-by-one in snmp subsystem (bsc#895773) - Memory leak in squid3 when using external_acl (bsc#976708) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slessp4-squid3-12701 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ Link for SUSE-SU-2016:2089-1 https://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html E-Mail link for SUSE-SU-2016:2089-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/895773 SUSE Bug 895773 https://bugzilla.suse.com/902197 SUSE Bug 902197 https://bugzilla.suse.com/938715 SUSE Bug 938715 https://bugzilla.suse.com/963539 SUSE Bug 963539 https://bugzilla.suse.com/967011 SUSE Bug 967011 https://bugzilla.suse.com/968392 SUSE Bug 968392 https://bugzilla.suse.com/968393 SUSE Bug 968393 https://bugzilla.suse.com/968394 SUSE Bug 968394 https://bugzilla.suse.com/968395 SUSE Bug 968395 https://bugzilla.suse.com/973782 SUSE Bug 973782 https://bugzilla.suse.com/973783 SUSE Bug 973783 https://bugzilla.suse.com/976553 SUSE Bug 976553 https://bugzilla.suse.com/976556 SUSE Bug 976556 https://bugzilla.suse.com/976708 SUSE Bug 976708 https://bugzilla.suse.com/979008 SUSE Bug 979008 https://bugzilla.suse.com/979009 SUSE Bug 979009 https://bugzilla.suse.com/979010 SUSE Bug 979010 https://bugzilla.suse.com/979011 SUSE Bug 979011 https://bugzilla.suse.com/993299 SUSE Bug 993299 https://www.suse.com/security/cve/CVE-2011-3205/ SUSE CVE CVE-2011-3205 page https://www.suse.com/security/cve/CVE-2011-4096/ SUSE CVE CVE-2011-4096 page https://www.suse.com/security/cve/CVE-2012-5643/ SUSE CVE CVE-2012-5643 page https://www.suse.com/security/cve/CVE-2013-0188/ SUSE CVE CVE-2013-0188 page https://www.suse.com/security/cve/CVE-2013-4115/ SUSE CVE CVE-2013-4115 page https://www.suse.com/security/cve/CVE-2014-0128/ SUSE CVE CVE-2014-0128 page https://www.suse.com/security/cve/CVE-2014-6270/ SUSE CVE CVE-2014-6270 page https://www.suse.com/security/cve/CVE-2014-7141/ SUSE CVE CVE-2014-7141 page https://www.suse.com/security/cve/CVE-2014-7142/ SUSE CVE CVE-2014-7142 page https://www.suse.com/security/cve/CVE-2015-5400/ SUSE CVE CVE-2015-5400 page https://www.suse.com/security/cve/CVE-2016-2390/ SUSE CVE CVE-2016-2390 page https://www.suse.com/security/cve/CVE-2016-2569/ SUSE CVE CVE-2016-2569 page https://www.suse.com/security/cve/CVE-2016-2570/ SUSE CVE CVE-2016-2570 page https://www.suse.com/security/cve/CVE-2016-2571/ SUSE CVE CVE-2016-2571 page https://www.suse.com/security/cve/CVE-2016-2572/ SUSE CVE CVE-2016-2572 page https://www.suse.com/security/cve/CVE-2016-3947/ SUSE CVE CVE-2016-3947 page https://www.suse.com/security/cve/CVE-2016-3948/ SUSE CVE CVE-2016-3948 page https://www.suse.com/security/cve/CVE-2016-4051/ SUSE CVE CVE-2016-4051 page https://www.suse.com/security/cve/CVE-2016-4052/ SUSE CVE CVE-2016-4052 page https://www.suse.com/security/cve/CVE-2016-4053/ SUSE CVE CVE-2016-4053 page https://www.suse.com/security/cve/CVE-2016-4054/ SUSE CVE CVE-2016-4054 page https://www.suse.com/security/cve/CVE-2016-4553/ SUSE CVE CVE-2016-4553 page https://www.suse.com/security/cve/CVE-2016-4554/ SUSE CVE CVE-2016-4554 page https://www.suse.com/security/cve/CVE-2016-4555/ SUSE CVE CVE-2016-4555 page https://www.suse.com/security/cve/CVE-2016-4556/ SUSE CVE CVE-2016-4556 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 squid3-3.1.23-8.16.30.1 squid3-3.1.23-8.16.30.1 as a component of SUSE Linux Enterprise Server 11 SP4 squid3-3.1.23-8.16.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression. CVE-2011-3205 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2011-3205.html CVE-2011-3205 https://bugzilla.suse.com/715171 SUSE Bug 715171 The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service (daemon abort) via a DNS reply containing a CNAME record that references another CNAME record that contains an empty A record. CVE-2011-4096 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2011-4096.html CVE-2011-4096 https://bugzilla.suse.com/727492 SUSE Bug 727492 Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials. CVE-2012-5643 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2012-5643.html CVE-2012-5643 https://bugzilla.suse.com/794954 SUSE Bug 794954 https://bugzilla.suse.com/796999 SUSE Bug 796999 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-0189, CVE-2013-0191. Reason: this identifier was intended for one issue, but it was inadvertently associated with multiple issues. Notes: All CVE users should consult CVE-2013-0189 and CVE-2013-0191 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage. CVE-2013-0188 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2013-0188.html CVE-2013-0188 https://bugzilla.suse.com/794954 SUSE Bug 794954 https://bugzilla.suse.com/796999 SUSE Bug 796999 Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows remote attackers to cause a denial of service (memory corruption and server termination) via a long name in a DNS lookup request. CVE-2013-4115 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2013-4115.html CVE-2013-4115 https://bugzilla.suse.com/829084 SUSE Bug 829084 https://bugzilla.suse.com/880233 SUSE Bug 880233 Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management. CVE-2014-0128 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2014-0128.html CVE-2014-0128 https://bugzilla.suse.com/867533 SUSE Bug 867533 Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted UDP SNMP request, which triggers a heap-based buffer overflow. CVE-2014-6270 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2014-6270.html CVE-2014-6270 https://bugzilla.suse.com/895773 SUSE Bug 895773 The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet. CVE-2014-7141 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2014-7141.html CVE-2014-7141 https://bugzilla.suse.com/1040640 SUSE Bug 1040640 https://bugzilla.suse.com/891268 SUSE Bug 891268 https://bugzilla.suse.com/895773 SUSE Bug 895773 The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size. CVE-2014-7142 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2014-7142.html CVE-2014-7142 https://bugzilla.suse.com/895773 SUSE Bug 895773 https://bugzilla.suse.com/973782 SUSE Bug 973782 Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request. CVE-2015-5400 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 moderate 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2015-5400.html CVE-2015-5400 https://bugzilla.suse.com/938715 SUSE Bug 938715 https://bugzilla.suse.com/967073 SUSE Bug 967073 The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message. CVE-2016-2390 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2016-2390.html CVE-2016-2390 https://bugzilla.suse.com/967011 SUSE Bug 967011 Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header. CVE-2016-2569 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2016-2569.html CVE-2016-2569 https://bugzilla.suse.com/968392 SUSE Bug 968392 https://bugzilla.suse.com/968393 SUSE Bug 968393 The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h. CVE-2016-2570 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2016-2570.html CVE-2016-2570 https://bugzilla.suse.com/968392 SUSE Bug 968392 https://bugzilla.suse.com/968393 SUSE Bug 968393 http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response. CVE-2016-2571 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2016-2571.html CVE-2016-2571 https://bugzilla.suse.com/968394 SUSE Bug 968394 https://bugzilla.suse.com/968395 SUSE Bug 968395 http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response. CVE-2016-2572 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2016-2572.html CVE-2016-2572 https://bugzilla.suse.com/968394 SUSE Bug 968394 https://bugzilla.suse.com/968395 SUSE Bug 968395 Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 allows remote servers to cause a denial of service (performance degradation or transition failures) or write sensitive information to log files via an ICMPv6 packet. CVE-2016-3947 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2016-3947.html CVE-2016-3947 https://bugzilla.suse.com/973782 SUSE Bug 973782 Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP response, related to Vary headers. CVE-2016-3948 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 moderate 2.9 AV:A/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2016-3948.html CVE-2016-3948 https://bugzilla.suse.com/973783 SUSE Bug 973783 Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data. CVE-2016-4051 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2016-4051.html CVE-2016-4051 https://bugzilla.suse.com/976553 SUSE Bug 976553 Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses. CVE-2016-4052 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2016-4052.html CVE-2016-4052 https://bugzilla.suse.com/976556 SUSE Bug 976556 Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization. CVE-2016-4053 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2016-4053.html CVE-2016-4053 https://bugzilla.suse.com/976556 SUSE Bug 976556 Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses. CVE-2016-4054 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2016-4054.html CVE-2016-4054 https://bugzilla.suse.com/976556 SUSE Bug 976556 client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request. CVE-2016-4553 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2016-4553.html CVE-2016-4553 https://bugzilla.suse.com/979009 SUSE Bug 979009 https://bugzilla.suse.com/990451 SUSE Bug 990451 mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue. CVE-2016-4554 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2016-4554.html CVE-2016-4554 https://bugzilla.suse.com/979010 SUSE Bug 979010 https://bugzilla.suse.com/990451 SUSE Bug 990451 client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses. CVE-2016-4555 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 moderate 6 AV:N/AC:M/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2016-4555.html CVE-2016-4555 https://bugzilla.suse.com/979008 SUSE Bug 979008 https://bugzilla.suse.com/979011 SUSE Bug 979011 Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response. CVE-2016-4556 SUSE Linux Enterprise Server 11 SP4:squid3-3.1.23-8.16.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:squid3-3.1.23-8.16.30.1 moderate 6 AV:N/AC:M/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162089-1/ https://www.suse.com/security/cve/CVE-2016-4556.html CVE-2016-4556 https://bugzilla.suse.com/979008 SUSE Bug 979008 https://bugzilla.suse.com/979011 SUSE Bug 979011