CVE-2007-6239
NoneCVSS
—
EPSS
26.7%
Published
Dec 4, 2007
CISA due date
—
The record
The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | squid | 0 | 2.6.17-1 |
| Debian:11 | squid | 0 | 2.6.17-1 |
| Debian:12 | squid | 0 | 2.6.17-1 |
| Debian:13 | squid | 0 | 2.6.17-1 |
| Debian:4.0 | squid | 0 | 2.6.5-6etch1 |
| Debian:4.0 | squid | 0 | 2.6.5-6etch4 |
| Red Hat:enterprise_linux:2.1::as | squid | 0 | 7:2.4.STABLE7-1.21as.11 |
| Red Hat:enterprise_linux:2.1::aw | squid | 0 | 7:2.4.STABLE7-1.21as.11 |
| Red Hat:enterprise_linux:2.1::es | squid | 0 | 7:2.4.STABLE7-1.21as.11 |
| Red Hat:enterprise_linux:3::as | squid | 0 | 7:2.5.STABLE3-8.3E |
| Red Hat:enterprise_linux:3::as | squid-debuginfo | 0 | 7:2.5.STABLE3-8.3E |
| Red Hat:enterprise_linux:3::desktop | squid | 0 | 7:2.5.STABLE3-8.3E |
| Red Hat:enterprise_linux:3::desktop | squid-debuginfo | 0 | 7:2.5.STABLE3-8.3E |
| Red Hat:enterprise_linux:3::es | squid | 0 | 7:2.5.STABLE3-8.3E |
| Red Hat:enterprise_linux:3::es | squid-debuginfo | 0 | 7:2.5.STABLE3-8.3E |
| Red Hat:enterprise_linux:3::ws | squid | 0 | 7:2.5.STABLE3-8.3E |
| Red Hat:enterprise_linux:3::ws | squid-debuginfo | 0 | 7:2.5.STABLE3-8.3E |
| Red Hat:enterprise_linux:4::as | squid | 0 | 7:2.5.STABLE14-1.4E.el4_6.1 |
| Red Hat:enterprise_linux:4::as | squid-debuginfo | 0 | 7:2.5.STABLE14-1.4E.el4_6.1 |
| Red Hat:enterprise_linux:4::desktop | squid | 0 | 7:2.5.STABLE14-1.4E.el4_6.1 |
| Red Hat:enterprise_linux:4::desktop | squid-debuginfo | 0 | 7:2.5.STABLE14-1.4E.el4_6.1 |
| Red Hat:enterprise_linux:4::es | squid | 0 | 7:2.5.STABLE14-1.4E.el4_6.1 |
| Red Hat:enterprise_linux:4::es | squid-debuginfo | 0 | 7:2.5.STABLE14-1.4E.el4_6.1 |
| Red Hat:enterprise_linux:4::ws | squid | 0 | 7:2.5.STABLE14-1.4E.el4_6.1 |
| Red Hat:enterprise_linux:4::ws | squid-debuginfo | 0 | 7:2.5.STABLE14-1.4E.el4_6.1 |
| Red Hat:enterprise_linux:5::client_workstation | squid | 0 | 7:2.6.STABLE6-5.el5_1.2 |
| Red Hat:enterprise_linux:5::client_workstation | squid-debuginfo | 0 | 7:2.6.STABLE6-5.el5_1.2 |
| Red Hat:enterprise_linux:5::server | squid | 0 | 7:2.6.STABLE6-5.el5_1.2 |
| Red Hat:enterprise_linux:5::server | squid-debuginfo | 0 | 7:2.6.STABLE6-5.el5_1.2 |
Related vulnerabilities
- CVE-2016-2390 The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x… Also affects squid
- CVE-2015-3455 Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before… Also affects squid
- CVE-2014-6270 Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when… Also affects squid
- CVE-2009-2855 The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers… Also affects squid
- CVE-2009-0478 Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers… Also affects squid
- CVE-2007-1560 The clientProcessRequest() function in src/client_side.c in Squid 2.6 before 2.6.STABLE12… Also affects squid
- CVE-2007-0247 squid/src/ftp.c in Squid before 2.6.STABLE7 allows remote FTP servers to cause a denial… Also affects squid
- CVE-2025-54574 Squid is a caching proxy for the Web. Also affects squid