==========================================================================
Ubuntu Security Notice USN-4059-2
July 17, 2019

squid3 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 12.04 ESM

Summary:

Several security issues were fixed in Squid.

Software Description:
– squid3: Web proxy cache server

Details:

USN-4059-1 and USN-3557-1 fixed several vulnerabilities in Squid. This update provides
the corresponding update for Ubuntu 12.04 ESM.

Original advisory details:

Louis Dion-Marcil discovered that Squid incorrectly handled certain
Edge Side Includes (ESI) responses. A malicious remote server could
possibly cause Squid to crash, resulting in a denial of service.
(CVE-2018-1000024)

Louis Dion-Marcil discovered that Squid incorrectly handled certain
Edge Side Includes (ESI) responses. A malicious remote server could
possibly cause Squid to crash, resulting in a denial of service.
(CVE-2018-1000027)

It was discovered that Squid incorrectly handled the cachemgr.cgi web
module. A remote attacker could possibly use this issue to conduct
cross-site scripting (XSS) attacks. (CVE-2019-13345)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 ESM:
squid3 3.1.19-1ubuntu3.12.04.9

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4059-2
https://usn.ubuntu.com/4059-1
CVE-2018-1000024, CVE-2018-1000027, CVE-2019-13345
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBAgAGBQJdLy4fAAoJEEW851uECx9pI0sQALKd2GALkbiIGGdacFHj9E1E
Of0iWVMrjk2asT3d/lI3LxucbvV38BCE/iG77+c5RL6AQ2xNOpYStnneh6Cl9DMP
A/KFY4zm86neYlM7tE7XTFFRdD2lmxQUmNivfDgPmyIWZk4NJ1oCT55yrr3RxQpM
AXlhV2KN8/AiVISRtROBD1uEL/9qGwAeqapWlBxmtqkmRqaYSMZaKA0COOYDUxrb
GjVnZkJUPF6YvTA1Nb+QBRzB1oTPOcxuddaTKYCanYc1ASBgVUiMjXXU1HLDGrRm
bxCh6v6PsJ0unlNJW9bGehkVH4+ToiVePuu94zXL/fP9YZ6IImwgLzPD5K4UtLwC
+0qmKgl8TxIfGMJ8eBhaDvTIdbUBk/kt9tY7k7qh7wyg4S4HjKnev4Dk3J2z6ydo
Yr3CYhZdO1m1BaFaBxAJ77ucg0BkzNrRk+iZxcrPdAP1pGMlarIjRS6fN0EosGMn
gQKps1IsYXiV/WXqqkK0IZia2m13ZXPJUqVLn5lsJoiwxWSvcCz8FB7lbxQjDj5/
VWxw0RcHnbXULNGNO6eLwwfIRXB+2XHDMGdYJlsDw2q0Y1TpYSEOV2d+H8yRq5BD
2VsD3IE+E8wTEkFDg/QZiSvmu0xa3OLS8oN6vlC7MEXoynWnAeuS14p3LjD+yH+p
HEScU85LWLBH87SW4YuP
=nQLF
—–END PGP SIGNATURE—–
—