PublicDateAtUSN: 2016-02-27
Candidate: CVE-2016-2570
PublicDate: 2016-02-27 05:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2570
 http://www.squid-cache.org/Advisories/SQUID-2016_2.txt
 https://ubuntu.com/security/notices/USN-3557-1
Description:
 The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x
 before 4.0.7 does not check buffer limits during XML parsing, which allows
 remote HTTP servers to cause a denial of service (assertion failure and
 daemon exit) via a crafted XML document, related to esi/CustomParser.cc and
 esi/CustomParser.h.
Ubuntu-Description:
Notes:
 mdeslaur> needs substantial backporting
 mdeslaur> There are no current plans to fix this CVE in Ubuntu 12.04 LTS
 mdeslaur> and Ubuntu 14.04 LTS.
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816011
Priority: low
Discovered-by: William Lima
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]

Patches_squid3:
 upstream: http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13993.patch
upstream_squid3: released (3.5.15, 4.0.7)
precise_squid3: ignored
precise/esm_squid3: ignored
trusty_squid3: ignored
trusty/esm_squid3: DNE (trusty was ignored)
vivid/ubuntu-core_squid3: DNE
vivid/stable-phone-overlay_squid3: DNE
wily_squid3: ignored (reached end-of-life)
xenial_squid3: released (3.5.12-1ubuntu7.5)
esm-infra/xenial_squid3: released (3.5.12-1ubuntu7.5)
yakkety_squid3: ignored (reached end-of-life)
zesty_squid3: ignored (reached end-of-life)
artful_squid3: not-affected (3.5.23-5ubuntu1)
devel_squid3: not-affected (3.5.23-5ubuntu1)