oss-security - CVE-request(?): squid: buffer overflow in Gopher reply parser

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <201108291348.18241.mweckbecker@suse.de>
Date: Mon, 29 Aug 2011 13:48:17 +0200
From: Matthias Weckbecker <mweckbecker@...e.de>
To: oss-security@...ts.openwall.com
Subject: CVE-request(?): squid: buffer overflow in Gopher reply parser

Hi,

squid 3.x seems to have re-introduced a security issue found by Ben Hawkes of 
the Google Security Team in 2005,

  2011: http://www.squid-cache.org/Advisories/SQUID-2011_3.txt
  2005: http://www.squid-cache.org/Advisories/SQUID-2005_1.txt (CVE-2005-0094)

Will there be a new CVE required? Not quite sure how such "special" cases are 
handled usually.

Thanks,
Matthias

-- 
Matthias Weckbecker, Junior Software Engineer, SUSE Security Team
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany
Tel: +49-911-74053-0;  http://suse.com/
SUSE LINUX Products GmbH, GF: Jeff Hawn, HRB 16746 (AG Nuernberg)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.