CVE-2014-3609

Squid 3.x < 3.3.12 and 3.4.x < 3.4.6 - Denial of Service via Crafted Range Headers

Title source: llm
STIX 2.1

Description

HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values."

References (14)

Core 14
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61320
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60179
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2327-1
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2015/dsa-3139
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-09/msg00029.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-3014
Vendor Advisory x_refsource_confirm
http://www.squid-cache.org/Advisories/SQUID-2014_2.txt
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60334
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/69453
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/61412
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1147.html

Scores

EPSS 0.5622
EPSS Percentile 98.9%

Details

CWE
CWE-20
Status published
Products (50)
squid-cache/squid 3.1
squid-cache/squid 3.1.0.1
squid-cache/squid 3.1.0.2
squid-cache/squid 3.1.0.3
squid-cache/squid 3.1.0.4
squid-cache/squid 3.1.0.5
squid-cache/squid 3.1.0.6
squid-cache/squid 3.1.0.7
squid-cache/squid 3.1.0.8
squid-cache/squid 3.1.0.9
... and 40 more
Published Sep 11, 2014
Tracked Since Feb 18, 2026