CVE-2016-2570
Published · Updated
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 9.0%
exploitation probability
9.0%top 5% of all CVEs
observed exploitation
nono source reports it
The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h.
Affected products
n/a · n/aReferences
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.htmlhttp://lists.opensuse.org/opensuse-updates/2016-08/msg00069.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2600.htmlhttps://security.gentoo.org/glsa/201607-01https://usn.ubuntu.com/3557-1/http://www.openwall.com/lists/oss-security/2016/02/26/2http://www.securitytracker.com/id/1035101http://www.squid-cache.org/Advisories/SQUID-2016_2.txthttp://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13993.patchhttp://www.squid-cache.org/Versions/v4/changesets/squid-4-14549.patch