Your submission was sent successfully! Close

CVE-2011-4096

Published: 17 November 2011

The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service (daemon abort) via a DNS reply containing a CNAME record that references another CNAME record that contains an empty A record.

Priority

Medium

Status

Package Release Status
squid3
Launchpad, Ubuntu, Debian
Upstream
Released (3.1.16-1)
Patches:
Vendor: https://rhn.redhat.com/errata/RHSA-2011-1791.html
Vendor: http://www.debian.org/security/2012/dsa-2381