CVE-2016-4556

Published: 10 May 2016

Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.

Notes

same fixes as CVE-2016-4555

Priority

Medium

CVSS 3 base score: 7.5

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4556
• http://www.squid-cache.org/Advisories/SQUID-2016_9.txt
• https://ubuntu.com/security/notices/USN-2995-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823968