Description

An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.

Remediation

References

CVE-2019-12527

Related Vulnerabilities

Resin Application Server Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2012-2968)

WordPress 5.1.x Multiple Vulnerabilities (5.1 - 5.1.6)

WordPress 4.3.x Cross-Site Request Forgery (4.3 - 4.3.18)

MyBB Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2019-3579)

WordPress Plugin Popup Maker-Popup for opt-ins, lead gen, & more Cross-Site Scripting (1.16.10)

Severity

High

Classification

CVE-2019-12527 CWE-787 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities