CVE-2007-1560

MEDIUM 5.0CVE-2007-1560 · Published 21/03/2007 · updated 16/06/2026

Package	Affected versions	Patched versions
squid squid	`= 2.6.stable1= 2.6.stable10= 2.6.stable11= 2.6.stable2= 2.6.stable3= 2.6.stable4= 2.6.stable5= 2.6.stable6= 2.6.stable7= 2.6.stable8= 2.6.stable9`	No fix yet

Description

The clientProcessRequest() function in src/client_side.c in Squid 2.6 before 2.6.STABLE12 allows remote attackers to cause a denial of service (daemon crash) via crafted TRACE requests that trigger an assertion error.

References

secunia.com/advisories/24611 · Patch
secunia.com/advisories/24614 · Vendor Advisory
secunia.com/advisories/24625 · Vendor Advisory
secunia.com/advisories/24662 · Vendor Advisory
secunia.com/advisories/24911 · Vendor Advisory
security.gentoo.org/glsa/glsa-200703-27.xml
mandriva.com/security/advisories
novell.com/linux/security/advisories/2007_5_sr.html
redhat.com/support/errata/RHSA-2007-0131.html
securityfocus.com/bid/23085
securitytracker.com/id
squid-cache.org/Advisories/SQUID-2007_1.txt · Patch
squid-cache.org/Versions/v2/2.6/changesets/11349.patch
ubuntu.com/usn/usn-441-1
vupen.com/english/advisories/2007/1035 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/33124
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10291

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free