This update for squid fixes the following issues :

  - CVE-2016-10003: Prevent incorrect forwarding of cached     private responses when Collapsed Forwarding feature is     enabled. This allowed remote attacker (proxy user) to     discover private and sensitive information about another     user (bsc#1016169).

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168).

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

squid was updated to fix two security issues.

These security issues were fixed :

  - CVE-2014-6270: Fixed an off by one in snmp subsystem     (bsc#895773).

  - CVE-2014-9749: Fixed a nonce replay vulnerability in     Digest authentication (bsc#949942).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid3 fixes the following issues :

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168)

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid fixes the following issues :

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168)

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942)

This update was imported from the SUSE:SLE-12:Update update project.

squid was updated to fix one security issue.

This security issue was fixed :

  - CVE-2014-9749: Nonce replay vulnerability in Digest     authentication (bsc#949942).

This update for squid fixes the following issues :

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168)

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for squid fixes the following issues :

  - CVE-2016-10003: Prevent incorrect forwarding of cached     private responses when Collapsed Forwarding feature is     enabled. This allowed remote attacker (proxy user) to     discover private and sensitive information about another     user (bsc#1016169).

  - CVE-2016-10002: Fixed incorrect processing of responses     to If-None-Modified HTTP conditional requests. This     allowed responses containing private data to clients it     should not have reached (bsc#1016168).

  - CVE-2014-9749: Prevent nonce replay in Digest     authentication, preventing the reuse of stale auth     tokens (bsc#949942).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote     authenticated users to retain access by leveraging a stale nonce, aka Nonce replay vulnerability.
    (CVE-2014-9749)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
96530	SUSE SLES12 Security Update : squid (SUSE-SU-2017:0128-1)	Nessus	SuSE Local Security Checks	1/16/2017	1/6/2021	high
86883	SUSE SLES11 Security Update : squid (SUSE-SU-2015:1983-1)	Nessus	SuSE Local Security Checks	11/16/2015	1/19/2021	medium
96432	SUSE SLES11 Security Update : squid3 (SUSE-SU-2017:0110-1)	Nessus	SuSE Local Security Checks	1/12/2017	1/19/2021	high
96648	openSUSE Security Update : squid (openSUSE-2017-127)	Nessus	SuSE Local Security Checks	1/20/2017	1/19/2021	high
86647	openSUSE Security Update : squid (openSUSE-2015-684)	Nessus	SuSE Local Security Checks	10/29/2015	1/19/2021	medium
96482	SUSE SLES12 Security Update : squid (SUSE-SU-2017:0116-1)	Nessus	SuSE Local Security Checks	1/13/2017	1/6/2021	high
96622	openSUSE Security Update : squid (openSUSE-2017-115)	Nessus	SuSE Local Security Checks	1/19/2017	1/19/2021	high
218493	Linux Distros Unpatched Vulnerability : CVE-2014-9749	Nessus	Misc.	3/4/2025	3/4/2025	critical

Detections

Analytics

Plugins Search

high

medium

high

high

medium

high

high

critical