Home > Vulnerability Database > CVE-2019-12526

Mend.io Vulnerability Database

CVE-2019-12526

Date: November 26, 2019

An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap.

Language: C++

Severity Score

9.8

Related Resources (16)

Url: http://www.squid-cache.org/Advisories/SQUID-2019_7.txt

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/

Url: https://nvd.nist.gov/vuln/detail/CVE-2019-12526

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/

Url: https://lists.debian.org/debian-lts-announce/2019/12/msg00011.html

Url: https://www.debian.org/security/2020/dsa-4682

Url: https://security.gentoo.org/glsa/202003-34

Url: https://security-tracker.debian.org/tracker/CVE-2019-12526

Url: https://usn.ubuntu.com/4213-1/

Url: https://bugzilla.suse.com/show_bug.cgi?id=1156326

Url: https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2019-12526

Url: https://access.redhat.com/security/cve/CVE-2019-12526

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/

Url: https://www.mend.io/vulnerability-database/CVE-2019-12526

Severity Score

9.8

Weakness Type (CWE)

Out-of-bounds Write

CWE-787

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-120

CVSS v3.1

Base Score:	9.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

CVSS v2

Base Score:	7.5
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2019-12526

Date: November 26, 2019

Language: C++

Severity Score

Related Resources (16)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?