CVE-2016-4053
high-risk
Published 2016-04-25
Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.
Do I need to act?
!
26.2% chance of exploitation in next 30 days
EPSS score — higher than 74% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.7/10
Low
NETWORK
/ HIGH complexity
Affected Products (20)
Affected Vendors
References (34)
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.h...
Third Party Advisory
http://www.securityfocus.com/bid/91787
Third Party Advisory
http://www.securitytracker.com/id/1035647
Vendor Advisory
http://www.squid-cache.org/Advisories/SQUID-2016_6.txt
Third Party Advisory
http://www.ubuntu.com/usn/USN-2995-1
and 14 more references
60
/ 100
high-risk
Severity
13/34 · Low
Exploitability
15/34 · Moderate
Exposure
32/34 · Critical