CVE-2007-6239: squid squid_web_proxy_cache Improper Input Validation

CVSS: 5.0v2.0MediumModified

AliasesRHSA-2007:1130DEBIAN-CVE-2007-6239DSA-1482-1

Published 04-12-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-6239 is a medium (CVSS 5.0) Improper Input Validation vulnerability in squid squid_web_proxy_cache. EPSS estimates a 26.66% chance of exploitation in the next 30 days, higher than 98% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

35/100

0100

Medium · default modelHow is this calculated?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

26.66%

0%100%

High · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 1

DSA-1646-2

Timeline

04-12-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

26.66%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

0.00 pp

From 26.66% on 19-09-2026

19-09-202619-10-2026

EPSS score

26.66%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (squid-cache.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Redhat2 products

squid< 7:2.4.STABLE7-1.21as.11 | < 7:2.5.STABLE3-8.3E | < 7:2.5.STABLE14-1.4E.el4_6.1 | < 7:2.6.STABLE6-5.el5_1.2
squid-debuginfo< 7:2.5.STABLE3-8.3E | < 7:2.5.STABLE14-1.4E.el4_6.1 | < 7:2.6.STABLE6-5.el5_1.2

Debian1 product

squid< 2.6.17-1 | < 2.6.5-6etch1

Squid1 product

squid_web_proxy_cache2.0_patch2 | 2.1_patch2 | 2.3.stable4 | 2.3.stable5 | 2.4_stable2 | 2.4_stable4 | 2.4_stable6 | 2.4_stable7 | 2.5.stable11 | 2.5.stable12 | 2.5.stable13 | 2.5.stable14 | 2.5_.stable9 | 2.5_stable1 | 2.5_stable3 | 2.5_stable4 | 2.5_stable5 | 2.5_stable6 | 2.5_stable7 | 2.5_stable8 | 2.5_stable10 | 2.6 | 2.6.stable1 | 2.6.stable2 | 2.6.stable3 | 2.6.stable4 | 2.6.stable5 | 2.6.stable6 | 2.6.stable7 | 2.6.stable12 | 2.6.stable13 | 2.6.stable14 | 2.6.stable15 | 2.6.stable16 | 3.0 | 3.0_pre1 | 3.0_pre2 | 3.0_pre3

3 vendors · 4 products

References

34 links

secunia.com/advisories/28091Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/28412Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/archives/fedora-package-announce/2007-December/msg00507.htmlVendor AdvisoryX Refsource FEDORA
www.debian.org/security/2008/dsa-1482Vendor AdvisoryX Refsource DEBIANPatch
secunia.com/advisories/28814Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.kb.cert.org/vuls/id/232881Third Party AdvisoryX Refsource CERT VNUS Government Resource
security.gentoo.org/glsa/glsa-200903-38.xmlVendor AdvisoryX Refsource GENTOO
www.securityfocus.com/bid/26687VDB EntryX Refsource BIDPatch
www.redhat.com/support/errata/RHSA-2007-1130.htmlVendor AdvisoryX Refsource REDHATPatch
secunia.com/advisories/28109Third Party AdvisoryX Refsource SECUNIAVendor Advisory

Show all 34 references

www.squid-cache.org/Advisories/SQUID-2007_2.txtX Refsource CONFIRMPatchVendor Advisory
www.mandriva.com/security/advisories?name=MDVSA-2008:002Vendor AdvisoryX Refsource MANDRIVA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10915VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/28403Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/27910Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
security.gentoo.org/glsa/glsa-200801-05.xmlVendor AdvisoryX Refsource GENTOO
www.vupen.com/english/advisories/2007/4066VDB EntryX Refsource VUPENVendor Advisory
secunia.com/advisories/28350Third Party AdvisoryX Refsource SECUNIAVendor Advisory
bugzilla.redhat.com/show_bug.cgi?id=410181X Refsource CONFIRMREPORT
www.securitytracker.com/id?1019036VDB EntryX Refsource SECTRACK
secunia.com/advisories/28381Third Party AdvisoryX Refsource SECUNIAVendor Advisory
bugs.gentoo.org/show_bug.cgi?id=201209X Refsource CONFIRM
secunia.com/advisories/34467Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/archives/fedora-package-announce/2007-December/msg00497.htmlVendor AdvisoryX Refsource FEDORA
www.ubuntu.com/usn/usn-565-1Vendor AdvisoryX Refsource UBUNTU
www.squid-cache.org/Versions/v2/2.6/changesets/11780.patchX Refsource CONFIRMExploitVendor Advisory
lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.htmlVendor AdvisoryX Refsource SUSE
access.redhat.com/errata/RHSA-2007:1130Advisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_1130.jsonAdvisory
access.redhat.com/security/cve/CVE-2007-6239REPORT
www.cve.org/CVERecord?id=CVE-2007-6239Advisory
nvd.nist.gov/vuln/detail/CVE-2007-6239Advisory
security-tracker.debian.org/tracker/CVE-2007-6239Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities