5

CVE-2014-3609: squid-cache squid Improper Input Validation

CVSS: 5.0v2.0MediumModified
AliasesMGASA-2014-0369RHSA-2014:1147UBUNTU-CVE-2014-3609
Published 11-09-2014Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2014-3609 is a medium (CVSS 5.0) Improper Input Validation vulnerability in squid-cache squid. EPSS estimates a 56.22% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.0/10
010
Medium · v2.0 (NVD)
EPSS score
56.22%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1
RHSA-2014:1148

Timeline

  1. 11-09-2014
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values."

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

56.22%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 56.22% on 18-09-2026

18-09-202618-10-2026
EPSS score
56.22%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat3 products
  • squid< 7:3.3.8-12.el7_0
  • squid-debuginfo< 7:3.3.8-12.el7_0
  • squid-sysvinit< 7:3.3.8-12.el7_0
Debian2 products
  • squid< 2.7.STABLE9-5 | < 2.7.STABLE9-2.1+deb6u1 | < 2.7.STABLE9-4.1+deb7u1
  • squid3< 3.1.6-1.2+squeeze4 | < 3.1.20-2.2+deb7u2
Mageia2 products
  • squid< 3.2.10-1.7.mga3
  • squid< 3.3.13-1.mga4
Squid-cache1 product
  • squidEOL3.1 | 3.1.0.1 | 3.1.0.2 | 3.1.0.3 | 3.1.0.4 | 3.1.0.5 | 3.1.0.6 | 3.1.0.7 | 3.1.0.8 | 3.1.0.9 | 3.1.0.10 | 3.1.0.11 | 3.1.0.12 | 3.1.0.13 | 3.1.0.14 | 3.1.0.15 | 3.1.0.16 | 3.1.0.17 | 3.1.0.18 | 3.1.1 | 3.1.2 | 3.1.3 | 3.1.4 | 3.1.5 | 3.1.5.1 | 3.1.6 | 3.1.7 | 3.1.8 | 3.1.9 | 3.1.10 | 3.1.11 | 3.1.12 | 3.1.13 | 3.1.14 | 3.1.15 | 3.2.0.1 | 3.2.0.2 | 3.2.0.3 | 3.2.0.4 | 3.2.0.5 | 3.2.0.6 | 3.2.0.7 | 3.2.0.8 | 3.2.0.9 | 3.2.0.10 | 3.2.0.11 | 3.2.0.12 | 3.2.0.13 | 3.2.0.14 | 3.2.0.15 | 3.2.0.16 | 3.2.0.17 | 3.2.0.18 | 3.2.0.19 | 3.2.1 | 3.2.2 | 3.2.3 | 3.2.4 | 3.2.5 | 3.2.6 | 3.2.7 | 3.2.8 | 3.2.9 | 3.2.10 | 3.2.11 | 3.2.12 | 3.3.0 | 3.3.0.2 | 3.3.0.3 | 3.3.1 | 3.3.2 | 3.3.3 | 3.3.4 | 3.3.5 | 3.3.6 | 3.3.7 | 3.3.8 | 3.3.9 | 3.3.10 | 3.3.11 | 3.4.0.1 | 3.4.0.2 | 3.4.0.3 | 3.4.1 | 3.4.2 | 3.4.3 | 3.4.4 | 3.4.5
Ubuntu1 product
  • squid3< 3.3.8-1ubuntu6.1

5 vendors · 9 products

References

28 links
Show all 28 references