CVE-2019-12528

An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes.

References

Affected packages

Git / github.com/squid-cache/squid

Affected ranges

Type: GIT
Repo: https://github.com/squid-cache/squid
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

91d32285db62332648d92eabd48c5d8e59b475d2

Affected versions

Other

BASIC_TPROXY4

HISTORIC_RELEASES

SQUID_3_0_PRE1

SQUID_3_0_PRE2

SQUID_3_0_PRE3

SQUID_3_0_PRE4

SQUID_3_0_PRE5

SQUID_3_0_PRE6

SQUID_3_0_PRE7

SQUID_3_0_RC1

SQUID_4_0_1

SQUID_4_0_10

SQUID_4_0_11

SQUID_4_0_12

SQUID_4_0_13

SQUID_4_0_14

SQUID_4_0_15

SQUID_4_0_16

SQUID_4_0_17

SQUID_4_0_18

SQUID_4_0_19

SQUID_4_0_2

SQUID_4_0_20

SQUID_4_0_21

SQUID_4_0_22

SQUID_4_0_23

SQUID_4_0_24

SQUID_4_0_25

SQUID_4_0_3

SQUID_4_0_4

SQUID_4_0_5

SQUID_4_0_6

SQUID_4_0_7

SQUID_4_0_8

SQUID_4_0_9

SQUID_4_1

SQUID_4_2

SQUID_4_3

SQUID_4_4

SQUID_4_5

SQUID_4_6

SQUID_4_7

SQUID_4_8

SQUID_4_9

for-libecap-v0p1

merge-candidate-3-v1

merge-candidate-3-v2

sourceformat-review-1

take00

take01

take02

take03

take04

take06

take07

take08

take09

take1

take2

BumpSslServerFirst.*

BumpSslServerFirst.take01

BumpSslServerFirst.take02

BumpSslServerFirst.take03

BumpSslServerFirst.take04

BumpSslServerFirst.take05

BumpSslServerFirst.take06

BumpSslServerFirst.take07

BumpSslServerFirst.take08

BumpSslServerFirst.take09

BumpSslServerFirst.take10

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12528.json"