[Secure-testing-commits] r47173 - data/CVE

[Salvatore Bonaccorso]

Author: carnil
Date: 2016-12-17 15:36:06 +0000 (Sat, 17 Dec 2016)
New Revision: 47173

Modified:
   data/CVE/list
Log:
Add two new squid3 issues

Modified: data/CVE/list
===================================================================
--- data/CVE/list	2016-12-17 14:46:12 UTC (rev 47172)
+++ data/CVE/list	2016-12-17 15:36:06 UTC (rev 47173)
@@ -1,3 +1,28 @@
+CVE-2016-XXXX [Issue #2, cookie headers and other client-specific private infformation leak]
+	- squid3 <unfixed>
+	NOTE: http://www.squid-cache.org/Advisories/SQUID-2016_10.txt
+	NOTE: http://www.squid-cache.org/Versions/v4/changesets/squid-4-14956.patch
+	NOTE: http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2016_10_a.patch (for squid-3.5 excluding 3.5.22)
+	NOTE: http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14127.patch (for squid 3.5.22 only)
+	NOTE: Vulnerable Squid Versions:
+	NOTE: 3.5.0.1 up to and including 3.5.22
+	NOTE: 4.0.1 up to and including 4.0.16
+	NOTE: CVE Request: http://www.openwall.com/lists/oss-security/2016/12/17/1
+CVE-2016-XXXX [Issue #1, cookie headers and other client-specific private infformation leak]
+	- squid3 <unfixed>
+	NOTE: http://www.squid-cache.org/Advisories/SQUID-2016_11.txt
+	NOTE: http://bugs.squid-cache.org/show_bug.cgi?id=4169
+	NOTE: http://www.squid-cache.org/Versions/v3/3.1/changesets/SQUID-2016_11.patch
+	NOTE: http://www.squid-cache.org/Versions/v3/3.2/changesets/SQUID-2016_11.patch
+	NOTE: http://www.squid-cache.org/Versions/v3/3.3/changesets/SQUID-2016_11.patch
+	NOTE: http://www.squid-cache.org/Versions/v3/3.4/changesets/SQUID-2016_11.patch
+	NOTE: http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2016_11.patch
+	NOTE: http://www.squid-cache.org/Versions/v4/changesets/SQUID-2016_11.patch
+	NOTE: Vulnerable squid versions:
+	NOTE: 3.1.10 up to and including 3.1.23
+	NOTE: 3.2.0.3 up to and including 3.5.22
+	NOTE: 4.0.1 up to and including 4.0.16
+	NOTE: CVE Request: http://www.openwall.com/lists/oss-security/2016/12/17/1
 CVE-2016-582384
 	REJECTED
 CVE-2016-9964 [redirect() doesn't filter "\r\n" which allows for CRLF attack]