Evil-DB LogoEvil-DB
← All CVEs

CVE-2023-46847

high · 8.6

Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.

8.6
CVSS
88.4%
EPSS (exploit prob.)
100th
EPSS percentile
2023-11-03
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Weaknesses

CWE-120

Affected products

VendorProductAffected versions
squid-cachesquid>= 3.2.0.1, < 6.4
redhatenterprise_linux8.0
redhatenterprise_linux9.0
redhatenterprise_linux_eus8.6
redhatenterprise_linux_eus8.8
redhatenterprise_linux_eus9.0
redhatenterprise_linux_eus9.2
redhatenterprise_linux_for_arm_648.0_aarch64
redhatenterprise_linux_for_ibm_z_systems8.0_s390x
redhatenterprise_linux_for_power_little_endian8.0_ppc64le
redhatenterprise_linux_server7.0
redhatenterprise_linux_server_aus8.2
redhatenterprise_linux_server_aus8.4
redhatenterprise_linux_server_aus8.6
redhatenterprise_linux_server_aus9.2
redhatenterprise_linux_server_tus8.2
redhatenterprise_linux_server_tus8.4
redhatenterprise_linux_server_tus8.6
redhatenterprise_linux_server_tus8.8
redhatenterprise_linux_server_tus9.2
redhatenterprise_linux_workstation7.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-46847