Re: CVE-request(?): squid: buffer overflow in Gopher reply parser

[Vincent Danen <vdanen () redhat com>]

* [2011-08-29 13:48:17 +0200] Matthias Weckbecker wrote:

> Hi,
>
> squid 3.x seems to have re-introduced a security issue found by Ben Hawkes of
> the Google Security Team in 2005,
>
>  2011: http://www.squid-cache.org/Advisories/SQUID-2011_3.txt
>  2005: http://www.squid-cache.org/Advisories/SQUID-2005_1.txt (CVE-2005-0094)
>
> Will there be a new CVE required? Not quite sure how such "special" cases are
> handled usually.

Does anyone know when this was re-introduced?  The upstream advisory
indicates all 3.0 releases are affected, but doesn't indicate if 2.x
(after 2.5.STABLE7) was at any point vulnerable.

--
Vincent Danen / Red Hat Security Response Team