Improper input validation in Squid-Cache Squid

CVE-2010-0308

lib/rfc1035.c in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service (assertion failure) via a crafted DNS packet that only contains a header.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.229 (97.5th percentile) — read the EPSS interpretation.

Affected products

  • Squid-cache Squid — versions 3.0.stable22, 3.0.stable1, 3.0.stable21
  • N/a — versions n/a

Weakness classification (CWE)

References