critique
CVE-2025-54574
squid-cache: Squid Buffer Overflow
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (élevée), Amazon (élevée), Oracle (élevée), Rocky Linux (élevée), Ubuntu (moyenne).
Description
Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 2023 | squid, squid-debuginfo, squid-debugsource | 7:6.6-1.amzn2023.0.3 |
| debian 11 | squid | 4.13-10+deb11u5 |
| debian 12 | squid | 5.7-2+deb12u3 |
| debian 13 | squid | 6.5-1 |
| debian 14 | squid | 6.5-1 |
| echo | squid | 5.7-2+deb12u3 |
| Oracle Linux 7 | squid, squid-migration-script, squid-sysvinit | 7:3.5.20-17.0.7.el7_9.13 |
| Oracle Linux 9 | squid | 7:5.5-6.el9_3.2 |
| rapidfort amazon linux 2023 | squid | 7:6.6-1.amzn2023.0.3 |
| rapidfort Oracle Linux 9 | squid | 7:5.5-6.el9_3.2 |
| rapidfort ubuntu 20.04 | rf-squid, squid | 0:5.7-0ubuntu0.22.04.4 |
| rapidfort ubuntu 22.04 | rf-squid, squid | 0:5.7-0ubuntu0.22.04.4 |
Afficher les 27 entrées de 18 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 2023 | squid | 7:6.6-1.amzn2023.0.3 |
| amazon linux 2023 | squid-debuginfo | 7:6.6-1.amzn2023.0.3 |
| amazon linux 2023 | squid-debugsource | 7:6.6-1.amzn2023.0.3 |
| debian 11 | squid | 4.13-10+deb11u5 |
| debian 12 | squid | 5.7-2+deb12u3 |
| debian 13 | squid | 6.5-1 |
| debian 14 | squid | 6.5-1 |
| echo | squid | 5.7-2+deb12u3 |
| Oracle Linux 7 | squid | 7:3.5.20-17.0.7.el7_9.13 |
| Oracle Linux 7 | squid-migration-script | 7:3.5.20-17.0.7.el7_9.13 |
| Oracle Linux 7 | squid-sysvinit | 7:3.5.20-17.0.7.el7_9.13 |
| Oracle Linux 9 | squid | 7:5.5-6.el9_3.2 |
| rapidfort amazon linux 2023 | squid | 7:6.6-1.amzn2023.0.3 |
| rapidfort Oracle Linux 9 | squid | 7:5.5-6.el9_3.2 |
| rapidfort ubuntu 20.04 | rf-squid | 0:5.7-0ubuntu0.22.04.4 |
| rapidfort ubuntu 20.04 | squid | 0:5.7-0ubuntu0.22.04.4 |
| rapidfort ubuntu 22.04 | rf-squid | 0:5.7-0ubuntu0.22.04.4 |
| rapidfort ubuntu 22.04 | squid | 0:5.7-0ubuntu0.22.04.4 |
| rapidfort ubuntu 24.04 | rf-squid | 0:5.7-0ubuntu0.22.04.4 |
| rapidfort ubuntu 24.04 | squid | 0:5.7-0ubuntu0.22.04.4 |
| Red Hat | squid | pas de correctif indiqué |
| Red Hat | squid34 | pas de correctif indiqué |
| rocky 8 | squid:4::libecap | 1.0.1-2.module+el8.9.0+1437+df5ea8f0 |
| rocky 8 | squid:4::libecap-devel | 1.0.1-2.module+el8.9.0+1437+df5ea8f0 |
| ubuntu 20.04 | squid | 4.10-1ubuntu1.12 |
| ubuntu 20.04-ESM | squid | 4.10-1ubuntu1.12 |
| ubuntu 22.04 | squid | 5.7-0ubuntu0.22.04.4 |
Références
- http://www.openwall.com/lists/oss-security/2025/11/05/5
- https://access.redhat.com/errata/RHSA-2023:7668
- https://access.redhat.com/security/cve/CVE-2025-54574
- https://bugzilla.redhat.com/show_bug.cgi?id=2245914
- https://bugzilla.redhat.com/show_bug.cgi?id=2252918
- https://bugzilla.redhat.com/show_bug.cgi?id=2386026
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49288
Les 19 références
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5824
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54574
- https://errata.rockylinux.org/RLSA-2023:7668
- https://github.com/squid-cache/squid/commit/a27bf4b84da23594150c7a86a23435df0b35b988
- https://github.com/squid-cache/squid/releases/tag/SQUID_6_4
- https://github.com/squid-cache/squid/security/advisories/GHSA-w4gv-vw3f-29g3
- https://linux.oracle.com/cve/CVE-2025-54574.html
- https://linux.oracle.com/errata/ELSA-2025-14414.html
- https://lists.debian.org/debian-lts-announce/2025/09/msg00027.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-54574
- https://www.cve.org/CVERecord?id=CVE-2025-54574