CVE-2004-2654 Null dereference in n/a

What is CVE-2004-2654?

CVE-2004-2654 is a medium-severity vulnerability in n/a, published on 24 Feb 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The clientAbortBody function in client_side.c in Squid Web Proxy Cache before 2.6 STABLE6 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors that trigger a null dereference. NOTE: in a followup advisory, a researcher claimed that the issue was a buffer overflow that was not fixed in STABLE6. However, the vendor's bug report clearly shows that the researcher later retracted this claim, because the tested product was actually STABLE5.

Which versions are affected by CVE-2004-2654?

It affects 1 product.

Products include Squid Squid.

How do I fix CVE-2004-2654?

Upgrade to a fixed version.

Is CVE-2004-2654 being exploited?

There is no known exploitation of CVE-2004-2654 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2005-0194 Auth bypass in n/a Critical 10.0
• CVE-2005-1345 Missing authorization in n/a High 7.5
• CVE-2005-0173 Auth bypass in n/a High 7.5
• CVE-2004-0189 Security feature bypass in n/a High 7.5
• CVE-2002-0163 Memory corruption in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2004-2654, GHSA-jxhx-rppc-gf4x.