CVE-2010-3072

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 59.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-09-20 · updated 2026-06-16

Description

The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.

Affected products

Squid: 3.0, 3.0.stable1, 3.0.stable2, 3.0.stable3, 3.0.stable4, 3.0.stable5 (+49)

References

http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047787.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047820.html
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
http://secunia.com/advisories/41298
http://secunia.com/advisories/41477
http://secunia.com/advisories/41534
http://www.debian.org/security/2010/dsa-2111
http://www.openwall.com/lists/oss-security/2010/09/05/2
http://www.openwall.com/lists/oss-security/2010/09/07/7
http://www.securityfocus.com/bid/42982
http://www.squid-cache.org/Advisories/SQUID-2010_3.txt
http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9189.patch

Get alerted when CVE-2010-3072 or the next vulnerability affects your stack