CVE-2016-3947

Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 allows remote servers to cause a denial of service (performance degradation or transition failures) or write sensitive information to log files via an ICMPv6 packet.

• CWE-119

• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
• http://www.securitytracker.com/id/1035457
• http://www.squid-cache.org/Advisories/SQUID-2016_3.txtVendor Advisory
• http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10495.patchPatch
• http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11839.patchPatch, Third Party Advisory, US Government Resource
• http://www.squid-cache.org/Versions/v3/3.3/changesets/squid-3.3-12694.patchPatch
• http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13232.patchPatch
• http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14015.patchPatch
• http://www.ubuntu.com/usn/USN-2995-1
• https://security.gentoo.org/glsa/201607-01
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
• http://www.securitytracker.com/id/1035457
• http://www.squid-cache.org/Advisories/SQUID-2016_3.txtVendor Advisory
• http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10495.patchPatch
• http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11839.patchPatch, Third Party Advisory, US Government Resource
• http://www.squid-cache.org/Versions/v3/3.3/changesets/squid-3.3-12694.patchPatch
• http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13232.patchPatch
• http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14015.patchPatch
• http://www.ubuntu.com/usn/USN-2995-1
• https://security.gentoo.org/glsa/201607-01

Published

Apr 7, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-3940The Synaptics touchscreen driver in Android before 2016-10-0…
• CVE-2016-3941Buffer overflow in the AStreamPeekStream function in input/s…
• CVE-2016-3943Panda Endpoint Administration Agent before 7.50.00, as used …7.8
• CVE-2016-3944UpdateAgent in Lenovo Accelerator Application allows man-in-…
• CVE-2016-3945Multiple integer overflows in the (1) cvt_by_strip and (2) c…
• CVE-2016-3946SAP Console (aka SAPConsole) 7.30 allows local users to disc…
• CVE-2016-3948Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perf…
• CVE-2016-3949Siemens SIMATIC S7-300 Profinet-enabled CPU devices with fir…
• CVE-2016-3950Huawei AR3200 routers with software before V200R006C10SPC300…
• CVE-2016-3951Double free vulnerability in drivers/net/usb/cdc_ncm.c in th…
• CVE-2016-3952web2py before 2.14.1, when using the standalone version, all…
• CVE-2016-3953The sample web application in web2py before 2.14.2 might all…