CVE-2016-4053

Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.

• CWE-119

• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
• http://www.debian.org/security/2016/dsa-3625
• http://www.openwall.com/lists/oss-security/2016/04/20/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/04/20/9Mailing List, Third Party Advisory
• http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatch, Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlThird Party Advisory
• http://www.securityfocus.com/bid/86788
• http://www.securityfocus.com/bid/91787Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1035647Third Party Advisory, VDB Entry
• http://www.squid-cache.org/Advisories/SQUID-2016_6.txtVendor Advisory
• http://www.ubuntu.com/usn/USN-2995-1Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1138
• https://access.redhat.com/errata/RHSA-2016:1139
• https://access.redhat.com/errata/RHSA-2016:1140
• https://security.gentoo.org/glsa/201607-01
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
• http://www.debian.org/security/2016/dsa-3625
• http://www.openwall.com/lists/oss-security/2016/04/20/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/04/20/9Mailing List, Third Party Advisory
• http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatch, Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlThird Party Advisory
• http://www.securityfocus.com/bid/86788
• http://www.securityfocus.com/bid/91787Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1035647Third Party Advisory, VDB Entry
• http://www.squid-cache.org/Advisories/SQUID-2016_6.txtVendor Advisory
• http://www.ubuntu.com/usn/USN-2995-1Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1138
• https://access.redhat.com/errata/RHSA-2016:1139
• https://access.redhat.com/errata/RHSA-2016:1140
• https://security.gentoo.org/glsa/201607-01

Published

Apr 25, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-4047An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-4048An issue was discovered in Open-Xchange OX App Suite before …
• CVE-2016-4049The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quag…
• CVE-2016-4050Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-4051Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5…
• CVE-2016-4052Multiple stack-based buffer overflows in Squid 3.x before 3.…
• CVE-2016-4054Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.…
• CVE-2016-4055The duration function in the moment package before 2.11.2 fo…6.5
• CVE-2016-4056Cross-site scripting (XSS) vulnerability in the Backend comp…
• CVE-2016-4057Huawei FusionCompute before V100R005C10SPC700 allows remote …
• CVE-2016-4058Cross-site scripting (XSS) vulnerability in Huawei Policy Ce…
• CVE-2016-4059Use-after-free vulnerability in Foxit Reader and PhantomPDF …