CVE-2005-0241

Name	CVE-2005-0241
Description	The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
squid (PTS)	buster (security), buster, buster (lts)	4.6-1+deb10u10	fixed
	bullseye (security), bullseye	4.13-10+deb11u3	fixed
	bookworm (security), bookworm	5.7-2+deb12u2	fixed
	sid, trixie	6.12-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
squid	source	(unstable)	2.5.7-7