{"id":"CVE-2016-3947","details":"Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 allows remote servers to cause a denial of service (performance degradation or transition failures) or write sensitive information to log files via an ICMPv6 packet.","modified":"2026-03-20T11:09:38.456197Z","published":"2016-04-07T18:59:00.137Z","related":["MGASA-2016-0133","SUSE-SU-2016:2008-1","SUSE-SU-2016:2089-1","openSUSE-SU-2024:11403-1"],"references":[{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html"},{"type":"WEB","url":"http://www.securitytracker.com/id/1035457"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html"},{"type":"ADVISORY","url":"http://www.ubuntu.com/usn/USN-2995-1"},{"type":"ADVISORY","url":"http://www.squid-cache.org/Advisories/SQUID-2016_3.txt"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201607-01"},{"type":"FIX","url":"http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10495.patch"},{"type":"FIX","url":"http://www.squid-cache.org/Versions/v3/3.2/changesets/squid-3.2-11839.patch"},{"type":"FIX","url":"http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14015.patch"},{"type":"FIX","url":"http://www.squid-cache.org/Versions/v3/3.3/changesets/squid-3.3-12694.patch"},{"type":"FIX","url":"http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13232.patch"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/squid-cache/squid","events":[{"introduced":"0"},{"last_affected":"b59f0c8802d10b86bffea3aaaa5ae135c087b179"},{"introduced":"0"},{"last_affected":"1243ec712bf76c549ba7f48fcdc30d98ce550449"},{"introduced":"0"},{"last_affected":"6c4d7196d05c95c406bafce712c8768cc8dc3beb"},{"introduced":"0"},{"last_affected":"2552ca552397fb9d23f06d4f1211c505205aee95"},{"introduced":"0"},{"last_affected":"78121f9a195344616290ecdd4f7f9dd521daaf1a"},{"introduced":"0"},{"last_affected":"ff87fda5fe2e205785b15ebdb243ad812effc981"},{"introduced":"0"},{"last_affected":"404063c59bb4ffa6c5a005611c4375f82ddd423f"},{"introduced":"0"},{"last_affected":"7f53f09fb9dc2d6ac4f49ceae514ad6488e2600e"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"3.5.15"},{"introduced":"0"},{"last_affected":"4.0.1"},{"introduced":"0"},{"last_affected":"4.0.2"},{"introduced":"0"},{"last_affected":"4.0.3"},{"introduced":"0"},{"last_affected":"4.0.4"},{"introduced":"0"},{"last_affected":"4.0.5"},{"introduced":"0"},{"last_affected":"4.0.6"},{"introduced":"0"},{"last_affected":"4.0.7"}]}}],"versions":["BASIC_TPROXY4","BumpSslServerFirst.take01","BumpSslServerFirst.take02","BumpSslServerFirst.take03","BumpSslServerFirst.take04","BumpSslServerFirst.take05","BumpSslServerFirst.take06","BumpSslServerFirst.take07","BumpSslServerFirst.take08","BumpSslServerFirst.take09","BumpSslServerFirst.take10","HISTORIC_RELEASES","SQUID_3_0_PRE1","SQUID_3_0_PRE2","SQUID_3_0_PRE3","SQUID_3_0_PRE4","SQUID_3_0_PRE5","SQUID_3_0_PRE6","SQUID_3_0_PRE7","SQUID_3_0_RC1","SQUID_3_5_0_1","SQUID_3_5_0_2","SQUID_3_5_0_3","SQUID_3_5_0_4","SQUID_3_5_1","SQUID_3_5_10","SQUID_3_5_11","SQUID_3_5_12","SQUID_3_5_13","SQUID_3_5_14","SQUID_3_5_15","SQUID_3_5_2","SQUID_3_5_3","SQUID_3_5_4","SQUID_3_5_5","SQUID_3_5_6","SQUID_3_5_7","SQUID_3_5_8","SQUID_3_5_9","SQUID_4_0_1","for-libecap-v0p1","merge-candidate-3-v1","merge-candidate-3-v2","sourceformat-review-1","take00","take01","take02","take03","take04","take06","take07","take08","take09","take1","take2"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-3947.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"12.04"}]},{"events":[{"introduced":"0"},{"last_affected":"14.04"}]},{"events":[{"introduced":"0"},{"last_affected":"15.10"}]},{"events":[{"introduced":"0"},{"last_affected":"16.04"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}]}