CVE-2019-18679

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Nov 26, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-18687.5A vulnerability in the web-based management interface of Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to acceCVE-2019-186807.5An issue was discovered in the Linux kernel 4.4.x before 4.4.195. There is a NULL pointer dereference in rds_tcp_kill_sock() in net/rds/tcp.CVE-2019-186837.0An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on somCVE-2019-186847.0Sudo through 1.8.29 allows local users to escalate to root if they have write access to file descriptor 3 of the sudo process. This occurs bCVE-2019-18697.5A vulnerability in the internal packet-processing functionality of the Cisco StarOS operating system running on virtual platforms could alloCVE-2019-18706.1A vulnerability in the web-based management interface of Cisco Enterprise Chat and Email (ECE) Center could allow an unauthenticated, remoteCVE-2019-18717.2A vulnerability in the Import Cisco IMC configuration utility of Cisco Integrated Management Controller (IMC) could allow an authenticated, CVE-2019-18725.3A vulnerability in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series software could allow an unauthenticated, CVE-2019-18738.6A vulnerability in the cryptographic driver for Cisco Adaptive Security Appliance Software (ASA) and Firepower Threat Defense (FTD) SoftwareCVE-2019-18748.8A vulnerability in the web-based management interface of Cisco Prime Service Catalog Software could allow an unauthenticated, remote attackeCVE-2019-18754.8A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conducCVE-2019-18765.3A vulnerability in the HTTPS proxy feature of Cisco Wide Area Application Services (WAAS) Software could allow an unauthenticated, remote at
CVE-2019-18679: High severity, CVSS 7.5 | Vulnix