CVE-2023-46847

HighCVSS 7.5/10Last modified Aug 7, 2026

Description

Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120

Affected software

VendorProductVersions
——>= 3.2.0.1, < 6.4
Red HatRed Hat Enterprise Linux 6 Extended Lifecycle Support—
Red HatRed Hat Enterprise Linux 6 Extended Lifecycle Support—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 7.6 Advanced Update Support—
Red HatRed Hat Enterprise Linux 7.7 Advanced Update Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.1 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—
Red HatRed Hat Enterprise Linux 8.2 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support—

References

Timeline

Published
Nov 3, 2023
Last modified
Aug 7, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-468487.5Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constrCVE-2023-468497.5Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero beCVE-2023-46857.8Delta Electronics' CNCSoft-B version 1.0.0.4 and DOPSoft versions 4.0.0.82 and prior are vulnerable to stack-based buffer overflow, which coCVE-2023-468509.8Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending netCVE-2023-468514.9Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these impCVE-2023-468527.5In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the "geCVE-2023-468539.8In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.CVE-2023-468546.1Proxmox proxmox-widget-toolkit before 4.0.9, as used in multiple Proxmox products, allows XSS via the edit notes feature.CVE-2023-468575.4Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in thCVE-2023-468585.4Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link CVE-2023-46864.3The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via theCVE-2023-468624.7An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL