[squid-users] [squid-announce] [ADVISORY] SQUID-2026:9 FTP command injection in FTP gateway

[Matus UHLAR - fantomas]

>> On 12.09.26 14:55, Amos Jeffries wrote:
>> > Advisory ID:       | SQUID-2026:9

>On Thu, Sep 17, 2026 at 9:21 AM Matus UHLAR - fantomas
><uhlar at fantomas.sk> wrote:
>> Has anyone tried to backport these fixes to 6 (possibly 6.13 in debian)?

On 22.09.26 23:17, Francesco Chemolli wrote:
>   the patch in the advisory applies more or less cleanly; I tried
>compiling that file on v6 and it builds, except for an unrelated build
>error in include/splay.h.
>In other words, it should be an easy addition to Debian's source package.

Thank you, I can conirm at least patches for SQUID-2026:6 and SQUID-2026:9 
make 6.13 compile cleanly, squid does even start.
I'll try to upgrade one used instance on thursday (I already upgraded some 
backup instances).
-- 
Matus UHLAR - fantomas, uhlar at fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
It's now safe to throw off your computer.