Squid-2.5.STABLE9 available

The Squid HTTP Proxy team is pleased to announce the availability of the
Squid-2.5.STABLE9 (and 2.5.STABLE8) bugfix release.

Squid-2.5.STABLE9 is a major bugfix release of Squid-2.5 and corrects
several security and stability issues found after the 2.5.STABLE7 release.

All users of Squid-2.5.STABLE7 and earlier are recommended to upgrade to
make sure they are not vulnerable to any of the security or stability
issues mentioned below.

Users who have already upgraded to the Squid-2.5.STABLE8 release is
recommended to at least make sure they have the DNS related patch for
Bug #1234 applied. If unsure of if any of the other changes looks appealing
it is recommended to upgrade to 2.5.STABLE9. See the ChangeLog for details
on the changes between 2.5.STABLE8 and 2.5.STABLE9.

This new release can be downloaded from our HTTP or FTP servers

    http://www.squid-cache.org/Versions/v2/2.5/
    ftp://ftp.squid-cache.org/pub/squid-2/STABLE/

or the mirrors. For a list of mirror sites see

    http://www.squid-cache.org/Mirrors/http-mirrors.html
    http://www.squid-cache.org/Mirrors/ftp-mirrors.html


The most important bug-fixes in this release compared with 2.5.STABLE7 are:

    [Security] Hardened against several forms of cache pollution
    by attacks on the structure of the HTTP protocol

    [Medium security] Buffer overflow in WCCP recvfrom() call
    (Bug #1217)

    [Security] buffer overflow bug in gopherToHTML() (Bug #1189)

    [Minor security] Confusing results on empty acl declarations (Bug
    #1166)

    [Medium security] Denial of service with forged WCCP messages
    (Bug #1190)

    [Minor Security] Add sanity checks on LDAP user names (Bug #1187)

    [Security] Properly handle oversized reply headers (Bug #1216)

    [Major] Assertion failures on certain odd DNS responses (Bug #1234)

    [Major] Segmentation fault on failed PUT/POST requests (Bug #1224)

    [Major] HTTP reply data corruption in certain situations involving
    reply headers split over multiple packets (Bug #1233)


In addition there is a number of new features or improvements which
enhances the functionality of Squid

    [Minor] Password management in ftp:// gatewaying improved (Bug #1226)

    [Minor] httpd_accel_port 0 now working properly in accelerator setups
    (Bug #1121)

    [Minor] The new acls req_header and resp_header to match arbitrary
    HTTP headers now works (Bug #961)

    [Minor] High characters allowed un-encoded in FTP and Gopher
    listings to allow the user-agent to display data in non-iso8859-1
    charsets. (Bug #1220)

    [Minor] FTP gatewaying URLs cleaned up slightly, mainly to work
    better with Mozilla but also to improve security slightly on
    non-anonymous FTP.

    [Cosmetic] Adjusted to build cleanly with GCC-4 (Bug #1211)

    [Medium] Don't retry requests on 403 errors (Bug #1210)

For a complete list of changes see the ChangeLog and the Squid-2.5
Patches page <url:http://www.squid-cache.org/Versions/v2/2.5/bugs/>

It is recommended to read the release notes when upgrading from an earlier
Squid release (including earlier Squid-2.5 releases) as there has been some
minor changes in the configuration.

Thanks goes to MARA Systems AB who has been actively sponsoring this
bugfix release of Squid as part of their continuing effort to provide both
free and commercial support to the Squid community, and to all users who
have provided valuable bug reports and feedback via the Squid bug
reporting tool and mailinglists.

Regards
The Squid HTTP Proxy developer team