Heap-based buffer overflow in Squid before 2.4 STABLE4 and Squid 2.5 and 2.6 until March 12 2002 distributions allows remote attackers to cause a denial of service and possibly execute arbitrary code via compressed DNS responses.