This bug was fixed in the package squid - 4.4-1ubuntu1

---------------
squid (4.4-1ubuntu1) disco; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - Use snakeoil certificates.
    - Add an example refresh pattern for debs.
    - Add disabled by default AppArmor profile.
    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
      error in parse_time_t, triggered on ppc64el due to the build using -O3
      in that architecture.
    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
      -O2 and that triggers a format-truncation error on pcon.cc. See
      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
    - d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
      Thanks to Vitaly Lavrov <email address hidden>. (LP #1794553)
  * Drop:
    - d/rules: enable cdbs parallel build
      [Fixed in 4.2-1]
    - d/t/test-squid.py: fix apparmor profile filename
      [Fixed in 4.2-1]
    - d/t/test-squid.py: fix the process name. The PID points at the parent.
      [Fixed in 4.2-1]
    - d/t/upstream-test-suite: also make libmem.la, needed by the tests.
      [Fixed in 4.2-1]
    - d/t/0003-installed-binary-for-debian-ci.patch:  use the squid
      binary from the system, instead of the one from the source tree.
      [Fixed in 4.2-1]
    - d/t/upstream-test-suite: drop the sed line, since patch
      0003-installed-binary-for-debian-ci.patch is doing this work now.
      (https://salsa.debian.org/squid-team/squid/commit/ad4372b444ba8b1587839)
      [Fixed in 4.2-1]
  * Added changes:
    - d/rules: Only use -latomic with the intended architectures, instead of
      all of them. This matches what was suggested in
      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
      dh_installchangelogs can pick it up. dh_installchangelogs handles
      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
    - d/usr.sbin.squid: fix the apparmor profile (LP: #1796189):
      + allow net_admin capability
      + add attach_disconnected flag

squid (4.4-1) unstable; urgency=high

  * Urgency high due to security fixes

  [ Amos Jeffries <email address hidden> ]
  * New Upstream Release
    - Fix security issue SQUID-2018:4 (CVE: TBD) (Closes: #912293)
    - Fix security issue SQUID-2018:5 (CVE: TBD) (Closes: #912294)

  [ Luigi Gangitano ]
  * debian/squid.preinst
    - Don't parse /etc/passwd, use getent to make lintian happy

squid (4.3-1) unstable; urgency=low

  [ Amos Jeffries <email address hidden> ]
  * New Upstream Release

  * debian/patches/
    - Remove upstream pr264 patch for systemd

  * debian/control
    - Bumped Standards-Version to 4.2.1, no change needed

squid (4.2-2) unstable; urgency=high

  [ Adrian Bunk <email address hidden> ]
  * Add -latomic for rmel m68k mips mipsel powerpc powerpcspe sh4
    (Closes: #907106)

squid (4.2-1) unstable; urgency=high

  [ Amos Jeffries <email address hidden> ]
  * New Upstream Release

  * debian/patches/
    - Patch to use installed binary for upstream config tests
    - Remove patches included upstream: 0011-upstream-pr172.patch
    - Add upstream pr264 patch for systemd (Closes: #903165)

  * debian/control
    - Bumped Standards-Version to 4.2.0.0, no change needed

  [ Andreas Hasenack ]
  * Enable CDBS parallel build
  * d/t/upstream-test-suite: also make libmem.la, needed by the tests.
  * d/t/test-squid.py: fix apparmor profile filename
  * debian/tests/control: add ssl-cert to the list of dependencies of the
    squid test, as apache is configured to load
    /etc/ssl/certs/ssl-cert-snakeoil.pem in that test.
  * d/t/test-squid.py: fix the process name. The PID points at the parent.

  [ Luigi Gangitano ]
  * debian/control
    - Fix Vcs-Git and Vcs-Browser URLs

 -- Andreas Hasenack <email address hidden>  Mon, 19 Nov 2018 10:51:18 -0200