Ah you would be needing this as well I think:
http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10063.patch (upstream bug 3011)
That patch labeled as CVE was a bug-fix on top of other code. This sets up the background state on which it was built and should be included in the CVE patch for 3.1.6.
Amos -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org