7.5

CVE-2009-2629

Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
F5 ≫ Nginx Version >= 0.1.0 < 0.5.38
F5 ≫ Nginx Version >= 0.6.0 < 0.6.39
F5 ≫ Nginx Version >= 0.7.0 < 0.7.62
F5 ≫ Nginx Version >= 0.8.0 < 0.8.15
Debian ≫ Debian Linux Version 4.0
Debian ≫ Debian Linux Version 5.0
Debian ≫ Debian Linux Version 6.0
Fedoraproject ≫ Fedora Version 10
Fedoraproject ≫ Fedora Version 11
Fedoraproject ≫ Fedora Version 12
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 75.08% 0.995
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

http://nginx.net/CHANGES
Vendor Advisory
Release Notes
http://nginx.net/CHANGES-0.5
Vendor Advisory
Release Notes
http://nginx.net/CHANGES-0.6
Vendor Advisory
Release Notes
http://nginx.net/CHANGES-0.7
Vendor Advisory
Release Notes
http://sysoev.ru/nginx/patch.180065.txt
Broken Link
http://www.debian.org/security/2009/dsa-1884
Third Party Advisory
http://www.kb.cert.org/vuls/id/180065
Third Party Advisory
US Government Resource
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00428.html
Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00442.html
Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00449.html
Third Party Advisory