7.5

CVE-2009-2629

Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests.

Data is provided by the National Vulnerability Database (NVD)
F5 ≫ Nginx Version >= 0.1.0 < 0.5.38
F5 ≫ Nginx Version >= 0.6.0 < 0.6.39
F5 ≫ Nginx Version >= 0.7.0 < 0.7.62
F5 ≫ Nginx Version >= 0.8.0 < 0.8.15
Debian ≫ Debian Linux Version4.0
Debian ≫ Debian Linux Version5.0
Debian ≫ Debian Linux Version6.0
Fedoraproject ≫ Fedora Version10
Fedoraproject ≫ Fedora Version11
Fedoraproject ≫ Fedora Version12
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 80.03% 0.991
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

http://nginx.net/CHANGES
Vendor Advisory
Release Notes
http://nginx.net/CHANGES-0.5
Vendor Advisory
Release Notes
http://nginx.net/CHANGES-0.6
Vendor Advisory
Release Notes
http://nginx.net/CHANGES-0.7
Vendor Advisory
Release Notes
http://www.kb.cert.org/vuls/id/180065
Third Party Advisory
US Government Resource