5

CVE-2012-1180

Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
F5 ≫ Nginx Version >= 0.1.0 < 1.0.14
F5 ≫ Nginx Version >= 1.1.0 < 1.1.17
Fedoraproject ≫ Fedora Version15
Fedoraproject ≫ Fedora Version16
Fedoraproject ≫ Fedora Version17
Debian ≫ Debian Linux Version6.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 10.42% 0.951
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://secunia.com/advisories/48577
Third Party Advisory
http://security.gentoo.org/glsa/glsa-201203-22.xml
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077966.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076646.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076671.html
Third Party Advisory
http://nginx.org/download/patch.2012.memory.txt
Patch
Vendor Advisory
http://nginx.org/en/security_advisories.html
Patch
Vendor Advisory
http://osvdb.org/80124
Broken Link
http://seclists.org/bugtraq/2012/Mar/65
Third Party Advisory
Mailing List
http://secunia.com/advisories/48465
Third Party Advisory
http://trac.nginx.org/nginx/changeset/4530/nginx
Patch
Vendor Advisory
http://trac.nginx.org/nginx/changeset/4531/nginx
Patch
Vendor Advisory
http://www.debian.org/security/2012/dsa-2434
Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2012:043
Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/03/15/5
Patch
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2012/03/15/9
Patch
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/52578
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id?1026827
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=803856
Third Party Advisory
Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/74191
Third Party Advisory
VDB Entry
https://hermes.opensuse.org/messages/14173096
Broken Link