PT-2012-3799 · Nginx · Nginx

Matthew Daley · Publicado 2012-04-17 · Atualizado 2024-06-15 · CVE-2012-2089

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nginx versions 1.0.7 through 1.0.14 nginx versions 1.1.3 through 1.1.18

Description A buffer overflow in the ngx http mp4 module module, when the mp4 directive is used, allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted MP4 file. The issue is related to the ngx http mp4 module.c file.

Recommendations For versions 1.0.7 through 1.0.14, update to a version outside of this range to resolve the issue. For versions 1.1.3 through 1.1.18, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling the mp4 directive until a patch is available.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-120

Identificadores relacionados

CVE-2012-2089

OPENSUSE-SU-2024:10044-1

Produtos afetados

Nginx

Referências · 27

• https://suse.com/security/cve/CVE-2014-3556 · Nota
• https://suse.com/security/cve/CVE-2012-2089 · Nota
• https://suse.com/security/cve/CVE-2013-2070 · Nota
• https://cve.org/CVERecord?id=CVE-2012-2089 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2089 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079474.html · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10044-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-2089 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-0746 · Nota
• https://suse.com/security/cve/CVE-2011-4315 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079388.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-3616 · Nota
• https://suse.com/security/cve/CVE-2013-4547 · Nota
• https://security-tracker.debian.org/tracker/CVE-2012-2089 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-2089 · Nota de Segurança