Security Information / 2012 / Security Information -- DSA-2434-1 nginx

Debian Security Advisory

DSA-2434-1 nginx -- sensitive information leak

Date Reported:

19 Mar 2012

Affected Packages:

nginx

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 664137.
In Mitre's CVE dictionary: CVE-2012-1180.

More information:

Matthew Daley discovered a memory disclosure vulnerability in nginx. In previous versions of this web server, an attacker can receive the content of previously freed memory if an upstream server returned a specially crafted HTTP response, potentially exposing sensitive information.

For the stable distribution (squeeze), this problem has been fixed in version 0.7.67-3+squeeze2.

For the unstable distribution (sid), this problem has been fixed in version 1.1.17-1.

We recommend that you upgrade your nginx packages.