p PatchFirst

CVE-2017-7529

CVE-2017-7529

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

CVSS 7.5 · High · EPSS 62.6% · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • nginx

    Versions
    • 0.5.6 - 1.13.2: Affected

    No fix published

  • nginx Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.13.3-1

    Update to 1.13.3-1

  • nginx Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.13.3-1

    Update to 1.13.3-1

  • nginx Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.13.3-1

    Update to 1.13.3-1

  • nginx Ubuntu:14.04:LTS

    Versions
    • 1.4.1-3ubuntu1
    • 1.4.3-2ubuntu1
    • 1.4.4-1ubuntu1
    • 1.4.4-2ubuntu1
    • 1.4.4-4ubuntu1
    • 1.4.5-1ubuntu1
    • 1.4.6-1ubuntu2
    • 1.4.6-1ubuntu3
    • 1.4.6-1ubuntu3.1
    • 1.4.6-1ubuntu3.2
    • 1.4.6-1ubuntu3.3
    • 1.4.6-1ubuntu3.4
    • 1.4.6-1ubuntu3.5
    • 1.4.6-1ubuntu3.6
    • 1.4.6-1ubuntu3.7
    Affected ranges
    • ECOSYSTEM: < 1.4.6-1ubuntu3.8

    Update to 1.4.6-1ubuntu3.8

  • nginx Ubuntu:16.04:LTS

    Versions
    • 1.9.3-1ubuntu1
    • 1.9.6-2ubuntu1
    • 1.9.6-2ubuntu2
    • 1.9.9-0ubuntu1
    • 1.9.9-1ubuntu1
    • 1.9.10-0ubuntu1
    • 1.9.10-1ubuntu1
    • 1.9.11-0ubuntu1
    • 1.9.11-0ubuntu2
    • 1.9.12-0ubuntu1
    • 1.9.13-0ubuntu1
    • 1.9.14-0ubuntu1
    • 1.9.15-0ubuntu1
    • 1.10.0-0ubuntu0.16.04.1
    • 1.10.0-0ubuntu0.16.04.2
    • 1.10.0-0ubuntu0.16.04.3
    • 1.10.0-0ubuntu0.16.04.4
    • 1.10.3-0ubuntu0.16.04.1
    Affected ranges
    • ECOSYSTEM: < 1.10.3-0ubuntu0.16.04.2

    Update to 1.10.3-0ubuntu0.16.04.2

Original sources

Check your server →