Mercurial > hg > nginx-site

annotate xml/en/security_advisories.xml @ 904:22bd9315e047

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
nginx-1.2.9
author Maxim Dounin <mdounin@mdounin.ru>
date Mon, 13 May 2013 15:23:37 +0400
parents 8f674c48b879
children ec5d7bb1d40c
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
580
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 525
diff changeset
1 <!--
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 525
diff changeset
2 Copyright (C) Igor Sysoev
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 525
diff changeset
3 Copyright (C) Nginx, Inc.
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 525
diff changeset
4 -->
be54c443235a Added copyright markers to documentation sources.
Ruslan Ermilov <ru@nginx.com>
parents: 525
diff changeset
5
50
9d544687d02c Fixed DOCTYPE declaration.
Ruslan Ermilov <ru@nginx.com>
parents: 0
diff changeset
6 <!DOCTYPE article SYSTEM "../../dtd/article.dtd">
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
7
123
7db449e89e92 Unified the use of the "name" attribute instead of "title".
Ruslan Ermilov <ru@nginx.com>
parents: 50
diff changeset
8 <article name="nginx security advisories"
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
9 link="/en/security_advisories.html"
589
764fbac1b8b4 Added document revision.
Ruslan Ermilov <ru@nginx.com>
parents: 580
diff changeset
10 lang="en"
764fbac1b8b4 Added document revision.
Ruslan Ermilov <ru@nginx.com>
parents: 580
diff changeset
11 rev="1">
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
12
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
13 <section>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
14
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
15 <para>
457
ab9453c6b9c6 A contact email for the security issues added.
Maxim Konovalov <maxim@nginx.com>
parents: 447
diff changeset
16 All nginx security issues should be reported to
ab9453c6b9c6 A contact email for the security issues added.
Maxim Konovalov <maxim@nginx.com>
parents: 447
diff changeset
17 <link url="mailto:security-alert@nginx.org">security-alert@nginx.org</link>.
ab9453c6b9c6 A contact email for the security issues added.
Maxim Konovalov <maxim@nginx.com>
parents: 447
diff changeset
18 </para>
ab9453c6b9c6 A contact email for the security issues added.
Maxim Konovalov <maxim@nginx.com>
parents: 447
diff changeset
19
ab9453c6b9c6 A contact email for the security issues added.
Maxim Konovalov <maxim@nginx.com>
parents: 447
diff changeset
20 <para>
458
cdf45fe0d9de Made the link to PGP public keys read as a full sentence.
Ruslan Ermilov <ru@nginx.com>
parents: 457
diff changeset
21 Patches are signed using one of the
cdf45fe0d9de Made the link to PGP public keys read as a full sentence.
Ruslan Ermilov <ru@nginx.com>
parents: 457
diff changeset
22 <link doc="pgp_keys.xml">PGP public keys</link>.
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
23 </para>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
24
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
25 <security>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
26
904
22bd9315e047 nginx-1.2.9
Maxim Dounin <mdounin@mdounin.ru>
parents: 901
diff changeset
27 <item name="Memory disclosure with specially crafted http backend responses"
22bd9315e047 nginx-1.2.9
Maxim Dounin <mdounin@mdounin.ru>
parents: 901
diff changeset
28 severity="medium"
22bd9315e047 nginx-1.2.9
Maxim Dounin <mdounin@mdounin.ru>
parents: 901
diff changeset
29 cve="2013-2070"
22bd9315e047 nginx-1.2.9
Maxim Dounin <mdounin@mdounin.ru>
parents: 901
diff changeset
30 good="1.5.0+, 1.4.1+, 1.2.9+"
22bd9315e047 nginx-1.2.9
Maxim Dounin <mdounin@mdounin.ru>
parents: 901
diff changeset
31 vulnerable="1.1.4-1.2.8, 1.3.9-1.4.0">
22bd9315e047 nginx-1.2.9
Maxim Dounin <mdounin@mdounin.ru>
parents: 901
diff changeset
32 <patch name="patch.2013.chunked.txt" versions="1.3.9-1.4.0" />
22bd9315e047 nginx-1.2.9
Maxim Dounin <mdounin@mdounin.ru>
parents: 901
diff changeset
33 <patch name="patch.2013.proxy.txt" versions="1.1.4-1.2.8" />
22bd9315e047 nginx-1.2.9
Maxim Dounin <mdounin@mdounin.ru>
parents: 901
diff changeset
34 </item>
22bd9315e047 nginx-1.2.9
Maxim Dounin <mdounin@mdounin.ru>
parents: 901
diff changeset
35
899
012feca3d85f nginx-1.5.0, nginx-1.4.1
Maxim Dounin <mdounin@mdounin.ru>
parents: 589
diff changeset
36 <item name="Stack-based buffer overflow with specially crafted request"
012feca3d85f nginx-1.5.0, nginx-1.4.1
Maxim Dounin <mdounin@mdounin.ru>
parents: 589
diff changeset
37 severity="major"
901
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
38 advisory="http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html"
899
012feca3d85f nginx-1.5.0, nginx-1.4.1
Maxim Dounin <mdounin@mdounin.ru>
parents: 589
diff changeset
39 cve="2013-2028"
012feca3d85f nginx-1.5.0, nginx-1.4.1
Maxim Dounin <mdounin@mdounin.ru>
parents: 589
diff changeset
40 good="1.5.0+, 1.4.1+"
901
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
41 vulnerable="1.3.9-1.4.0">
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
42 <patch name="patch.2013.chunked.txt" />
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
43 </item>
899
012feca3d85f nginx-1.5.0, nginx-1.4.1
Maxim Dounin <mdounin@mdounin.ru>
parents: 589
diff changeset
44
525
1dca638da1eb Win32 security issue added.
Maxim Dounin <mdounin@mdounin.ru>
parents: 488
diff changeset
45 <item name="Vulnerabilities with Windows directory aliases"
1dca638da1eb Win32 security issue added.
Maxim Dounin <mdounin@mdounin.ru>
parents: 488
diff changeset
46 severity="medium"
1dca638da1eb Win32 security issue added.
Maxim Dounin <mdounin@mdounin.ru>
parents: 488
diff changeset
47 cve="2011-4963"
1dca638da1eb Win32 security issue added.
Maxim Dounin <mdounin@mdounin.ru>
parents: 488
diff changeset
48 good="1.3.1+, 1.2.1+"
1dca638da1eb Win32 security issue added.
Maxim Dounin <mdounin@mdounin.ru>
parents: 488
diff changeset
49 vulnerable="nginx/Windows 0.7.52-1.3.0" />
1dca638da1eb Win32 security issue added.
Maxim Dounin <mdounin@mdounin.ru>
parents: 488
diff changeset
50
487
2406529bc838 nginx-1.1.19, nginx-1.0.15
Maxim Dounin <mdounin@mdounin.ru>
parents: 472
diff changeset
51 <item name="Buffer overflow in the ngx_http_mp4_module"
2406529bc838 nginx-1.1.19, nginx-1.0.15
Maxim Dounin <mdounin@mdounin.ru>
parents: 472
diff changeset
52 severity="major"
2406529bc838 nginx-1.1.19, nginx-1.0.15
Maxim Dounin <mdounin@mdounin.ru>
parents: 472
diff changeset
53 cve="2012-2089"
2406529bc838 nginx-1.1.19, nginx-1.0.15
Maxim Dounin <mdounin@mdounin.ru>
parents: 472
diff changeset
54 good="1.1.19+, 1.0.15+"
901
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
55 vulnerable="1.1.3-1.1.18, 1.0.7-1.0.14">
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
56 <patch name="patch.2012.mp4.txt" />
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
57 </item>
487
2406529bc838 nginx-1.1.19, nginx-1.0.15
Maxim Dounin <mdounin@mdounin.ru>
parents: 472
diff changeset
58
445
86d441d817dd nginx-1.1.17, nginx-1.0.14
Maxim Dounin <mdounin@mdounin.ru>
parents: 247
diff changeset
59 <item name="Memory disclosure with specially crafted backend responses"
86d441d817dd nginx-1.1.17, nginx-1.0.14
Maxim Dounin <mdounin@mdounin.ru>
parents: 247
diff changeset
60 severity="major"
472
7054e1c9c9c2 Added CVE ID to the latest security advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 458
diff changeset
61 cve="2012-1180"
445
86d441d817dd nginx-1.1.17, nginx-1.0.14
Maxim Dounin <mdounin@mdounin.ru>
parents: 247
diff changeset
62 good="1.1.17+, 1.0.14+"
901
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
63 vulnerable="0.1.0-1.1.16">
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
64 <patch name="patch.2012.memory.txt" />
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
65 </item>
445
86d441d817dd nginx-1.1.17, nginx-1.0.14
Maxim Dounin <mdounin@mdounin.ru>
parents: 247
diff changeset
66
488
78ab3599e1fe Added CVE-2011-4315 (buffer overflow in resolver).
Maxim Dounin <mdounin@mdounin.ru>
parents: 487
diff changeset
67 <item name="Buffer overflow in resolver"
78ab3599e1fe Added CVE-2011-4315 (buffer overflow in resolver).
Maxim Dounin <mdounin@mdounin.ru>
parents: 487
diff changeset
68 severity="medium"
78ab3599e1fe Added CVE-2011-4315 (buffer overflow in resolver).
Maxim Dounin <mdounin@mdounin.ru>
parents: 487
diff changeset
69 cve="2011-4315"
78ab3599e1fe Added CVE-2011-4315 (buffer overflow in resolver).
Maxim Dounin <mdounin@mdounin.ru>
parents: 487
diff changeset
70 good="1.1.8+, 1.0.10+"
78ab3599e1fe Added CVE-2011-4315 (buffer overflow in resolver).
Maxim Dounin <mdounin@mdounin.ru>
parents: 487
diff changeset
71 vulnerable="0.6.18-1.1.7" />
78ab3599e1fe Added CVE-2011-4315 (buffer overflow in resolver).
Maxim Dounin <mdounin@mdounin.ru>
parents: 487
diff changeset
72
123
7db449e89e92 Unified the use of the "name" attribute instead of "title".
Ruslan Ermilov <ru@nginx.com>
parents: 50
diff changeset
73 <item name="Vulnerabilities with invalid UTF-8 sequence on Windows"
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
74 severity="major"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
75 cve="2010-2266"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
76 good="0.8.41+, 0.7.67+"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
77 vulnerable="nginx/Windows 0.7.52-0.8.40" />
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
78
123
7db449e89e92 Unified the use of the "name" attribute instead of "title".
Ruslan Ermilov <ru@nginx.com>
parents: 50
diff changeset
79 <item name="Vulnerabilities with Windows file default stream"
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
80 severity="major"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
81 cve="2010-2263"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
82 good="0.8.40+, 0.7.66+"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
83 vulnerable="nginx/Windows 0.7.52-0.8.39" />
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
84
123
7db449e89e92 Unified the use of the "name" attribute instead of "title".
Ruslan Ermilov <ru@nginx.com>
parents: 50
diff changeset
85 <item name="Vulnerabilities with Windows 8.3 filename pseudonyms"
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
86 severity="major"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
87 core="CORE-2010-0121"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
88 href="http://www.coresecurity.com/content/filename-pseudonyms-vulnerabilities"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
89 good="0.8.33+, 0.7.65+"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
90 vulnerable="nginx/Windows 0.7.52-0.8.32" />
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
91
123
7db449e89e92 Unified the use of the "name" attribute instead of "title".
Ruslan Ermilov <ru@nginx.com>
parents: 50
diff changeset
92 <item name="An error log data are not sanitized"
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
93 severity="none"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
94 cve="2009-4487"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
95 good="none"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
96 vulnerable="all" />
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
97
123
7db449e89e92 Unified the use of the "name" attribute instead of "title".
Ruslan Ermilov <ru@nginx.com>
parents: 50
diff changeset
98 <item name="The renegotiation vulnerability in SSL protocol"
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
99 severity="major"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
100 cert="120541"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
101 cve="2009-3555"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
102 good="0.8.23+, 0.7.64+"
901
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
103 vulnerable="0.1.0-0.8.22">
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
104 <patch name="patch.cve-2009-3555.txt" />
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
105 </item>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
106
123
7db449e89e92 Unified the use of the "name" attribute instead of "title".
Ruslan Ermilov <ru@nginx.com>
parents: 50
diff changeset
107 <item name="Directory traversal vulnerability"
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
108 severity="minor"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
109 cve="2009-3898"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
110 good="0.8.17+, 0.7.63+"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
111 vulnerable="0.1.0-0.8.16" />
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
112
123
7db449e89e92 Unified the use of the "name" attribute instead of "title".
Ruslan Ermilov <ru@nginx.com>
parents: 50
diff changeset
113 <item name="Buffer underflow vulnerability"
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
114 severity="major"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
115 cert="180065"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
116 cve="2009-2629"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
117 good="0.8.15+, 0.7.62+, 0.6.39+, 0.5.38+"
901
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
118 vulnerable="0.1.0-0.8.14">
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
119 <patch name="patch.180065.txt" />
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
120 </item>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
121
123
7db449e89e92 Unified the use of the "name" attribute instead of "title".
Ruslan Ermilov <ru@nginx.com>
parents: 50
diff changeset
122 <item name="Null pointer dereference vulnerability"
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
123 severity="major"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
124 cve="2009-3896"
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
125 good="0.8.14+, 0.7.62+, 0.6.39+, 0.5.38+"
901
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
126 vulnerable="0.1.0-0.8.13">
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
127 <patch name="patch.null.pointer.txt" />
8f674c48b879 Security advisories: advisory link and several patches per advisory.
Ruslan Ermilov <ru@nginx.com>
parents: 899
diff changeset
128 </item>
0
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
129
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
130 </security>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
131
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
132 </section>
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
133
61e04fc01027 Initial import of the nginx.org website.
Ruslan Ermilov <ru@nginx.com>
parents:
diff changeset
134 </article>