Bug 28663 - надо обновить до 1.1.19+
Summary: надо обновить до 1.1.19+
Status: CLOSED NOTABUG
Alias: None
Product: Sisyphus
Classification: Development
Component: nginx (show other bugs)
Version: unstable
Hardware: all Linux
: P3 major
Assignee: Anton Farygin
QA Contact: qa-sisyphus
URL: http://nginx.org/#2012-04-12
Keywords:
Depends on:
Blocks:
 
Reported: 2013-03-12 15:04 MSK by Michael Shigorin
Modified: 2013-03-13 17:29 MSK (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Shigorin 2013-03-12 15:04:38 MSK 
В ngx_http_mp4_module нашли buffer overflow.
Comment 1 Igor Zubkov 2013-03-13 04:54:26 MSK 
Судя по http://nginx.org/en/security_advisories.html -- наш nginx 1.2.4 уже давно исправлен.

Buffer overflow in the ngx_http_mp4_module
Severity: major
CVE-2012-2089
Not vulnerable: 1.1.19+, 1.0.15+
Vulnerable: 1.1.3-1.1.18, 1.0.7-1.0.14
Comment 2 Anton Farygin 2013-03-13 15:08:25 MSK 
Вам надо - вы и обновляйте, у нас уже давно 1.2.4
Comment 3 Michael Shigorin 2013-03-13 17:29:10 MSK 
Н-да, и куда я смотрел... прошу прощения за спам.