CVE

Id
61975  
CVE No.
CVE-2013-2028  
Status
Candidate  
Description
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow.  
Phase
Assigned (20130219)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
620475 61975 CVE-2013-2028 MLIST:[nginx-announce] 20130507 nginx security advisory (CVE-2013-2028)  View
620476 61975 CVE-2013-2028 URL:http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html  View
620477 61975 CVE-2013-2028 MISC:http://nginx.org/download/patch.2013.chunked.txt  View
620478 61975 CVE-2013-2028 MISC:http://packetstormsecurity.com/files/121675/Nginx-1.3.9-1.4.0-Denial-Of-Service.html  View
620479 61975 CVE-2013-2028 MISC:http://www.vnsecurity.net/2013/05/analysis-of-nginx-cve-2013-2028/  View
620480 61975 CVE-2013-2028 MISC:https://github.com/rapid7/metasploit-framework/pull/1834  View
620481 61975 CVE-2013-2028 FEDORA:FEDORA-2013-7560  View
620482 61975 CVE-2013-2028 URL:http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105176.html  View
620483 61975 CVE-2013-2028 GENTOO:GLSA-201310-04  View
620484 61975 CVE-2013-2028 URL:http://security.gentoo.org/glsa/glsa-201310-04.xml  View
620485 61975 CVE-2013-2028 BID:59699  View
620486 61975 CVE-2013-2028 URL:http://www.securityfocus.com/bid/59699  View
620487 61975 CVE-2013-2028 OSVDB:93037  View
620488 61975 CVE-2013-2028 URL:http://www.osvdb.org/93037  View
620489 61975 CVE-2013-2028 SECUNIA:55181  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
24720 JVNDB-2013-006295 CloudBees Jenkins におけるクロスサイトスクリプティングの脆弱性 CloudBees Jenkins には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2013-2033 61975 2.1 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-006295.html  View