Multiple vulnerabilities have been found in nginx, the worst of which could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-servers/nginx | * | < 1.30.4-r1 | >= 1.30.4-r1 |
nginx is a robust, small, and high performance HTTP and reverse proxy server.
Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All nginx users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.30.4-r1"
Multiple vulnerabilities have been discovered in nginx, the worst of which could result in denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-servers/nginx | * | < 1.26.2-r2 | >= 1.26.2-r2 |
nginx is a robust, small, and high performance HTTP and reverse proxy server.
Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All nginx users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.26.2-r2"
A vulnerability in nginx could lead to remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-servers/nginx | * | < 1.21.0 | >= 1.20.1:0, >= 1.21.0:mainline |
nginx is a robust, small, and high performance HTTP and reverse proxy server.
It was discovered that nginx did not properly handle DNS responses when “resolver” directive is used.
A remote attacker, able to provide DNS responses to a nginx instance, could cause the execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All nginx users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.20.1"
All nginx mainline users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.21.0:mainline"
Gentoo's NGINX ebuilds are vulnerable to privilege escalation due to the way log files are handled.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-servers/nginx | * | < 1.10.2-r3 | >= 1.10.2-r3 |
nginx is a robust, small, and high performance HTTP and reverse proxy server.
It was discovered that Gentoo’s default NGINX installation applied similar problematic permissions on “/var/log/nginx” as Debian (DSA-3701) and is therefore vulnerable to the same attack described in CVE-2016-1247.
A local attacker, who either is already NGINX’s system user or belongs to NGINX’s group, could potentially escalate privileges.
Ensure that no untrusted user can create files in directories which are used by NGINX (or an NGINX vhost) to store log files.
All NGINX users should upgrade to the latest ebuild revision:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.10.2-r3"
Multiple vulnerabilities have been found in nginx, the worst of which may allow a remote attacker to cause a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-servers/nginx | * | < 1.10.1 | >= 1.10.1 |
nginx is a robust, small, and high performance HTTP and reverse proxy server.
Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly cause a Denial of Service condition via a crafted packet.
There is no known workaround at this time.
All nginx users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.10.1"
An SSL session fixation vulnerability in nginx may allow remote attackers to obtain sensitive information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-servers/nginx | * | < 1.7.6 | >= 1.7.6 |
nginx is a robust, small, and high performance HTTP and reverse proxy server.
An SSL session fixation vulnerability has been found in nginx when multiple servers use the same shared ssl_session_cache or ssl_session_ticket_key.
A remote attacker may be able to obtain sensitive information.
There is no known workaround at this time.
All nginx users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.7.6"
A vulnerability has been found in nginx which may allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-servers/nginx | * | < 1.4.7 | >= 1.4.7 |
nginx is a robust, small, and high performance HTTP and reverse proxy server.
A bug in the SPDY implementation in nginx was found which might cause a heap memory buffer overflow in a worker process by using a specially crafted request. The SPDY implementation is not enabled in default configurations.
A remote attacker could cause execution of arbitrary code by using a specially crafted request.
Disable the spdy module in NGINX_MODULES_HTTP.
All nginx users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.4.7"
Multiple vulnerabilities have been found in nginx, the worst of which may allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-servers/nginx | * | < 1.4.1-r2 | >= 1.4.1-r2 |
nginx is a robust, small, and high performance HTTP and reverse proxy server.
Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below for details.
A remote attacker could send a specially crafted request, possibly resulting in execution of arbitrary code with the privileges of the process, or a Denial of Service condition. Furthermore, a context-dependent attacker may be able to obtain sensitive information.
There is no known workaround at this time.
All nginx users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.4.1-r2"
A buffer overflow vulnerability in nginx could result in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-servers/nginx | * | < 1.0.15 | >= 1.0.15 |
nginx is a robust, small, and high performance HTTP and reverse proxy server.
An error in ngx_http_mp4_module.c could cause a buffer overflow.
NOTE: nginx must have been emerged with USE="nginx_modules_http_mp4" in order to be affected by this vulnerability.
A remote attacker could entice a user to place a specially crafted MP4 file on the nginx server, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All nginx users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.0.15"
Multiple vulnerabilities have been found in nginx, the worst of which may allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-servers/nginx | * | < 1.0.14 | >= 1.0.14 |
nginx is a robust, small, and high performance HTTP and reverse proxy server.
Multiple vulnerabilities have been found in nginx:
A remote attacker could possibly execute arbitrary code with the privileges of the nginx process, cause a Denial of Service condition, create or overwrite arbitrary files, or obtain sensitive information.
There is no known workaround at this time.
All nginx users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.0.14"
A buffer underflow vulnerability in the request URI processing of nginx might enable remote attackers to execute arbitrary code or cause a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-servers/nginx | * | < 0.7.62 | >= 0.5.38 (revision), >= 0.6.39 (revision), >= 0.7.62 |
nginx is a robust, small and high performance HTTP and reverse proxy server.
Chris Ries reported a heap-based buffer underflow in the ngx_http_parse_complex_uri() function in http/ngx_http_parse.c when parsing the request URI.
A remote attacker might send a specially crafted request URI to a nginx server, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the server, or a Denial of Service. NOTE: By default, nginx runs as the "nginx" user.
There is no known workaround at this time.
All nginx 0.5.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-0.5.38"
All nginx 0.6.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-0.6.39"
All nginx 0.7.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-0.7.62"