CVE-2010-2266

2010-06-1514:04:00

Debian Security Bug Tracker

security-tracker.debian.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.005 Low

EPSS

Percentile

74.9%

JSON

nginx 0.8.36 allows remote attackers to cause a denial of service (crash) via certain encoded directory traversal sequences that trigger memory corruption, as demonstrated using the “%c0.%c0.” sequence.

OSVersionArchitecturePackageVersionFilename
Debian12allnginx< 1.22.1-9nginx_1.22.1-9_all.deb
Debian11allnginx< 1.18.0-6.1+deb11u3nginx_1.18.0-6.1+deb11u3_all.deb
Debian10allnginx< 1.14.2-2+deb10u4nginx_1.14.2-2+deb10u4_all.deb
Debian999allnginx< 1.24.0-2nginx_1.24.0-2_all.deb
Debian13allnginx< 1.24.0-2nginx_1.24.0-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	nginx	< 1.22.1-9	nginx_1.22.1-9_all.deb
Debian	11	all	nginx	< 1.18.0-6.1+deb11u3	nginx_1.18.0-6.1+deb11u3_all.deb
Debian	10	all	nginx	< 1.14.2-2+deb10u4	nginx_1.14.2-2+deb10u4_all.deb
Debian	999	all	nginx	< 1.24.0-2	nginx_1.24.0-2_all.deb
Debian	13	all	nginx	< 1.24.0-2	nginx_1.24.0-2_all.deb