Buffer overread in the ngx_http_mp4_module

🗓️ 14 Aug 2024 14:32:33Reported by NginxType

Buffer overread in ngx_http_mp4_module, Severity: low, CVE-2024-7347. Not vulnerable: 1.27.1+, 1.26.2+. Vulnerable: 1.5.13-1.27.

Reporter	Title	Published	Views	Family All 184
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	19 Dec 202416:32	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Nginx affects IBM Integrated Analytics System (Sailfish)[CVE-2023-44487, CVE-2024-7347].	17 May 202509:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Nginx	28 Oct 202419:37	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in nginx affects IBM Robotic Process Automatin for Cloud Pak and may result in a denial of service (CVE-2024-7347)	28 Jan 202522:08	–	ibm
FreeBSD	nginx -- Vulnerability in the ngx_http_mp4_module	14 Aug 202400:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2024-707)	9 Sep 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2 : nginx (ALASNGINX1-2024-007)	9 Sep 202400:00	–	nessus
Tenable Nessus	AlmaLinux 9 : nginx:1.22 (ALSA-2025:3261)	31 Mar 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : nginx (ALSA-2025:7402)	21 May 202500:00	–	nessus

Vulners

Node

f5 nginxRange1.5.13–1.27.0

Source	Link
mailman	www.mailman.nginx.org/pipermail/nginx-announce/2024/UUOCLLONPR6244YQYU65PO5LB7JDYCWM.html

14 Aug 2024 14:32Current

5.1Medium risk

Vulners AI Score5.1

CVSS 3.14.7

CVSS 45.7

EPSS0.00202

SSVC