OESA-2022-2023 nginx security update

NGINX is a free, open-source, high-performance HTTP server and reverse proxy,as well as an IMAP/POP3 proxy server. Security Fixes: NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1...

Updated nginx packages fix security vulnerability

Two security issues were identified in the ngxhttpmp4module, which might allow an attacker to cause a worker process crash or worker process memory disclosure by using a specially crafted mp4 file, or might have potential other impact. CVE-2022-41741, CVE-2022-41742...

MGASA-2022-0398 Updated nginx packages fix security vulnerability

Two security issues were identified in the ngxhttpmp4module, which might allow an attacker to cause a worker process crash or worker process memory disclosure by using a specially crafted mp4 file, or might have potential other impact. CVE-2022-41741, CVE-2022-41742...

CVE-2022-43286

Nginx NJS v0.7.2 was discovered to contain a heap-use-after-free bug caused by illegal memory copy in the function njsjsonparseiteratorcall at njsjson.c...

CVE-2022-43285

Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njspromisereactionjob. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input...

NGINX JavaScript 缓冲区错误漏洞

NGINX JavaScript is an extension to the NGINX open source. A buffer error vulnerability exists in NGINX JavaScript versions 0.7.2 through 0.7.4, which stems from a segmentation violation in the njsscopevalidvalue function in njsscope.h. The vulnerability is caused by the use of the...

CVE-2022-43284

Nginx NJS v0.7.2 to v0.7.4 was discovered to contain a segmentation violation via njsscopevalidvalue at njsscope.h. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input...

CVE-2022-43286

CVE-2022-43286 affects the Nginx NJS component: version 0.7.2 . The root cause is a heap-use-after-free caused by an illegal memory copy in the function njs_json_parse_iterator_call located in njs_json.c . CVSS v3.1 scores reported as 9.8 (CRITICAL) with network attack vector, no user interaction...

CVE-2022-43286

Nginx NJS v0.7.2 was discovered to contain a heap-use-after-free bug caused by illegal memory copy in the function njsjsonparseiteratorcall at njsjson.c...

CVE-2022-43285

Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njspromisereactionjob. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input...

PT-2022-5321 · Nginx · Nginx Njs

Name of the Vulnerable Software and Affected Versions: Nginx NJS versions 0.7.2 through 0.7.4 Description: The issue is related to a segmentation violation via the njs scope valid value function at njs scope.h. This could potentially allow a remote attacker to cause a denial of service. The vendo...

CVE-2022-43285

Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njspromisereactionjob. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input...

PT-2022-5322 · Nginx · Nginx Njs

Name of the Vulnerable Software and Affected Versions: Nginx NJS version 0.7.2 Description: The issue is related to a heap-use-after-free bug caused by an illegal memory copy in the njs json parse iterator call function at njs json.c. This bug can be exploited by a remote attacker to execute...

PT-2022-5323 · Nginx · Nginx Njs

Name of the Vulnerable Software and Affected Versions: Nginx NJS version 0.7.4 Description: The issue is related to a buffer overflow in the njs promise reaction job function of the njs interpreter in the nginx server. This could allow a remote attacker to cause a denial of service. The vendor...

Mageia: Security Advisory (MGASA-2022-0398)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-43284

Nginx NJS versions 0.7.2–0.7.4 have a segmentation violation in njs_scope_valid_value (njs_scope.h). Redundant vendor dispute notes that NJS does not operate on untrusted input. Potential impact is unspecified in detail in the sources, but PT-2022-5321 mentions a possible denial of service via th...

NGINX JavaScript 安全漏洞

NGINX JavaScript is an extension to the NGINX open source. A security vulnerability exists in NGINX JavaScript version 0.7.4, which stems from a segmentation violation in the njspromisereactionjob function...

CVE-2022-43286

Nginx NJS v0.7.2 was discovered to contain a heap-use-after-free bug caused by illegal memory copy in the function njsjsonparseiteratorcall at njsjson.c...

CVE-2022-43285

CVE-2022-43285 affects Nginx NJS 0.7.4. The issue is a segmentation violation in the function njs_promise_reaction_job. The vendor disputes the significance, stating NJS does not operate on untrusted input. Practical impact is a potential crash/DoS as described by the PT-2022-5323 entry, which al...

Nginx 资源管理错误漏洞

Nginx is a lightweight web server/reverse proxy server and email IMAP/POP3 proxy server from Nginx, Inc. njs is one of the scripting language components that supports extended NGINX functionality. A security vulnerability exists in Nginx NJS version 0.7.2, which stems from heap-based...