[SECURITY] Fedora 19 Update: nginx-1.4.7-3.fc19

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

Medium: nginx

Issue Overview: A virtual host confusion issue was found in nginx, allowing HTTPS connections for one origin to be redirected to the virtual host of a different origin. This leads to a variety of issues, such as cookie theft and session hijacking. It could be triggered from a cross-site scripting...

[SECURITY] Fedora 21 Update: nginx-1.6.2-2.fc21

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

Fedora 21 : nginx-1.6.2-2.fc21 (2014-11251)

Security fix for CVE-2014-3616 - Create nginx-filesystem subpackage Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

[USN-2351-1] nginx vulnerability

========================================================================== Ubuntu Security Notice USN-2351-1 September 22, 2014 nginx vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

nginx information leakage

Invalid cached session reusage...

Mango cloud KODExlporer design flaws lead to arbitrary code execution-vulnerability warning-the black bar safety net

http://www.wooyun.org/bugs/wooyun-2014-066056 About the content: http://www.kalcaddle.com The test account permissions: default The problem is in the renaming. I upload. php file is not executed, ok, then change suffix to. ph After a successful upload, 改名.php, tips no limit. Well, 改名.php ,rename ...

Ubuntu 14.04 LTS : nginx vulnerability (USN-2351-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2351-1 advisory. Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that nginx incorrectly reused cached SSL sessions. An attacker could possibly use this issue in certa...

Ubuntu: Security Advisory (USN-2351-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-2351-1 nginx vulnerability

Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that nginx incorrectly reused cached SSL sessions. An attacker could possibly use this issue in certain configurations to obtain access to information from a different virtual host...

USN-2351-1: nginx vulnerability

Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that nginx incorrectly reused cached SSL sessions. An attacker could possibly use this issue in certain configurations to obtain access to information from a different virtual host...

Debian DSA-3029-1 : nginx - security update

Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that it was possible to reuse cached SSL sessions in unrelated contexts, allowing virtual host confusion attacks in some configurations by an attacker in a privileged network position. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

[SECURITY] [DSA 3029-1] nginx security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3029-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 20, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3029-1] nginx security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3029-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 20, 2014 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 3029-1 (nginx - security update)

Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that it was possible to reuse cached SSL sessions in unrelated contexts, allowing virtual host confusion attacks in some configurations by an attacker in a privileged network position. OpenVAS Vulnerability Test $Id: deb3029.nasl 6735...

DSA-3029-1 nginx - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3029-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security fix for the ALT Linux 9 package nginx version 1.6.2-alt1

Sept. 18, 2014 Denis Smirnov 1.6.2-alt1 - 1.6.2 - CVE-2014-3616...

[SECURITY] [DLA 55-1] nginx security update

Package : nginx Version : 0.7.67-3+squeeze4 CVE ID : CVE-2014-3616 Antoine Delignat-Lavaud discovered that it was possible to reuse SSL sessions in unrelated contexts if a shared SSL session cache or the same TLS session ticket key was used for multiple "server" blocks...

CVE-2014-3616

nginx 0.5.6 through 1.7.4, when using the same shared sslsessioncache or sslsessionticketkey for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks...