CVE-2012-2089: Buffer Overflow
Buffer overflow in ngxhttpmp4module.c in the ngxhttpmp4module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted MP4 file.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2089?
CVE-2012-2089 has a high severity rating due to its potential to allow remote attackers to execute arbitrary code or cause a denial of service.
How do I fix CVE-2012-2089?
To fix CVE-2012-2089, upgrade nginx to version 1.0.15 or later for 1.0.x versions and to version 1.1.19 or later for 1.1.x versions.
Which versions of nginx are affected by CVE-2012-2089?
CVE-2012-2089 affects nginx versions from 1.0.7 to 1.0.14 and from 1.1.3 to 1.1.18.
Can CVE-2012-2089 be exploited through a crafted MP4 file?
Yes, CVE-2012-2089 can be exploited by sending a crafted MP4 file to the nginx server.
What types of systems are impacted by CVE-2012-2089?
CVE-2012-2089 impacts systems running affected versions of nginx and specific Fedora releases, such as Fedora 15, 16, and 17.