CVE-2013-2028: Buffer Overflow
The ngxhttpparsechunked function in http/ngxhttpparse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2028?
CVE-2013-2028 has a high severity rating due to its potential for remote code execution and denial of service.
How do I fix CVE-2013-2028?
To fix CVE-2013-2028, upgrade your Nginx installation to version 1.4.1 or later.
What versions of Nginx are affected by CVE-2013-2028?
CVE-2013-2028 affects Nginx versions 1.3.9 through 1.4.0.
Can CVE-2013-2028 lead to arbitrary code execution?
Yes, CVE-2013-2028 can enable remote attackers to execute arbitrary code on vulnerable systems.
What types of systems are impacted by CVE-2013-2028?
CVE-2013-2028 impacts systems running affected versions of Nginx, including certain Fedora distributions.