Buffer underflow in src/http/ngxhttpparse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests.

A flaw was reported [1] in nginx versions prior to 1.0.14 and 1.1.17 where contents of previously freed memory could be sent to a client if an upstream server returned a specially crafted HTTP response. This could potentially leak sensitive information to the HTTP client.

This has been corrected upstream [2],[3] and a patch [4] is available for earlier versions of nginx.

[1] http://seclists.org/bugtraq/2012/Mar/65 [2] http://trac.nginx.org/nginx/changeset/4530/nginx [3] http://trac.nginx.org/nginx/changeset/4531/nginx [4] http://nginx.org/download/patch.2012.memory.txt