Heap-based buffer overflow in compression-pointer processing in core/ngxresolver.c in nginx before 1.0.10 allows remote resolvers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long response.

A flaw was reported [1] in nginx versions prior to 1.0.14 and 1.1.17 where contents of previously freed memory could be sent to a client if an upstream server returned a specially crafted HTTP response. This could potentially leak sensitive information to the HTTP client.

This has been corrected upstream [2],[3] and a patch [4] is available for earlier versions of nginx.

[1] http://seclists.org/bugtraq/2012/Mar/65 [2] http://trac.nginx.org/nginx/changeset/4530/nginx [3] http://trac.nginx.org/nginx/changeset/4531/nginx [4] http://nginx.org/download/patch.2012.memory.txt