A similar security issue to CVE-2013-2028 was identified [1] for versions of nginx if proxypass to untrusted upstream HTTP servers are used, which could lead to a denial of service or a disclosure of a worker process' memory.

The problem affects nginx 1.1.4 - 1.2.8, 1.3.0 - 1.4.0 and was assigned the name CVE-2013-2070, so only Fedora 18 is affected.

http://nginx.org/download/patch.2013.proxy.txt

[1] http://www.openwall.com/lists/oss-security/2013/05/13/3

The ngxhttpparsechunked function in http/ngxhttpparse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow.

A vulnerability was found in nginx code responsible for saving client request body to a temporary file. A specially crafted request might result in worker process crash due to a NULL pointer dereference while writing client request body to a temporary file.

External references:

http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html

Upstream patches:

[nginx 1.9.13 - 1.11.0] http://nginx.org/download/patch.2016.write.txt

[nginx 1.3.9 - 1.9.12] http://nginx.org/download/patch.2016.write2.txt