onyx --cves cve-2012-1180
CVE-2012-1180
- score
- <0.1
- cvss
- 5.0
- epss
- 10.6%
- published
- 2012-04-17
- kev added
- —
- first seen
nginx < 1.0.14 and < 1.1.17 contain a use-after-free caused by improper handling of backend responses, letting remote attackers obtain sensitive information from process memory, exploit requires crafted backend response and client request.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 19
- http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076671.html
- http://www.securityfocus.com/bid/52578
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74191
- http://www.openwall.com/lists/oss-security/2012/03/15/5
- http://nginx.org/download/patch.2012.memory.txt
- http://trac.nginx.org/nginx/changeset/4530/nginx
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077966.html
- http://security.gentoo.org/glsa/glsa-201203-22.xml
- http://www.securitytracker.com/id?1026827
- http://nginx.org/en/security_advisories.html
- http://trac.nginx.org/nginx/changeset/4531/nginx
- http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076646.html
- http://secunia.com/advisories/48465
- https://bugzilla.redhat.com/show_bug.cgi?id=803856
- http://seclists.org/bugtraq/2012/Mar/65
- http://secunia.com/advisories/48577
- http://www.debian.org/security/2012/dsa-2434
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:043
- http://www.openwall.com/lists/oss-security/2012/03/15/9