All the vulnerabilites related to F5 - NGINX

var-201707-1309

Vulnerability from variot

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request. nginx is prone to a remote integer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. Attackers can exploit this issue to obtain sensitive information or may crash the application resulting in a denial-of-service condition. nginx 0.5.6 through 1.13.2 are vulnerable. Nginx is a lightweight web server/reverse proxy server and email (IMAP/POP3) proxy server developed by Russian programmer Igor Sysoev. The range filter module is one of the range filter modules.

For the oldstable distribution (jessie), this problem has been fixed in version 1.6.2-5+deb8u5.

For the stable distribution (stretch), this problem has been fixed in version 1.10.3-1+deb9u1.

For the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your nginx packages.

Ubuntu Security Notice USN-3352-1 July 13, 2017

nginx vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 17.04
Ubuntu 16.10
Ubuntu 16.04 LTS
Ubuntu 14.04 LTS

Summary:

nginx could be made to expose sensitive information over the network. A remote attacker could use this to expose sensitive information.

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.04: nginx-common 1.10.3-1ubuntu3.1 nginx-core 1.10.3-1ubuntu3.1 nginx-extras 1.10.3-1ubuntu3.1 nginx-full 1.10.3-1ubuntu3.1 nginx-light 1.10.3-1ubuntu3.1

Ubuntu 16.10: nginx-common 1.10.1-0ubuntu1.3 nginx-core 1.10.1-0ubuntu1.3 nginx-extras 1.10.1-0ubuntu1.3 nginx-full 1.10.1-0ubuntu1.3 nginx-light 1.10.1-0ubuntu1.3

Ubuntu 16.04 LTS: nginx-common 1.10.3-0ubuntu0.16.04.2 nginx-core 1.10.3-0ubuntu0.16.04.2 nginx-extras 1.10.3-0ubuntu0.16.04.2 nginx-full 1.10.3-0ubuntu0.16.04.2 nginx-light 1.10.3-0ubuntu0.16.04.2

Ubuntu 14.04 LTS: nginx-common 1.4.6-1ubuntu3.8 nginx-core 1.4.6-1ubuntu3.8 nginx-extras 1.4.6-1ubuntu3.8 nginx-full 1.4.6-1ubuntu3.8 nginx-light 1.4.6-1ubuntu3.8

In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

===================================================================== Red Hat Security Advisory

Synopsis: Low: rh-nginx110-nginx security update Advisory ID: RHSA-2017:2538-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2017:2538 Issue date: 2017-08-28 CVE Names: CVE-2017-7529 =====================================================================

Summary:

An update for rh-nginx110-nginx is now available for Red Hat Software Collections.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Relevant releases/architectures:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64

Description:

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage. A remote attacker could possibly exploit this flaw to disclose parts of the cache file header, or, if used in combination with third party modules, disclose potentially sensitive memory by sending specially crafted HTTP requests. (CVE-2017-7529)

Red Hat would like to thank the Nginx project for reporting this issue.

Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Package List:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):

Source: rh-nginx110-nginx-1.10.2-8.el6.src.rpm

x86_64: rh-nginx110-nginx-1.10.2-8.el6.x86_64.rpm rh-nginx110-nginx-debuginfo-1.10.2-8.el6.x86_64.rpm rh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el6.x86_64.rpm rh-nginx110-nginx-mod-http-perl-1.10.2-8.el6.x86_64.rpm rh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el6.x86_64.rpm rh-nginx110-nginx-mod-mail-1.10.2-8.el6.x86_64.rpm rh-nginx110-nginx-mod-stream-1.10.2-8.el6.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):

Source: rh-nginx110-nginx-1.10.2-8.el6.src.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):

Source: rh-nginx110-nginx-1.10.2-8.el6.src.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):

Source: rh-nginx110-nginx-1.10.2-8.el7.src.rpm

x86_64: rh-nginx110-nginx-1.10.2-8.el7.x86_64.rpm rh-nginx110-nginx-debuginfo-1.10.2-8.el7.x86_64.rpm rh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el7.x86_64.rpm rh-nginx110-nginx-mod-http-perl-1.10.2-8.el7.x86_64.rpm rh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el7.x86_64.rpm rh-nginx110-nginx-mod-mail-1.10.2-8.el7.x86_64.rpm rh-nginx110-nginx-mod-stream-1.10.2-8.el7.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):

Source: rh-nginx110-nginx-1.10.2-8.el7.src.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):

Source: rh-nginx110-nginx-1.10.2-8.el7.src.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2017-7529 https://access.redhat.com/security/updates/classification/#low

Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

iD8DBQFZpJOQXlSAg2UNWIIRAmScAJ4wJSfq0I+2JBvww6c9AkJKZx4YAACdHwbT Rf+yBkpEe91OHNNto3rboqM= =rlDh -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

APPLE-SA-2021-09-20-4 Xcode 13

Xcode 13 addresses the following issues.

IDE Xcode Server Available for: macOS Big Sur 11.3 and later Impact: Multiple issues in nginx Description: Multiple issues were addressed by updating nginx to version 1.21.0. CVE-2016-0742 CVE-2016-0746 CVE-2016-0747 CVE-2017-7529 CVE-2018-16843 CVE-2018-16844 CVE-2018-16845 CVE-2019-20372

Installation note:

Xcode 13 may be obtained from:

https://developer.apple.com/xcode/downloads/

To check that the Xcode has been updated:

Select Xcode in the menu bar
Select About Xcode
The version after applying this update will be "Xcode 13"

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201707-1309",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "nginx",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.12.1"
      },
      {
        "model": "enterprise",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "puppet",
        "version": "2017.1.1"
      },
      {
        "model": "enterprise",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "puppet",
        "version": "2017.2.3"
      },
      {
        "model": "enterprise",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "puppet",
        "version": "2017.1.0"
      },
      {
        "model": "nginx",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.13.2"
      },
      {
        "model": "enterprise",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "puppet",
        "version": "2017.2.1"
      },
      {
        "model": "enterprise",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "puppet",
        "version": "2016.4.7"
      },
      {
        "model": "xcode",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "13.0"
      },
      {
        "model": "nginx",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.13.0"
      },
      {
        "model": "nginx",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "nginx",
        "version": "1.11.12"
      },
      {
        "model": "nginx",
        "scope": null,
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": null
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "1.11.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "1.13.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "1.11.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "1.11.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "1.13.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "1.11.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "1.13.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "1.11.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "1.11.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.11.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.10.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.10.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.9.15"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.9.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.9.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.8.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.7.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.6.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.4.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.16"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.15"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.2.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.18"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.17"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "0.9.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "0.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "0.8.55"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "0.8.36"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "0.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "0.7.69"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "0.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "0.6.39"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "0.6.18"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "0.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "0.5.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.6.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.6.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.4.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.4.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.4.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.2.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.19"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.16"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.15"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.15"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.0"
      },
      {
        "model": "nginx",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.13.3"
      },
      {
        "model": "nginx",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.12.1"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "99534"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006088"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7529"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-563"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.12.1",
                "versionStartIncluding": "0.5.6",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.13.2",
                "versionStartIncluding": "1.13.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2017.1.1",
                "versionStartIncluding": "2017.1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2017.2.3",
                "versionStartIncluding": "2017.2.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2016.4.7",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "13.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-7529"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The vendor reported this issue.",
    "sources": [
      {
        "db": "BID",
        "id": "99534"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2017-7529",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.0,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2017-7529",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-115732",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2017-7529",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2017-7529",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201707-563",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-115732",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2017-7529",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-115732"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-7529"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006088"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7529"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-563"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request. nginx is prone to a remote integer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. \nAttackers can exploit this issue to obtain sensitive information or may crash the application resulting in a denial-of-service condition. \nnginx 0.5.6 through 1.13.2 are vulnerable. Nginx is a lightweight web server/reverse proxy server and email (IMAP/POP3) proxy server developed by Russian programmer Igor Sysoev. The range filter module is one of the range filter modules. \n\nFor the oldstable distribution (jessie), this problem has been fixed\nin version 1.6.2-5+deb8u5. \n\nFor the stable distribution (stretch), this problem has been fixed in\nversion 1.10.3-1+deb9u1. \n\nFor the unstable distribution (sid), this problem will be fixed soon. \n\nWe recommend that you upgrade your nginx packages. \n==========================================================================\nUbuntu Security Notice USN-3352-1\nJuly 13, 2017\n\nnginx vulnerability\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 17.04\n- Ubuntu 16.10\n- Ubuntu 16.04 LTS\n- Ubuntu 14.04 LTS\n\nSummary:\n\nnginx could be made to expose sensitive information over the network. A remote attacker could use this to expose\nsensitive information. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 17.04:\n  nginx-common                    1.10.3-1ubuntu3.1\n  nginx-core                      1.10.3-1ubuntu3.1\n  nginx-extras                    1.10.3-1ubuntu3.1\n  nginx-full                      1.10.3-1ubuntu3.1\n  nginx-light                     1.10.3-1ubuntu3.1\n\nUbuntu 16.10:\n  nginx-common                    1.10.1-0ubuntu1.3\n  nginx-core                      1.10.1-0ubuntu1.3\n  nginx-extras                    1.10.1-0ubuntu1.3\n  nginx-full                      1.10.1-0ubuntu1.3\n  nginx-light                     1.10.1-0ubuntu1.3\n\nUbuntu 16.04 LTS:\n  nginx-common                    1.10.3-0ubuntu0.16.04.2\n  nginx-core                      1.10.3-0ubuntu0.16.04.2\n  nginx-extras                    1.10.3-0ubuntu0.16.04.2\n  nginx-full                      1.10.3-0ubuntu0.16.04.2\n  nginx-light                     1.10.3-0ubuntu0.16.04.2\n\nUbuntu 14.04 LTS:\n  nginx-common                    1.4.6-1ubuntu3.8\n  nginx-core                      1.4.6-1ubuntu3.8\n  nginx-extras                    1.4.6-1ubuntu3.8\n  nginx-full                      1.4.6-1ubuntu3.8\n  nginx-light                     1.4.6-1ubuntu3.8\n\nIn general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Low: rh-nginx110-nginx security update\nAdvisory ID:       RHSA-2017:2538-01\nProduct:           Red Hat Software Collections\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2017:2538\nIssue date:        2017-08-28\nCVE Names:         CVE-2017-7529 \n=====================================================================\n\n1. Summary:\n\nAn update for rh-nginx110-nginx is now available for Red Hat Software\nCollections. \n\nRed Hat Product Security has rated this update as having a security impact\nof Low. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64\n\n3. Description:\n\nNginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and\nIMAP protocols, with a strong focus on high concurrency, performance and\nlow memory usage. A remote attacker could possibly\nexploit this flaw to disclose parts of the cache file header, or, if used\nin combination with third party modules, disclose potentially sensitive\nmemory by sending specially crafted HTTP requests. (CVE-2017-7529)\n\nRed Hat would like to thank the Nginx project for reporting this issue. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Package List:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):\n\nSource:\nrh-nginx110-nginx-1.10.2-8.el6.src.rpm\n\nx86_64:\nrh-nginx110-nginx-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-debuginfo-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-mod-http-perl-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-mod-mail-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-mod-stream-1.10.2-8.el6.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):\n\nSource:\nrh-nginx110-nginx-1.10.2-8.el6.src.rpm\n\nx86_64:\nrh-nginx110-nginx-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-debuginfo-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-mod-http-perl-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-mod-mail-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-mod-stream-1.10.2-8.el6.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nrh-nginx110-nginx-1.10.2-8.el6.src.rpm\n\nx86_64:\nrh-nginx110-nginx-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-debuginfo-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-mod-http-perl-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-mod-mail-1.10.2-8.el6.x86_64.rpm\nrh-nginx110-nginx-mod-stream-1.10.2-8.el6.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):\n\nSource:\nrh-nginx110-nginx-1.10.2-8.el7.src.rpm\n\nx86_64:\nrh-nginx110-nginx-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-debuginfo-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-mod-http-perl-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-mod-mail-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-mod-stream-1.10.2-8.el7.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):\n\nSource:\nrh-nginx110-nginx-1.10.2-8.el7.src.rpm\n\nx86_64:\nrh-nginx110-nginx-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-debuginfo-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-mod-http-perl-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-mod-mail-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-mod-stream-1.10.2-8.el7.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nrh-nginx110-nginx-1.10.2-8.el7.src.rpm\n\nx86_64:\nrh-nginx110-nginx-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-debuginfo-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-mod-http-perl-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-mod-mail-1.10.2-8.el7.x86_64.rpm\nrh-nginx110-nginx-mod-stream-1.10.2-8.el7.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2017-7529\nhttps://access.redhat.com/security/updates/classification/#low\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2017 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niD8DBQFZpJOQXlSAg2UNWIIRAmScAJ4wJSfq0I+2JBvww6c9AkJKZx4YAACdHwbT\nRf+yBkpEe91OHNNto3rboqM=\n=rlDh\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2021-09-20-4 Xcode 13\n\nXcode 13 addresses the following issues. \n\nIDE Xcode Server\nAvailable for: macOS Big Sur 11.3 and later\nImpact: Multiple issues in nginx\nDescription: Multiple issues were addressed by updating nginx to\nversion 1.21.0. \nCVE-2016-0742\nCVE-2016-0746\nCVE-2016-0747\nCVE-2017-7529\nCVE-2018-16843\nCVE-2018-16844\nCVE-2018-16845\nCVE-2019-20372\n\nInstallation note:\n\nXcode 13 may be obtained from:\n\nhttps://developer.apple.com/xcode/downloads/\n\nTo check that the Xcode has been updated:\n\n* Select Xcode in the menu bar\n* Select About Xcode\n* The version after applying this update will be \"Xcode 13\"",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-7529"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006088"
      },
      {
        "db": "BID",
        "id": "99534"
      },
      {
        "db": "VULHUB",
        "id": "VHN-115732"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-7529"
      },
      {
        "db": "PACKETSTORM",
        "id": "143348"
      },
      {
        "db": "PACKETSTORM",
        "id": "143347"
      },
      {
        "db": "PACKETSTORM",
        "id": "143935"
      },
      {
        "db": "PACKETSTORM",
        "id": "164240"
      }
    ],
    "trust": 2.43
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-115732",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-115732"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-7529",
        "trust": 3.3
      },
      {
        "db": "BID",
        "id": "99534",
        "trust": 2.0
      },
      {
        "db": "SECTRACK",
        "id": "1039238",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006088",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-563",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "164240",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.3157",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1701",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "143935",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "143348",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "143347",
        "trust": 0.2
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-96273",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-115732",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-7529",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-115732"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-7529"
      },
      {
        "db": "BID",
        "id": "99534"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006088"
      },
      {
        "db": "PACKETSTORM",
        "id": "143348"
      },
      {
        "db": "PACKETSTORM",
        "id": "143347"
      },
      {
        "db": "PACKETSTORM",
        "id": "143935"
      },
      {
        "db": "PACKETSTORM",
        "id": "164240"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7529"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-563"
      }
    ]
  },
  "id": "VAR-201707-1309",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-115732"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T11:53:03.181000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2017-7529",
        "trust": 0.8,
        "url": "http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html"
      },
      {
        "title": "Nginx range filter Fixes for module digital error vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=71698"
      },
      {
        "title": "Ubuntu Security Notice: nginx vulnerability",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-3352-1"
      },
      {
        "title": "Debian Security Advisories: DSA-3908-1 nginx -- security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=704f48ff7bd09792912d23527ab54543"
      },
      {
        "title": "Debian CVElist Bug Report Logs: nginx: CVE-2017-7529 Integer overflow in the range filter",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=a0f173670cb05b0faed5127f8a0445b1"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2017-894",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=alas-2017-894"
      },
      {
        "title": "Red Hat: CVE-2017-7529",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=cve-2017-7529"
      },
      {
        "title": "Arch Linux Advisories: [ASA-201707-12] nginx-mainline: information disclosure",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories\u0026qid=asa-201707-12"
      },
      {
        "title": "Arch Linux Advisories: [ASA-201707-11] nginx: information disclosure",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories\u0026qid=asa-201707-11"
      },
      {
        "title": "Arch Linux Issues: ",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=cve-2017-7529"
      },
      {
        "title": "nginxpwner",
        "trust": 0.1,
        "url": "https://github.com/stark0de/nginxpwner "
      },
      {
        "title": "cve-2017-7529",
        "trust": 0.1,
        "url": "https://github.com/cved-sources/cve-2017-7529 "
      },
      {
        "title": "nginx-CVE-2017-7529",
        "trust": 0.1,
        "url": "https://github.com/cyberharsh/nginx-cve-2017-7529 "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-7529"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006088"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-563"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-190",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-115732"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006088"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7529"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.0,
        "url": "http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html"
      },
      {
        "trust": 1.8,
        "url": "https://access.redhat.com/errata/rhsa-2017:2538"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/99534"
      },
      {
        "trust": 1.7,
        "url": "https://puppet.com/security/cve/cve-2017-7529"
      },
      {
        "trust": 1.7,
        "url": "https://support.apple.com/kb/ht212818"
      },
      {
        "trust": 1.7,
        "url": "http://seclists.org/fulldisclosure/2021/sep/36"
      },
      {
        "trust": 1.7,
        "url": "http://www.securitytracker.com/id/1039238"
      },
      {
        "trust": 1.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-7529"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-7529"
      },
      {
        "trust": 0.6,
        "url": "https://support.apple.com/en-us/ht212818"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.3157"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1701/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/164240/apple-security-advisory-2021-09-20-4.html"
      },
      {
        "trust": 0.3,
        "url": "http://nginx.org/"
      },
      {
        "trust": 0.3,
        "url": "http://nginx.org/#2017-07-11"
      },
      {
        "trust": 0.3,
        "url": "http://nginx.org/en/security_advisories.html"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/faq"
      },
      {
        "trust": 0.1,
        "url": "https://www.ubuntu.com/usn/usn-3352-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.10.3-0ubuntu0.16.04.2"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.10.3-1ubuntu3.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.4.6-1ubuntu3.8"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.10.1-0ubuntu1.3"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "trust": 0.1,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-7529"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20372"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16843"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/kb/ht201222"
      },
      {
        "trust": 0.1,
        "url": "https://www.apple.com/support/security/pgp/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16845"
      },
      {
        "trust": 0.1,
        "url": "https://developer.apple.com/xcode/downloads/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16844"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0746"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0747"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/ht212818."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0742"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-115732"
      },
      {
        "db": "BID",
        "id": "99534"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006088"
      },
      {
        "db": "PACKETSTORM",
        "id": "143348"
      },
      {
        "db": "PACKETSTORM",
        "id": "143347"
      },
      {
        "db": "PACKETSTORM",
        "id": "143935"
      },
      {
        "db": "PACKETSTORM",
        "id": "164240"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7529"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-563"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-115732"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-7529"
      },
      {
        "db": "BID",
        "id": "99534"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006088"
      },
      {
        "db": "PACKETSTORM",
        "id": "143348"
      },
      {
        "db": "PACKETSTORM",
        "id": "143347"
      },
      {
        "db": "PACKETSTORM",
        "id": "143935"
      },
      {
        "db": "PACKETSTORM",
        "id": "164240"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-7529"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-563"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-07-13T00:00:00",
        "db": "VULHUB",
        "id": "VHN-115732"
      },
      {
        "date": "2017-07-13T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-7529"
      },
      {
        "date": "2017-07-11T00:00:00",
        "db": "BID",
        "id": "99534"
      },
      {
        "date": "2017-08-17T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-006088"
      },
      {
        "date": "2017-07-14T02:16:01",
        "db": "PACKETSTORM",
        "id": "143348"
      },
      {
        "date": "2017-07-14T02:15:51",
        "db": "PACKETSTORM",
        "id": "143347"
      },
      {
        "date": "2017-08-28T21:24:00",
        "db": "PACKETSTORM",
        "id": "143935"
      },
      {
        "date": "2021-09-22T16:28:58",
        "db": "PACKETSTORM",
        "id": "164240"
      },
      {
        "date": "2017-07-13T13:29:00.220000",
        "db": "NVD",
        "id": "CVE-2017-7529"
      },
      {
        "date": "2017-07-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201707-563"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-11-10T00:00:00",
        "db": "VULHUB",
        "id": "VHN-115732"
      },
      {
        "date": "2022-01-24T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-7529"
      },
      {
        "date": "2017-07-11T00:00:00",
        "db": "BID",
        "id": "99534"
      },
      {
        "date": "2017-08-17T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-006088"
      },
      {
        "date": "2022-01-24T16:46:04.030000",
        "db": "NVD",
        "id": "CVE-2017-7529"
      },
      {
        "date": "2023-05-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201707-563"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "143347"
      },
      {
        "db": "PACKETSTORM",
        "id": "143935"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-563"
      }
    ],
    "trust": 0.8
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Nginx of  range filter Module integer overflow vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-006088"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "input validation error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201707-563"
      }
    ],
    "trust": 0.6
  }
}

var-200911-0310

Vulnerability from variot

src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI. The 'nginx' program is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201203-22

                                        http://security.gentoo.org/

Severity: High Title: nginx: Multiple vulnerabilities Date: March 28, 2012 Bugs: #293785, #293786, #293788, #389319, #408367 ID: 201203-22

Synopsis

Multiple vulnerabilities have been found in nginx, the worst of which may allow execution of arbitrary code.

Background

nginx is a robust, small, and high performance HTTP and reverse proxy server.

Affected packages

-------------------------------------------------------------------
 Package              /     Vulnerable     /            Unaffected
-------------------------------------------------------------------

1 www-servers/nginx < 1.0.14 >= 1.0.14

Description

Multiple vulnerabilities have been found in nginx:

The TLS protocol does not properly handle session renegotiation requests (CVE-2009-3555).
The "ngx_http_process_request_headers()" function in ngx_http_parse.c could cause a NULL pointer dereference (CVE-2009-3896).
nginx does not properly sanitize user input for the the WebDAV COPY or MOVE methods (CVE-2009-3898).
The "ngx_resolver_copy()" function in ngx_resolver.c contains a boundary error which could cause a heap-based buffer overflow (CVE-2011-4315).
nginx does not properly parse HTTP header responses which could expose sensitive information (CVE-2012-1180).

Impact

A remote attacker could possibly execute arbitrary code with the privileges of the nginx process, cause a Denial of Service condition, create or overwrite arbitrary files, or obtain sensitive information.

Workaround

There is no known workaround at this time.

Resolution

All nginx users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.0.14"

References

[ 1 ] CVE-2009-3555 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3555 [ 2 ] CVE-2009-3896 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3896 [ 3 ] CVE-2009-3898 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3898 [ 4 ] CVE-2011-4315 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4315 [ 5 ] CVE-2012-1180 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1180

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201203-22.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5 . ----------------------------------------------------------------------

TITLE: Gentoo update for nginx

SECUNIA ADVISORY ID: SA48577

VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/48577/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=48577

RELEASE DATE: 2012-03-28

DISCUSS ADVISORY: http://secunia.com/advisories/48577/#comments

AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)

http://secunia.com/advisories/48577/

ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS

https://ca.secunia.com/?page=viewadvisory&vuln_id=48577

ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING

http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

DESCRIPTION: Gentoo has issued an update for nginx. This fixes a weakness, a security issue, and multiple vulnerabilities, which can be exploited by malicious people to disclose certain sensitive information, bypass certain security restrictions, cause a DoS (Denial of Service), manipulate certain data, and potentially compromise a vulnerable system.

For more information: SA36751 SA36818 SA37291 SA46798 SA48366

SOLUTION: Update to "www-servers/nginx-1.0.14" or later.

ORIGINAL ADVISORY: GLSA 201203-22: http://www.gentoo.org/security/en/glsa/glsa-201203-22.xml

OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200911-0310",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.35"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.32"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.4.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.30"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.34"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.2.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.21"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.49"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.45"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.45"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.42"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.29"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.39"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.47"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.22"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.34"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.19"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.22"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.33"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.24"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.24"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.59"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.50"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.36"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.30"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.22"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.21"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.51"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.21"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.16"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.25"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.4.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.34"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.33"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.26"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.38"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.21"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.41"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.20"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.17"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.20"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.30"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.61"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.48"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.30"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.16"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.25"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.57"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.27"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.37"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.25"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.17"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.32"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.18"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.35"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.17"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.19"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.42"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.4.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.27"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.22"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.29"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.31"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.43"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.46"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.2.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.39"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.54"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.29"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.61"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.43"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.23"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.46"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.30"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.55"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.56"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.21"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.20"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.50"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.38"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.38"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.40"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.2.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.28"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.60"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.28"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.31"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.29"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.15"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.36"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.32"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.2.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.23"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.54"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.24"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.57"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.53"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.16"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.15"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.4.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.18"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.22"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.36"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.51"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.33"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.36"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.56"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.39"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.15"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.44"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.49"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.15"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.19"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.18"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.33"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.19"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.2.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.4.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.34"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.34"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.47"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.28"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.23"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.55"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.16"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.4.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.4.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.4.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.32"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.25"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.19"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.4.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.26"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.4.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.52"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.23"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.37"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.26"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.35"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.15"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.37"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.40"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.26"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.4.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.33"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.48"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.53"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.31"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.28"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.23"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.27"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.41"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.38"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.37"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.2.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.59"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.17"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.44"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.52"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.45"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.43"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.24"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.28"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.24"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.26"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.18"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.20"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.27"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.17"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.4.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.31"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.36"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.31"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "nginx",
        "version": "0.6.1516"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.37"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.25"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.60"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.35"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.29"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.27"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.4.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.2.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.32"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.41"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.58"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.42"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.4.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.18"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.40"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.3.44"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.20"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.58"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.35"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "0.8.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "0.1.0 to  0.4.14"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "0.6.x"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "0.7.x"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "0.8.x"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "0.6.39"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "0.5.x"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "0.5.38"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "0.7.62"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.3.49"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.3.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.3.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.3.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.3.48"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.3.46"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.3.47"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.3.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.3.50"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.3.11"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.7.61"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.7"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.6.38"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.6.32"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.6"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.5.37"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.5"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.4.14"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.4.13"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.4"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0"
      },
      {
        "model": "linux",
        "scope": null,
        "trust": 0.3,
        "vendor": "gentoo",
        "version": null
      },
      {
        "model": "linux sparc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux s/390",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux mipsel",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux mips",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux m68k",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux ia-64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux ia-32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux hppa",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux armel",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux arm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux alpha",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux sparc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux s/390",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux mipsel",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux mips",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux m68k",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux ia-64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux ia-32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux hppa",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux armel",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux arm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux alpha",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "36839"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-005107"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-3896"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200911-243"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.44:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.36:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.37:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.41:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.40:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.33:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.25:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.18:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.17:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.19:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.26:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.27:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.34:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.35:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.4.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.4.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.4.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.4.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.58:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.59:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.52:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.31:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.30:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.23:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.22:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.15:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.16:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.19:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:nginx:nginx:0.6.1516:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.24:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.25:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.33:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.36:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.38:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.41:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.42:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.49:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.50:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.25:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.33:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.8.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.8.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.8.14:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.54:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.59:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.61:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.20:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.49:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.46:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.2.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.2.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.43:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.40:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.45:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.44:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.37:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.36:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.28:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.29:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.21:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.14:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.16:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.15:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.14:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.22:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.23:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.30:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.31:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.4.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.4.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.4.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.54:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.55:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.27:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.26:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.19:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.18:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.15:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.48:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.2.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.2.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.45:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.42:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.43:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.42:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.35:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.34:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.26:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.27:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.19:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.20:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.18:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.17:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.24:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.25:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.33:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.4.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.4.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.4.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.4.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.56:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.57:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.53:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.51:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.33:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.25:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.24:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.17:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.17:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.14:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.22:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.23:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.37:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.36:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.35:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.34:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.39:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.40:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.47:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.48:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.24:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.23:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.22:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.31:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.30:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.8.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.8.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.53:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.56:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.8.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.14:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.15:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.20:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.21:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.35:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.34:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.29:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.28:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.31:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.37:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.38:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.45:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.46:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.21:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.28:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.29:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.36:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.8.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.8.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.55:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.58:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.8.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.8.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.17:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.16:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.47:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.50:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.2.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.41:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.38:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.39:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.39:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.38:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.31:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.30:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.22:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.23:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.24:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.15:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.16:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.20:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.21:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.28:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.1.29:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.4.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.4.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.60:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.61:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.29:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.28:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.21:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.20:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.14:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.5.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.3.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.18:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.26:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.27:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.30:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.6.37:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.43:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.44:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.51:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.52:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.27:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.26:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.35:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.34:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.8.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.8.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.57:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.60:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.8.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.8.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.18:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.19:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:0.7.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2009-3896"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Jasson Bell",
    "sources": [
      {
        "db": "BID",
        "id": "36839"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200911-243"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2009-3896",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 5.0,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2009-3896",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "VHN-41342",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2009-3896",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200911-243",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-41342",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-41342"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-005107"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-3896"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200911-243"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI. The \u0027nginx\u0027 program is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. \nAttackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 201203-22\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                            http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: High\n    Title: nginx: Multiple vulnerabilities\n     Date: March 28, 2012\n     Bugs: #293785, #293786, #293788, #389319, #408367\n       ID: 201203-22\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in nginx, the worst of which\nmay allow execution of arbitrary code. \n\nBackground\n==========\n\nnginx is a robust, small, and high performance HTTP and reverse proxy\nserver. \n\nAffected packages\n=================\n\n    -------------------------------------------------------------------\n     Package              /     Vulnerable     /            Unaffected\n    -------------------------------------------------------------------\n  1  www-servers/nginx            \u003c 1.0.14                  \u003e= 1.0.14\n\nDescription\n===========\n\nMultiple vulnerabilities have been found in nginx:\n\n* The TLS protocol does not properly handle session renegotiation\n  requests (CVE-2009-3555). \n* The \"ngx_http_process_request_headers()\" function in ngx_http_parse.c\n  could cause a NULL pointer dereference (CVE-2009-3896). \n* nginx does not properly sanitize user input for the the WebDAV COPY\n  or MOVE methods (CVE-2009-3898). \n* The \"ngx_resolver_copy()\" function in ngx_resolver.c contains a\n  boundary error which could cause a heap-based buffer overflow\n  (CVE-2011-4315). \n* nginx does not properly parse HTTP header responses which could\n  expose sensitive information (CVE-2012-1180). \n\nImpact\n======\n\nA remote attacker could possibly execute arbitrary code with the\nprivileges of the nginx process, cause a Denial of Service condition,\ncreate or overwrite arbitrary files, or obtain sensitive information. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll nginx users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=www-servers/nginx-1.0.14\"\n\nReferences\n==========\n\n[ 1 ] CVE-2009-3555\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3555\n[ 2 ] CVE-2009-3896\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3896\n[ 3 ] CVE-2009-3898\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3898\n[ 4 ] CVE-2011-4315\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4315\n[ 5 ] CVE-2012-1180\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1180\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201203-22.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2012 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n. ----------------------------------------------------------------------\n\nBecome a PSI 3.0 beta tester!\nTest-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. \nDownload it here!\nhttp://secunia.com/psi_30_beta_launch\n\n----------------------------------------------------------------------\n\nTITLE:\nGentoo update for nginx\n\nSECUNIA ADVISORY ID:\nSA48577\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/48577/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=48577\n\nRELEASE DATE:\n2012-03-28\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/48577/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/48577/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=48577\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nGentoo has issued an update for nginx. This fixes a weakness, a\nsecurity issue, and multiple vulnerabilities, which can be exploited\nby malicious people to disclose certain sensitive information, bypass\ncertain security restrictions, cause a DoS (Denial of Service),\nmanipulate certain data, and potentially compromise a vulnerable\nsystem. \n\nFor more information:\nSA36751\nSA36818\nSA37291\nSA46798\nSA48366\n\nSOLUTION:\nUpdate to \"www-servers/nginx-1.0.14\" or later. \n\nORIGINAL ADVISORY:\nGLSA 201203-22:\nhttp://www.gentoo.org/security/en/glsa/glsa-201203-22.xml\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2009-3896"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-005107"
      },
      {
        "db": "BID",
        "id": "36839"
      },
      {
        "db": "VULHUB",
        "id": "VHN-41342"
      },
      {
        "db": "PACKETSTORM",
        "id": "111273"
      },
      {
        "db": "PACKETSTORM",
        "id": "111263"
      }
    ],
    "trust": 2.16
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2009-3896",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "36839",
        "trust": 2.0
      },
      {
        "db": "SECUNIA",
        "id": "48577",
        "trust": 1.8
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2009/11/20/1",
        "trust": 1.7
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2009/11/20/6",
        "trust": 1.7
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2009/11/23/10",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-005107",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200911-243",
        "trust": 0.7
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-87573",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-41342",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "111273",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "111263",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-41342"
      },
      {
        "db": "BID",
        "id": "36839"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-005107"
      },
      {
        "db": "PACKETSTORM",
        "id": "111273"
      },
      {
        "db": "PACKETSTORM",
        "id": "111263"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-3896"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200911-243"
      }
    ]
  },
  "id": "VAR-200911-0310",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-41342"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T10:54:43.254000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://nginx.org/"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-005107"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-119",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-41342"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-005107"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-3896"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.0,
        "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=552035"
      },
      {
        "trust": 1.8,
        "url": "http://security.gentoo.org/glsa/glsa-201203-22.xml"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/36839"
      },
      {
        "trust": 1.7,
        "url": "http://secunia.com/advisories/48577"
      },
      {
        "trust": 1.7,
        "url": "http://www.debian.org/security/2009/dsa-1920"
      },
      {
        "trust": 1.7,
        "url": "https://www.redhat.com/archives/fedora-package-announce/2009-december/msg00428.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.redhat.com/archives/fedora-package-announce/2009-december/msg00442.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.redhat.com/archives/fedora-package-announce/2009-december/msg00449.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.openwall.com/lists/oss-security/2009/11/20/6"
      },
      {
        "trust": 1.7,
        "url": "http://www.openwall.com/lists/oss-security/2009/11/20/1"
      },
      {
        "trust": 1.7,
        "url": "http://www.openwall.com/lists/oss-security/2009/11/23/10"
      },
      {
        "trust": 1.7,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch3.diff.gz"
      },
      {
        "trust": 1.7,
        "url": "http://sysoev.ru/nginx/patch.null.pointer.txt"
      },
      {
        "trust": 1.7,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=539565"
      },
      {
        "trust": 1.6,
        "url": "http://marc.info/?l=nginx\u0026m=125692080328141\u0026w=2"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-3896"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-3896"
      },
      {
        "trust": 0.3,
        "url": "http://nginx.org/"
      },
      {
        "trust": 0.1,
        "url": "http://marc.info/?l=nginx\u0026amp;m=125692080328141\u0026amp;w=2"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2009-3896"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-3898"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2009-3555"
      },
      {
        "trust": 0.1,
        "url": "http://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-1180"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-4315"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-3896"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2009-3898"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-4315"
      },
      {
        "trust": 0.1,
        "url": "http://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1180"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-3555"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/psi_30_beta_launch"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_intelligence/"
      },
      {
        "trust": 0.1,
        "url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=48577"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/48577/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/48577/#comments"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_scanning/personal/"
      },
      {
        "trust": 0.1,
        "url": "http://www.gentoo.org/security/en/glsa/glsa-201203-22.xml"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/about_secunia_advisories/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-41342"
      },
      {
        "db": "BID",
        "id": "36839"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-005107"
      },
      {
        "db": "PACKETSTORM",
        "id": "111273"
      },
      {
        "db": "PACKETSTORM",
        "id": "111263"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-3896"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200911-243"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-41342"
      },
      {
        "db": "BID",
        "id": "36839"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-005107"
      },
      {
        "db": "PACKETSTORM",
        "id": "111273"
      },
      {
        "db": "PACKETSTORM",
        "id": "111263"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-3896"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200911-243"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2009-11-24T00:00:00",
        "db": "VULHUB",
        "id": "VHN-41342"
      },
      {
        "date": "2009-10-27T00:00:00",
        "db": "BID",
        "id": "36839"
      },
      {
        "date": "2012-09-25T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2009-005107"
      },
      {
        "date": "2012-03-29T02:37:12",
        "db": "PACKETSTORM",
        "id": "111273"
      },
      {
        "date": "2012-03-28T06:36:19",
        "db": "PACKETSTORM",
        "id": "111263"
      },
      {
        "date": "2009-11-24T17:30:00.377000",
        "db": "NVD",
        "id": "CVE-2009-3896"
      },
      {
        "date": "2009-10-27T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200911-243"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-11-10T00:00:00",
        "db": "VULHUB",
        "id": "VHN-41342"
      },
      {
        "date": "2015-04-13T20:25:00",
        "db": "BID",
        "id": "36839"
      },
      {
        "date": "2012-09-25T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2009-005107"
      },
      {
        "date": "2021-11-10T15:52:55.747000",
        "db": "NVD",
        "id": "CVE-2009-3896"
      },
      {
        "date": "2023-05-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200911-243"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200911-243"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "nginx of  src/http/ngx_http_parse.c Service disruption in  (DoS) Vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-005107"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200911-243"
      }
    ],
    "trust": 0.6
  }
}

var-201204-0227

Vulnerability from variot

Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted MP4 file. nginx is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions. nginx versions 1.1.3 through 1.1.18 and 1.0.7 through 1.0.14 are vulnerable; other versions may also be affected. nginx is a lightweight web server/reverse proxy server and email (IMAP/POP3) proxy server developed by Russian programmer Igor Sysoev. Failure to do so will result in a denial of service. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201206-07

                                        http://security.gentoo.org/

Severity: Normal Title: nginx: User-assisted execution of arbitrary code Date: June 21, 2012 Bugs: #411751 ID: 201206-07

Synopsis

A buffer overflow vulnerability in nginx could result in the execution of arbitrary code.

Background

nginx is a robust, small, and high performance HTTP and reverse proxy server.

Affected packages

-------------------------------------------------------------------
 Package              /     Vulnerable     /            Unaffected
-------------------------------------------------------------------

1 www-servers/nginx < 1.0.15 >= 1.0.15

Description

An error in ngx_http_mp4_module.c could cause a buffer overflow.

Workaround

There is no known workaround at this time.

Resolution

All nginx users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.0.15"

References

[ 1 ] CVE-2012-2089 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2089

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201206-07.xml

Concerns?

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201204-0227",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "17"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "16"
      },
      {
        "model": "nginx",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.1.18"
      },
      {
        "model": "nginx",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.0.14"
      },
      {
        "model": "nginx",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.1.3"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "15"
      },
      {
        "model": "nginx",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.0.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "1.0.7 to  1.0.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "1.1.3 to  1.1.18"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "igor sysoev",
        "version": "1.1.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "igor sysoev",
        "version": "1.1.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "igor sysoev",
        "version": "1.1.15"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "igor sysoev",
        "version": "1.1.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "igor sysoev",
        "version": "1.1.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "igor sysoev",
        "version": "1.1.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "igor sysoev",
        "version": "1.1.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "igor sysoev",
        "version": "1.1.16"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "igor sysoev",
        "version": "1.1.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "igor sysoev",
        "version": "1.1.10"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "1.1.17"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "1.0.14"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "1.0.9"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "1.0.8"
      },
      {
        "model": "linux",
        "scope": null,
        "trust": 0.3,
        "vendor": "gentoo",
        "version": null
      },
      {
        "model": "sysoev nginx",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "igor",
        "version": "1.1.19"
      },
      {
        "model": "sysoev nginx",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "igor",
        "version": "1.0.15"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "52999"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002087"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-2089"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201204-276"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.0.14",
                "versionStartIncluding": "1.0.7",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.1.18",
                "versionStartIncluding": "1.1.3",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-2089"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Matthew Daley",
    "sources": [
      {
        "db": "BID",
        "id": "52999"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201204-276"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2012-2089",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": true,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "High",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 5.1,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2012-2089",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-55370",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2012-2089",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201204-276",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-55370",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-55370"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002087"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-2089"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201204-276"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted MP4 file. nginx is prone to a buffer-overflow vulnerability because it  fails to perform adequate boundary checks on user-supplied data. \nAttackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions. \nnginx versions 1.1.3 through 1.1.18 and 1.0.7 through 1.0.14 are vulnerable; other versions may also be affected. nginx is a lightweight web server/reverse proxy server and email (IMAP/POP3) proxy server developed by Russian programmer Igor Sysoev. Failure to do so will result in a denial of service. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 201206-07\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                            http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n    Title: nginx: User-assisted execution of arbitrary code\n     Date: June 21, 2012\n     Bugs: #411751\n       ID: 201206-07\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nA buffer overflow vulnerability in nginx could result in the execution\nof arbitrary code. \n\nBackground\n==========\n\nnginx is a robust, small, and high performance HTTP and reverse proxy\nserver. \n\nAffected packages\n=================\n\n    -------------------------------------------------------------------\n     Package              /     Vulnerable     /            Unaffected\n    -------------------------------------------------------------------\n  1  www-servers/nginx            \u003c 1.0.15                  \u003e= 1.0.15\n\nDescription\n===========\n\nAn error in ngx_http_mp4_module.c could cause a buffer overflow. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll nginx users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=www-servers/nginx-1.0.15\"\n\nReferences\n==========\n\n[ 1 ] CVE-2012-2089\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2089\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201206-07.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2012 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-2089"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002087"
      },
      {
        "db": "BID",
        "id": "52999"
      },
      {
        "db": "VULHUB",
        "id": "VHN-55370"
      },
      {
        "db": "PACKETSTORM",
        "id": "114012"
      }
    ],
    "trust": 2.07
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2012-2089",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "52999",
        "trust": 2.0
      },
      {
        "db": "SECTRACK",
        "id": "1026924",
        "trust": 1.7
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2012/04/12/9",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002087",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201204-276",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "114012",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-55370",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-55370"
      },
      {
        "db": "BID",
        "id": "52999"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002087"
      },
      {
        "db": "PACKETSTORM",
        "id": "114012"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-2089"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201204-276"
      }
    ]
  },
  "id": "VAR-201204-0227",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-55370"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T13:40:07.914000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "nginx security advisories",
        "trust": 0.8,
        "url": "http://nginx.org/en/security_advisories.html"
      },
      {
        "title": "nginx-1.0.15",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=42976"
      },
      {
        "title": "nginx-1.1.19",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=42979"
      },
      {
        "title": "nginx-1.1.19",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=42978"
      },
      {
        "title": "nginx-1.0.15",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=42977"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002087"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201204-276"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-120",
        "trust": 1.1
      },
      {
        "problemtype": "CWE-119",
        "trust": 0.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-55370"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002087"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-2089"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.0,
        "url": "http://nginx.org/en/security_advisories.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.securitytracker.com/id?1026924"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/52999"
      },
      {
        "trust": 1.7,
        "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-april/079388.html"
      },
      {
        "trust": 1.7,
        "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-may/079474.html"
      },
      {
        "trust": 1.7,
        "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-may/079467.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.openwall.com/lists/oss-security/2012/04/12/9"
      },
      {
        "trust": 1.7,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74831"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2089"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-2089"
      },
      {
        "trust": 0.3,
        "url": "http://nginx.org/"
      },
      {
        "trust": 0.1,
        "url": "http://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2089"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-2089"
      },
      {
        "trust": 0.1,
        "url": "http://security.gentoo.org/glsa/glsa-201206-07.xml"
      },
      {
        "trust": 0.1,
        "url": "http://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-55370"
      },
      {
        "db": "BID",
        "id": "52999"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002087"
      },
      {
        "db": "PACKETSTORM",
        "id": "114012"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-2089"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201204-276"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-55370"
      },
      {
        "db": "BID",
        "id": "52999"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002087"
      },
      {
        "db": "PACKETSTORM",
        "id": "114012"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-2089"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201204-276"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2012-04-17T00:00:00",
        "db": "VULHUB",
        "id": "VHN-55370"
      },
      {
        "date": "2012-04-12T00:00:00",
        "db": "BID",
        "id": "52999"
      },
      {
        "date": "2012-04-19T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-002087"
      },
      {
        "date": "2012-06-21T15:33:40",
        "db": "PACKETSTORM",
        "id": "114012"
      },
      {
        "date": "2012-04-17T21:55:01.353000",
        "db": "NVD",
        "id": "CVE-2012-2089"
      },
      {
        "date": "2012-04-16T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201204-276"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-11-10T00:00:00",
        "db": "VULHUB",
        "id": "VHN-55370"
      },
      {
        "date": "2015-04-13T21:21:00",
        "db": "BID",
        "id": "52999"
      },
      {
        "date": "2012-04-19T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-002087"
      },
      {
        "date": "2021-11-10T15:57:01.200000",
        "db": "NVD",
        "id": "CVE-2012-2089"
      },
      {
        "date": "2023-05-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201204-276"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201204-276"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "nginx of  ngx_http_mp4_module.c Vulnerable to buffer overflow",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002087"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201204-276"
      }
    ],
    "trust": 0.6
  }
}

var-202210-1347

Vulnerability from variot

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module. F5 BIG-IP and so on are all products of F5 Company in the United States. F5 BIG-IP is an application delivery platform that integrates functions such as network traffic management, application security management, and load balancing. F5 BIG-IQ is a software-based cloud management solution. F5 F5OS-A is an operating system software. F5 BIG-IP, BIG-IQ, F5OS-A, and F5OS-C have buffer error vulnerabilities. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

Debian Security Advisory DSA-5281-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff November 15, 2022 https://www.debian.org/security/faq

Package : nginx CVE ID : CVE-2022-41741 CVE-2022-41742

It was discovered that parsing errors in the mp4 module of Nginx, a high-performance web and reverse proxy server, could result in denial of service, memory disclosure or potentially the execution of arbitrary code when processing a malformed mp4 file.

This module is only enabled in the nginx-extras binary package.

For the stable distribution (bullseye), these problems have been fixed in version 1.18.0-6.1+deb11u3.

We recommend that you upgrade your nginx packages.

For the detailed security status of nginx please refer to its security tracker page at: https://security-tracker.debian.org/tracker/nginx

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmNz9JcACgkQEMKTtsN8 Tjb4tg/7BRkAkF48UvvRjLolxVVuV1paSTRG8ArEeW3fHyA0fxs2UMuRL4ic1vqc i3wxAAfHvYoOnk+QBY20Ly2MN7S7OukNovKE9AZCPulyYkVjtIWNSBeY0PzCU60y RP/KCZAGoGEYi6s4SUrK194ved+7jIcybgLvvGA8FRKW3wTRvzRGMfR6NTLuP7B3 th0C5+KkapE8G5XlHWOIjv1h3Ok40cua7LtYx9RTITJ+wClvkJ6gPcCXXj/CnWWa PUvuEBwyr0PEBXfL9v1P8Eq1MmN+mWU9KeLYxIC+vcJxtpsYL67tMHIGTlDUgDVE FrXrDXi7XP/6hjl7t/J/cTPEwy/twX0emUQcUDlRNlOxh3skSmdPJP7DMu+t9UtQ suepgZ+oHfHh3gs9EWz2zRqbsVO03NjhKo9ebIjhe3H0P39cX3NN5qlSJeNTY45k VBDecnPQnhYqYuzqwXy5ZoUQDcU0Bo7zaUzeYhUsfXqrROV/tj+UTMrM2anHdQ4B kAOrCBpmGP1lLvDs2PzBcWmBtII/5VTKZep05xH0L+dZWDV07j1ekCzv3/kuKiMl GTJQ7yl3fgKjLdkjMFKQIfsm3xdYwzxjOmtEY86tUV0LjtdR2GlJtF4YdIQhA4b1 /R82ZisLfmZ4ElL+ua8iypLOe9reyO4EpVVDkeewFS64Ye1Wn3k=3mDY -----END PGP SIGNATURE----- . ========================================================================= Ubuntu Security Notice USN-5722-1 November 15, 2022

nginx vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 22.10
Ubuntu 22.04 LTS
Ubuntu 20.04 LTS
Ubuntu 18.04 LTS
Ubuntu 16.04 ESM
Ubuntu 14.04 ESM

Summary:

Several security issues were fixed in nginx.

Software Description: - nginx: small, powerful, scalable web/proxy server

Details:

It was discovered that nginx incorrectly handled certain memory operations in the ngx_http_mp4_module module. (CVE-2022-41741, CVE-2022-41742)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.10: nginx 1.22.0-1ubuntu1.1 nginx-common 1.22.0-1ubuntu1.1 nginx-core 1.22.0-1ubuntu1.1 nginx-extras 1.22.0-1ubuntu1.1 nginx-full 1.22.0-1ubuntu1.1 nginx-light 1.22.0-1ubuntu1.1

Ubuntu 22.04 LTS: nginx 1.18.0-6ubuntu14.3 nginx-common 1.18.0-6ubuntu14.3 nginx-core 1.18.0-6ubuntu14.3 nginx-extras 1.18.0-6ubuntu14.3 nginx-full 1.18.0-6ubuntu14.3 nginx-light 1.18.0-6ubuntu14.3

Ubuntu 20.04 LTS: nginx 1.18.0-0ubuntu1.4 nginx-common 1.18.0-0ubuntu1.4 nginx-core 1.18.0-0ubuntu1.4 nginx-extras 1.18.0-0ubuntu1.4 nginx-full 1.18.0-0ubuntu1.4 nginx-light 1.18.0-0ubuntu1.4

Ubuntu 18.04 LTS: nginx 1.14.0-0ubuntu1.11 nginx-common 1.14.0-0ubuntu1.11 nginx-core 1.14.0-0ubuntu1.11 nginx-extras 1.14.0-0ubuntu1.11 nginx-full 1.14.0-0ubuntu1.11 nginx-light 1.14.0-0ubuntu1.11

Ubuntu 16.04 ESM: nginx 1.10.3-0ubuntu0.16.04.5+esm5 nginx-common 1.10.3-0ubuntu0.16.04.5+esm5 nginx-core 1.10.3-0ubuntu0.16.04.5+esm5 nginx-extras 1.10.3-0ubuntu0.16.04.5+esm5 nginx-full 1.10.3-0ubuntu0.16.04.5+esm5 nginx-light 1.10.3-0ubuntu0.16.04.5+esm5

Ubuntu 14.04 ESM: nginx 1.4.6-1ubuntu3.9+esm4 nginx-common 1.4.6-1ubuntu3.9+esm4 nginx-core 1.4.6-1ubuntu3.9+esm4 nginx-extras 1.4.6-1ubuntu3.9+esm4 nginx-full 1.4.6-1ubuntu3.9+esm4 nginx-light 1.4.6-1ubuntu3.9+esm4

In general, a standard system update will make all the necessary changes.

References: https://ubuntu.com/security/notices/USN-5722-1 CVE-2022-41741, CVE-2022-41742

Package Information: https://launchpad.net/ubuntu/+source/nginx/1.22.0-1ubuntu1.1 https://launchpad.net/ubuntu/+source/nginx/1.18.0-6ubuntu14.3 https://launchpad.net/ubuntu/+source/nginx/1.18.0-0ubuntu1.4 https://launchpad.net/ubuntu/+source/nginx/1.14.0-0ubuntu1.11

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202210-1347",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "nginx ingress controller",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.12.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "r1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.23.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "r2"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "10.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "11.0"
      },
      {
        "model": "nginx",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.22.0"
      },
      {
        "model": "nginx ingress controller",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "2.4.0"
      },
      {
        "model": "nginx ingress controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.9.0"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "37"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "36"
      },
      {
        "model": "nginx",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "r27"
      },
      {
        "model": "nginx",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "r22"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "35"
      },
      {
        "model": "nginx",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.1.3"
      },
      {
        "model": "nginx ingress controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "2.0.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.23.1"
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-41741"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2.4.0",
                "versionStartIncluding": "2.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.12.4",
                "versionStartIncluding": "1.9.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:plus:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "r27",
                "versionStartIncluding": "r22",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:1.23.1:*:*:*:open_source:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:1.23.0:*:*:*:open_source:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:open_source:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.22.0",
                "versionStartIncluding": "1.1.3",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:r2:*:*:*:open_source_subscription:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:r1:*:*:*:open_source_subscription:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-41741"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Debian",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "169909"
      }
    ],
    "trust": 0.1
  },
  "cve": "CVE-2022-41741",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "author": "f5sirt@f5.com",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.0,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2022-41741",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "f5sirt@f5.com",
            "id": "CVE-2022-41741",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202210-1419",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-41741"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-41741"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202210-1419"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module. F5 BIG-IP and so on are all products of F5 Company in the United States. F5 BIG-IP is an application delivery platform that integrates functions such as network traffic management, application security management, and load balancing. F5 BIG-IQ is a software-based cloud management solution. F5 F5OS-A is an operating system software. F5 BIG-IP, BIG-IQ, F5OS-A, and F5OS-C have buffer error vulnerabilities. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-5281-1                   security@debian.org\nhttps://www.debian.org/security/                       Moritz Muehlenhoff\nNovember 15, 2022                     https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage        : nginx\nCVE ID         : CVE-2022-41741 CVE-2022-41742\n\nIt was discovered that parsing errors in the mp4 module of Nginx, a\nhigh-performance web and reverse proxy server, could result in denial\nof service, memory disclosure or potentially the execution of arbitrary\ncode when processing a malformed mp4 file. \n\nThis module is only enabled in the nginx-extras binary package. \n\nFor the stable distribution (bullseye), these problems have been fixed in\nversion 1.18.0-6.1+deb11u3. \n\nWe recommend that you upgrade your nginx packages. \n\nFor the detailed security status of nginx please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/nginx\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmNz9JcACgkQEMKTtsN8\nTjb4tg/7BRkAkF48UvvRjLolxVVuV1paSTRG8ArEeW3fHyA0fxs2UMuRL4ic1vqc\ni3wxAAfHvYoOnk+QBY20Ly2MN7S7OukNovKE9AZCPulyYkVjtIWNSBeY0PzCU60y\nRP/KCZAGoGEYi6s4SUrK194ved+7jIcybgLvvGA8FRKW3wTRvzRGMfR6NTLuP7B3\nth0C5+KkapE8G5XlHWOIjv1h3Ok40cua7LtYx9RTITJ+wClvkJ6gPcCXXj/CnWWa\nPUvuEBwyr0PEBXfL9v1P8Eq1MmN+mWU9KeLYxIC+vcJxtpsYL67tMHIGTlDUgDVE\nFrXrDXi7XP/6hjl7t/J/cTPEwy/twX0emUQcUDlRNlOxh3skSmdPJP7DMu+t9UtQ\nsuepgZ+oHfHh3gs9EWz2zRqbsVO03NjhKo9ebIjhe3H0P39cX3NN5qlSJeNTY45k\nVBDecnPQnhYqYuzqwXy5ZoUQDcU0Bo7zaUzeYhUsfXqrROV/tj+UTMrM2anHdQ4B\nkAOrCBpmGP1lLvDs2PzBcWmBtII/5VTKZep05xH0L+dZWDV07j1ekCzv3/kuKiMl\nGTJQ7yl3fgKjLdkjMFKQIfsm3xdYwzxjOmtEY86tUV0LjtdR2GlJtF4YdIQhA4b1\n/R82ZisLfmZ4ElL+ua8iypLOe9reyO4EpVVDkeewFS64Ye1Wn3k=3mDY\n-----END PGP SIGNATURE-----\n. =========================================================================\nUbuntu Security Notice USN-5722-1\nNovember 15, 2022\n\nnginx vulnerabilities\n=========================================================================\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 22.10\n- Ubuntu 22.04 LTS\n- Ubuntu 20.04 LTS\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 ESM\n- Ubuntu 14.04 ESM\n\nSummary:\n\nSeveral security issues were fixed in nginx. \n\nSoftware Description:\n- nginx: small, powerful, scalable web/proxy server\n\nDetails:\n\nIt was discovered that nginx incorrectly handled certain memory operations in\nthe ngx_http_mp4_module module. (CVE-2022-41741, CVE-2022-41742)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 22.10:\n  nginx                           1.22.0-1ubuntu1.1\n  nginx-common                    1.22.0-1ubuntu1.1\n  nginx-core                      1.22.0-1ubuntu1.1\n  nginx-extras                    1.22.0-1ubuntu1.1\n  nginx-full                      1.22.0-1ubuntu1.1\n  nginx-light                     1.22.0-1ubuntu1.1\n\nUbuntu 22.04 LTS:\n  nginx                           1.18.0-6ubuntu14.3\n  nginx-common                    1.18.0-6ubuntu14.3\n  nginx-core                      1.18.0-6ubuntu14.3\n  nginx-extras                    1.18.0-6ubuntu14.3\n  nginx-full                      1.18.0-6ubuntu14.3\n  nginx-light                     1.18.0-6ubuntu14.3\n\nUbuntu 20.04 LTS:\n  nginx                           1.18.0-0ubuntu1.4\n  nginx-common                    1.18.0-0ubuntu1.4\n  nginx-core                      1.18.0-0ubuntu1.4\n  nginx-extras                    1.18.0-0ubuntu1.4\n  nginx-full                      1.18.0-0ubuntu1.4\n  nginx-light                     1.18.0-0ubuntu1.4\n\nUbuntu 18.04 LTS:\n  nginx                           1.14.0-0ubuntu1.11\n  nginx-common                    1.14.0-0ubuntu1.11\n  nginx-core                      1.14.0-0ubuntu1.11\n  nginx-extras                    1.14.0-0ubuntu1.11\n  nginx-full                      1.14.0-0ubuntu1.11\n  nginx-light                     1.14.0-0ubuntu1.11\n\nUbuntu 16.04 ESM:\n  nginx                           1.10.3-0ubuntu0.16.04.5+esm5\n  nginx-common                    1.10.3-0ubuntu0.16.04.5+esm5\n  nginx-core                      1.10.3-0ubuntu0.16.04.5+esm5\n  nginx-extras                    1.10.3-0ubuntu0.16.04.5+esm5\n  nginx-full                      1.10.3-0ubuntu0.16.04.5+esm5\n  nginx-light                     1.10.3-0ubuntu0.16.04.5+esm5\n\nUbuntu 14.04 ESM:\n  nginx                           1.4.6-1ubuntu3.9+esm4\n  nginx-common                    1.4.6-1ubuntu3.9+esm4\n  nginx-core                      1.4.6-1ubuntu3.9+esm4\n  nginx-extras                    1.4.6-1ubuntu3.9+esm4\n  nginx-full                      1.4.6-1ubuntu3.9+esm4\n  nginx-light                     1.4.6-1ubuntu3.9+esm4\n\nIn general, a standard system update will make all the necessary changes. \n\nReferences:\n  https://ubuntu.com/security/notices/USN-5722-1\n  CVE-2022-41741, CVE-2022-41742\n\nPackage Information:\n  https://launchpad.net/ubuntu/+source/nginx/1.22.0-1ubuntu1.1\n  https://launchpad.net/ubuntu/+source/nginx/1.18.0-6ubuntu14.3\n  https://launchpad.net/ubuntu/+source/nginx/1.18.0-0ubuntu1.4\n  https://launchpad.net/ubuntu/+source/nginx/1.14.0-0ubuntu1.11\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-41741"
      },
      {
        "db": "VULHUB",
        "id": "VHN-429567"
      },
      {
        "db": "PACKETSTORM",
        "id": "169909"
      },
      {
        "db": "PACKETSTORM",
        "id": "169833"
      }
    ],
    "trust": 1.17
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2022-41741",
        "trust": 1.9
      },
      {
        "db": "PACKETSTORM",
        "id": "169909",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "169833",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202210-1419",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.5236",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.6109",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.5959",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-429567",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-429567"
      },
      {
        "db": "PACKETSTORM",
        "id": "169909"
      },
      {
        "db": "PACKETSTORM",
        "id": "169833"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-41741"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202210-1419"
      }
    ]
  },
  "id": "VAR-202210-1347",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-429567"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T10:54:59.381000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "F5 Nginx Buffer error vulnerability fix",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=237454"
      }
    ],
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202210-1419"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-787",
        "trust": 1.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-429567"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-41741"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://security.netapp.com/advisory/ntap-20230120-0005/"
      },
      {
        "trust": 1.7,
        "url": "https://www.debian.org/security/2022/dsa-5281"
      },
      {
        "trust": 1.7,
        "url": "https://support.f5.com/csp/article/k81926432"
      },
      {
        "trust": 1.7,
        "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/bprvya4fs34vwb4fefynad7z2lfcjvei/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/fd6m3pvvko35wlaa7gldbs6teq26sm64/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/wborrvg7vvxyoaiad64zhes2u2viukfq/"
      },
      {
        "trust": 0.7,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/wborrvg7vvxyoaiad64zhes2u2viukfq/"
      },
      {
        "trust": 0.7,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/fd6m3pvvko35wlaa7gldbs6teq26sm64/"
      },
      {
        "trust": 0.7,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/bprvya4fs34vwb4fefynad7z2lfcjvei/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/169833/ubuntu-security-notice-usn-5722-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.5959"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2022-41741/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/169909/debian-security-advisory-5281-1.html"
      },
      {
        "trust": 0.6,
        "url": "http-mp4-module-39638"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/nginx-two-vulnerabilities-via-ngx-"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.5236"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.6109"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-41741"
      },
      {
        "trust": 0.1,
        "url": "https://security-tracker.debian.org/tracker/nginx"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/faq"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-41742"
      },
      {
        "trust": 0.1,
        "url": "https://ubuntu.com/security/notices/usn-5722-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.14.0-0ubuntu1.11"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.18.0-6ubuntu14.3"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.18.0-0ubuntu1.4"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.22.0-1ubuntu1.1"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-429567"
      },
      {
        "db": "PACKETSTORM",
        "id": "169909"
      },
      {
        "db": "PACKETSTORM",
        "id": "169833"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-41741"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202210-1419"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-429567"
      },
      {
        "db": "PACKETSTORM",
        "id": "169909"
      },
      {
        "db": "PACKETSTORM",
        "id": "169833"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-41741"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202210-1419"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-10-19T00:00:00",
        "db": "VULHUB",
        "id": "VHN-429567"
      },
      {
        "date": "2022-11-16T16:11:49",
        "db": "PACKETSTORM",
        "id": "169909"
      },
      {
        "date": "2022-11-15T16:38:50",
        "db": "PACKETSTORM",
        "id": "169833"
      },
      {
        "date": "2022-10-19T22:15:12.647000",
        "db": "NVD",
        "id": "CVE-2022-41741"
      },
      {
        "date": "2022-10-19T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202210-1419"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-01-20T00:00:00",
        "db": "VULHUB",
        "id": "VHN-429567"
      },
      {
        "date": "2023-11-07T03:52:58.060000",
        "db": "NVD",
        "id": "CVE-2022-41741"
      },
      {
        "date": "2023-05-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202210-1419"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "169833"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202210-1419"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "F5 Nginx Buffer error vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202210-1419"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202210-1419"
      }
    ],
    "trust": 0.6
  }
}

var-200909-0576

Vulnerability from variot

Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests. Nginx A web server contains a buffer underrun vulnerability. Nginx Is offered for various platforms HTTP Server and mail proxy server. Nginx Is ngx_http_parse_complex_uri() There was a problem with the function and it was crafted URI A buffer underrun may occur when processing.nginx Consists of a privileged master process and an unprivileged worker process. Arbitrary code execution or denial of service by a remote third party with the authority of a worker process (DoS) There is a possibility of being attacked. The 'nginx' program is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition.

Affected packages

-------------------------------------------------------------------
 Package            /  Vulnerable  /                    Unaffected
-------------------------------------------------------------------

1 www-servers/nginx < 0.7.62 >= 0.5.38 >= 0.6.39 >= 0.7.62

Description

Chris Ries reported a heap-based buffer underflow in the ngx_http_parse_complex_uri() function in http/ngx_http_parse.c when parsing the request URI. NOTE: By default, nginx runs as the "nginx" user.

Workaround

There is no known workaround at this time.

Resolution

All nginx 0.5.x users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose =www-servers/nginx-0.5.38

All nginx 0.6.x users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose =www-servers/nginx-0.6.39

All nginx 0.7.x users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose =www-servers/nginx-0.7.62

References

[ 1 ] CVE-2009-2629 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2629

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200909-18.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Debian Security Advisory DSA-1884-1 security@debian.org http://www.debian.org/security/ Nico Golde September 14th, 2009 http://www.debian.org/security/faq

Package : nginx Vulnerability : buffer underflow Problem type : remote Debian-specific: no CVE ID : CVE-2009-2629

Chris Ries discovered that nginx, a high-performance HTTP server, reverse proxy and IMAP/POP3 proxy server, is vulnerable to a buffer underflow when processing certain HTTP requests.

For the oldstable distribution (etch), this problem has been fixed in version 0.4.13-2+etch2.

For the stable distribution (lenny), this problem has been fixed in version 0.6.32-3+lenny2.

For the testing distribution (squeeze), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in version 0.7.61-3.

We recommend that you upgrade your nginx packages.

Upgrade instructions

wget url will fetch the file for you dpkg -i file.deb will install the referenced file.

If you are using the apt-get package manager, use the line for sources.list as given below:

apt-get update will update the internal database apt-get upgrade will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch

Debian (oldstable)

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13.orig.tar.gz Size/MD5 checksum: 436610 d385a1e7a23020d421531818d5606b5b http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2.diff.gz Size/MD5 checksum: 6578 db07ea3610574b7561cbedef09a51bf2 http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2.dsc Size/MD5 checksum: 618 12706d3c92e0c225dd47367aae43115e

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_alpha.deb Size/MD5 checksum: 211310 5e7efe11eca1aea2f6611cd913bf519d

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_amd64.deb Size/MD5 checksum: 195352 3fc58e180fca1465a360f37bad3da7db

arm architecture (ARM)

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_arm.deb Size/MD5 checksum: 187144 6e49d62ee4efa11f9b75292bcb3be1d7

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_hppa.deb Size/MD5 checksum: 205204 7f8f76147eccbf489c900831782806c0

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_i386.deb Size/MD5 checksum: 184912 7dc5e3672666d1b5666f6ce79f4c755b

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_ia64.deb Size/MD5 checksum: 278490 669e8d9e43a123367c429ca34927e22a

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_mips.deb Size/MD5 checksum: 208238 2e6f25c4bc053d1bb1ac82bec398624d

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_mipsel.deb Size/MD5 checksum: 207640 e6b0e0e8148d1786274cf9a4b7f9d060

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_powerpc.deb Size/MD5 checksum: 186542 5b1460ab8707b1ccb3cf0b75c8ea2548

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_s390.deb Size/MD5 checksum: 199720 8ecde48c393df02819c45bc966f73eae

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_sparc.deb Size/MD5 checksum: 185032 15212749985501b223af7888447fc433

Debian GNU/Linux 5.0 alias lenny

Debian (stable)

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2.dsc Size/MD5 checksum: 1238 41197ff9eca3cb3707ca5eff5e431183 http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2.diff.gz Size/MD5 checksum: 10720 b2c8f555b7de4ac17b2c98247fd2ae6b http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32.orig.tar.gz Size/MD5 checksum: 522183 c09a2ace3c91f45dabbb608b11e48ed1

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_alpha.deb Size/MD5 checksum: 297782 dc05cbf94712134298acdedad2a4e85d

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_amd64.deb Size/MD5 checksum: 268518 58dc10022dd7b20ff58a4b839be62a43

arm architecture (ARM)

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_arm.deb Size/MD5 checksum: 251688 7f5a9499de8ba40ae2caea7de183b966

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_hppa.deb Size/MD5 checksum: 282324 f0264b98d0564f51692292c0ec269a19

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_i386.deb Size/MD5 checksum: 253060 a64340fa3a9a5b58e23267f13abfeeed

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_ia64.deb Size/MD5 checksum: 420004 a2e6de141194e41a60893b0b2c457f28

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_mips.deb Size/MD5 checksum: 283220 04407318230621467ea3a42bfb11d724

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_mipsel.deb Size/MD5 checksum: 283444 0bd0eb1e415d7d6877a95e21ddb91fa7

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_powerpc.deb Size/MD5 checksum: 276056 fae6451ab5ac767f93d3229a9e01f3bf

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_sparc.deb Size/MD5 checksum: 256778 df6a47fe174736468910a4166fe0a064

These files will probably be moved into the stable distribution on its next update.

For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show ' and http://packages.debian.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkquZwIACgkQHYflSXNkfP+2zACghwt2Hx3UoREEb7p697sYiPSl pZQAn1WWgFTERwdFo5uw5KuZ7hN09KuH =Xrul -----END PGP SIGNATURE-----

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200909-0576",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "6.0"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "12"
      },
      {
        "model": "nginx",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "11"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "10"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.5.38"
      },
      {
        "model": "nginx",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.0"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.7.62"
      },
      {
        "model": "nginx",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.1.0"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.39"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.8.15"
      },
      {
        "model": "nginx",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.6.0"
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "debian gnu linux",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "gentoo linux",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "nginx",
        "version": null
      },
      {
        "model": "nginx",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "0.1.0 from  0.5.37"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "0.6.39 earlier"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "0.7.62 earlier"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "0.8.15 earlier"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.1.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.1.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.1.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.1.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.1.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.1.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.1.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.1.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.1.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "0.1.10"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.8.14"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.7.61"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.6.38"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.5.37"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0"
      },
      {
        "model": "linux",
        "scope": null,
        "trust": 0.3,
        "vendor": "gentoo",
        "version": null
      },
      {
        "model": "linux sparc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux s/390",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux mipsel",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux mips",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux m68k",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux ia-64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux ia-32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux hppa",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux armel",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux arm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux alpha",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux sparc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux s/390",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux mipsel",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux mips",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux m68k",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux ia-64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux ia-32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux hppa",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "linux armel",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "4.0"
      },
      {
        "model": "sysoev nginx",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.8.15"
      },
      {
        "model": "sysoev nginx",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.7.62"
      },
      {
        "model": "sysoev nginx",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.6.39"
      },
      {
        "model": "sysoev nginx",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "igor",
        "version": "0.5.38"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#180065"
      },
      {
        "db": "BID",
        "id": "36384"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-002152"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-2629"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200909-302"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.5.38",
                "versionStartIncluding": "0.1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.6.39",
                "versionStartIncluding": "0.6.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.7.62",
                "versionStartIncluding": "0.7.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.8.15",
                "versionStartIncluding": "0.8.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2009-2629"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Chris Ries",
    "sources": [
      {
        "db": "BID",
        "id": "36384"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200909-302"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2009-2629",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 7.5,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2009-2629",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-40075",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2009-2629",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CARNEGIE MELLON",
            "id": "VU#180065",
            "trust": 0.8,
            "value": "4.22"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200909-302",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-40075",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#180065"
      },
      {
        "db": "VULHUB",
        "id": "VHN-40075"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-002152"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-2629"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200909-302"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests. Nginx A web server contains a buffer underrun vulnerability. Nginx Is offered for various platforms HTTP Server and mail proxy server. Nginx Is ngx_http_parse_complex_uri() There was a problem with the function and it was crafted URI A buffer underrun may occur when processing.nginx Consists of a privileged master process and an unprivileged worker process. Arbitrary code execution or denial of service by a remote third party with the authority of a worker process (DoS) There is a possibility of being attacked. The \u0027nginx\u0027 program is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. \n\nAffected packages\n=================\n\n    -------------------------------------------------------------------\n     Package            /  Vulnerable  /                    Unaffected\n    -------------------------------------------------------------------\n  1  www-servers/nginx      \u003c 0.7.62                        *\u003e= 0.5.38\n                                                            *\u003e= 0.6.39\n                                                             \u003e= 0.7.62\n\nDescription\n===========\n\nChris Ries reported a heap-based buffer underflow in the\nngx_http_parse_complex_uri() function in http/ngx_http_parse.c when\nparsing the request URI. NOTE: By default, nginx runs as the \"nginx\" user. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll nginx 0.5.x users should upgrade to the latest version:\n\n    # emerge --sync\n    # emerge --ask --oneshot --verbose =www-servers/nginx-0.5.38\n\nAll nginx 0.6.x users should upgrade to the latest version:\n\n    # emerge --sync\n    # emerge --ask --oneshot --verbose =www-servers/nginx-0.6.39\n\nAll nginx 0.7.x users should upgrade to the latest version:\n\n    # emerge --sync\n    # emerge --ask --oneshot --verbose =www-servers/nginx-0.7.62\n\nReferences\n==========\n\n  [ 1 ] CVE-2009-2629\n        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2629\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n  http://security.gentoo.org/glsa/glsa-200909-18.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2009 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n- --------------------------------------------------------------------------\nDebian Security Advisory DSA-1884-1                    security@debian.org\nhttp://www.debian.org/security/                                 Nico Golde\nSeptember 14th, 2009                    http://www.debian.org/security/faq\n- --------------------------------------------------------------------------\n\nPackage        : nginx\nVulnerability  : buffer underflow\nProblem type   : remote\nDebian-specific: no\nCVE ID         : CVE-2009-2629\n\nChris Ries discovered that nginx, a high-performance HTTP server, reverse\nproxy and IMAP/POP3 proxy server, is vulnerable to a buffer underflow when\nprocessing certain HTTP requests. \n\n\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 0.4.13-2+etch2. \n\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.6.32-3+lenny2. \n\nFor the testing distribution (squeeze), this problem will be fixed soon. \n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.7.61-3. \n\n\nWe recommend that you upgrade your nginx packages. \n\nUpgrade instructions\n- --------------------\n\nwget url\n        will fetch the file for you\ndpkg -i file.deb\n        will install the referenced file. \n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n        will update the internal database\napt-get upgrade\n        will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration. \n\n\nDebian GNU/Linux 4.0 alias etch\n- -------------------------------\n\nDebian (oldstable)\n- ------------------\n\nOldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. \n\nSource archives:\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13.orig.tar.gz\n    Size/MD5 checksum:   436610 d385a1e7a23020d421531818d5606b5b\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2.diff.gz\n    Size/MD5 checksum:     6578 db07ea3610574b7561cbedef09a51bf2\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2.dsc\n    Size/MD5 checksum:      618 12706d3c92e0c225dd47367aae43115e\n\nalpha architecture (DEC Alpha)\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_alpha.deb\n    Size/MD5 checksum:   211310 5e7efe11eca1aea2f6611cd913bf519d\n\namd64 architecture (AMD x86_64 (AMD64))\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_amd64.deb\n    Size/MD5 checksum:   195352 3fc58e180fca1465a360f37bad3da7db\n\narm architecture (ARM)\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_arm.deb\n    Size/MD5 checksum:   187144 6e49d62ee4efa11f9b75292bcb3be1d7\n\nhppa architecture (HP PA RISC)\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_hppa.deb\n    Size/MD5 checksum:   205204 7f8f76147eccbf489c900831782806c0\n\ni386 architecture (Intel ia32)\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_i386.deb\n    Size/MD5 checksum:   184912 7dc5e3672666d1b5666f6ce79f4c755b\n\nia64 architecture (Intel ia64)\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_ia64.deb\n    Size/MD5 checksum:   278490 669e8d9e43a123367c429ca34927e22a\n\nmips architecture (MIPS (Big Endian))\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_mips.deb\n    Size/MD5 checksum:   208238 2e6f25c4bc053d1bb1ac82bec398624d\n\nmipsel architecture (MIPS (Little Endian))\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_mipsel.deb\n    Size/MD5 checksum:   207640 e6b0e0e8148d1786274cf9a4b7f9d060\n\npowerpc architecture (PowerPC)\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_powerpc.deb\n    Size/MD5 checksum:   186542 5b1460ab8707b1ccb3cf0b75c8ea2548\n\ns390 architecture (IBM S/390)\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_s390.deb\n    Size/MD5 checksum:   199720 8ecde48c393df02819c45bc966f73eae\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_sparc.deb\n    Size/MD5 checksum:   185032 15212749985501b223af7888447fc433\n\n\nDebian GNU/Linux 5.0 alias lenny\n- --------------------------------\n\nDebian (stable)\n- ---------------\n\nStable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. \n\nSource archives:\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2.dsc\n    Size/MD5 checksum:     1238 41197ff9eca3cb3707ca5eff5e431183\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2.diff.gz\n    Size/MD5 checksum:    10720 b2c8f555b7de4ac17b2c98247fd2ae6b\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32.orig.tar.gz\n    Size/MD5 checksum:   522183 c09a2ace3c91f45dabbb608b11e48ed1\n\nalpha architecture (DEC Alpha)\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_alpha.deb\n    Size/MD5 checksum:   297782 dc05cbf94712134298acdedad2a4e85d\n\namd64 architecture (AMD x86_64 (AMD64))\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_amd64.deb\n    Size/MD5 checksum:   268518 58dc10022dd7b20ff58a4b839be62a43\n\narm architecture (ARM)\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_arm.deb\n    Size/MD5 checksum:   251688 7f5a9499de8ba40ae2caea7de183b966\n\nhppa architecture (HP PA RISC)\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_hppa.deb\n    Size/MD5 checksum:   282324 f0264b98d0564f51692292c0ec269a19\n\ni386 architecture (Intel ia32)\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_i386.deb\n    Size/MD5 checksum:   253060 a64340fa3a9a5b58e23267f13abfeeed\n\nia64 architecture (Intel ia64)\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_ia64.deb\n    Size/MD5 checksum:   420004 a2e6de141194e41a60893b0b2c457f28\n\nmips architecture (MIPS (Big Endian))\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_mips.deb\n    Size/MD5 checksum:   283220 04407318230621467ea3a42bfb11d724\n\nmipsel architecture (MIPS (Little Endian))\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_mipsel.deb\n    Size/MD5 checksum:   283444 0bd0eb1e415d7d6877a95e21ddb91fa7\n\npowerpc architecture (PowerPC)\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_powerpc.deb\n    Size/MD5 checksum:   276056 fae6451ab5ac767f93d3229a9e01f3bf\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_sparc.deb\n    Size/MD5 checksum:   256778 df6a47fe174736468910a4166fe0a064\n\n\n  These files will probably be moved into the stable distribution on\n  its next update. \n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show \u003cpkg\u003e\u0027 and http://packages.debian.org/\u003cpkg\u003e\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.9 (GNU/Linux)\n\niEYEARECAAYFAkquZwIACgkQHYflSXNkfP+2zACghwt2Hx3UoREEb7p697sYiPSl\npZQAn1WWgFTERwdFo5uw5KuZ7hN09KuH\n=Xrul\n-----END PGP SIGNATURE-----\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2009-2629"
      },
      {
        "db": "CERT/CC",
        "id": "VU#180065"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-002152"
      },
      {
        "db": "BID",
        "id": "36384"
      },
      {
        "db": "VULHUB",
        "id": "VHN-40075"
      },
      {
        "db": "PACKETSTORM",
        "id": "81454"
      },
      {
        "db": "PACKETSTORM",
        "id": "81284"
      }
    ],
    "trust": 2.88
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-40075",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-40075"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#180065",
        "trust": 3.6
      },
      {
        "db": "NVD",
        "id": "CVE-2009-2629",
        "trust": 3.0
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-002152",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200909-302",
        "trust": 0.7
      },
      {
        "db": "BID",
        "id": "36384",
        "trust": 0.4
      },
      {
        "db": "PACKETSTORM",
        "id": "81454",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "81284",
        "trust": 0.2
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-87569",
        "trust": 0.1
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-69732",
        "trust": 0.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "14830",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-40075",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#180065"
      },
      {
        "db": "VULHUB",
        "id": "VHN-40075"
      },
      {
        "db": "BID",
        "id": "36384"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-002152"
      },
      {
        "db": "PACKETSTORM",
        "id": "81454"
      },
      {
        "db": "PACKETSTORM",
        "id": "81284"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-2629"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200909-302"
      }
    ]
  },
  "id": "VAR-200909-0576",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-40075"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T13:58:03.931000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://nginx.net/"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-002152"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-787",
        "trust": 1.1
      },
      {
        "problemtype": "CWE-119",
        "trust": 0.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-40075"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-002152"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-2629"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.8,
        "url": "http://www.kb.cert.org/vuls/id/180065"
      },
      {
        "trust": 2.5,
        "url": "http://www.debian.org/security/2009/dsa-1884"
      },
      {
        "trust": 2.0,
        "url": "http://nginx.net/changes-0.5"
      },
      {
        "trust": 2.0,
        "url": "http://nginx.net/changes-0.6"
      },
      {
        "trust": 2.0,
        "url": "http://nginx.net/changes-0.7"
      },
      {
        "trust": 1.7,
        "url": "http://sysoev.ru/nginx/patch.180065.txt"
      },
      {
        "trust": 1.7,
        "url": "https://www.redhat.com/archives/fedora-package-announce/2009-december/msg00428.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.redhat.com/archives/fedora-package-announce/2009-december/msg00442.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.redhat.com/archives/fedora-package-announce/2009-december/msg00449.html"
      },
      {
        "trust": 1.4,
        "url": "http://nginx.net/changes"
      },
      {
        "trust": 0.9,
        "url": "http://security.gentoo.org/glsa/glsa-200909-18.xml"
      },
      {
        "trust": 0.9,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-2629"
      },
      {
        "trust": 0.8,
        "url": "about vulnerability notes"
      },
      {
        "trust": 0.8,
        "url": "contact us about this vulnerability"
      },
      {
        "trust": 0.8,
        "url": "provide a vendor statement"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/cert/jvnvu180065/"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-2629"
      },
      {
        "trust": 0.3,
        "url": "http://nginx.org/"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2009-2629"
      },
      {
        "trust": 0.1,
        "url": "http://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "http://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_i386.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32.orig.tar.gz"
      },
      {
        "trust": 0.1,
        "url": "http://www.debian.org/security/faq"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_arm.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_ia64.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_s390.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_alpha.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_mips.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2.dsc"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_mips.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_sparc.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_sparc.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_ia64.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_mipsel.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2.diff.gz"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_mipsel.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2.dsc"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_alpha.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_hppa.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_amd64.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_powerpc.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_i386.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_hppa.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_arm.deb"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13.orig.tar.gz"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/"
      },
      {
        "trust": 0.1,
        "url": "http://packages.debian.org/\u003cpkg\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2.diff.gz"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch2_amd64.deb"
      },
      {
        "trust": 0.1,
        "url": "http://www.debian.org/security/"
      },
      {
        "trust": 0.1,
        "url": "http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+lenny2_powerpc.deb"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#180065"
      },
      {
        "db": "VULHUB",
        "id": "VHN-40075"
      },
      {
        "db": "BID",
        "id": "36384"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-002152"
      },
      {
        "db": "PACKETSTORM",
        "id": "81454"
      },
      {
        "db": "PACKETSTORM",
        "id": "81284"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-2629"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200909-302"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#180065"
      },
      {
        "db": "VULHUB",
        "id": "VHN-40075"
      },
      {
        "db": "BID",
        "id": "36384"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2009-002152"
      },
      {
        "db": "PACKETSTORM",
        "id": "81454"
      },
      {
        "db": "PACKETSTORM",
        "id": "81284"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-2629"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200909-302"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2009-09-15T00:00:00",
        "db": "CERT/CC",
        "id": "VU#180065"
      },
      {
        "date": "2009-09-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-40075"
      },
      {
        "date": "2009-09-14T00:00:00",
        "db": "BID",
        "id": "36384"
      },
      {
        "date": "2009-10-28T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2009-002152"
      },
      {
        "date": "2009-09-19T16:50:46",
        "db": "PACKETSTORM",
        "id": "81454"
      },
      {
        "date": "2009-09-15T04:05:55",
        "db": "PACKETSTORM",
        "id": "81284"
      },
      {
        "date": "2009-09-15T22:30:00.233000",
        "db": "NVD",
        "id": "CVE-2009-2629"
      },
      {
        "date": "2009-09-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200909-302"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2009-09-21T00:00:00",
        "db": "CERT/CC",
        "id": "VU#180065"
      },
      {
        "date": "2021-11-10T00:00:00",
        "db": "VULHUB",
        "id": "VHN-40075"
      },
      {
        "date": "2015-05-07T17:02:00",
        "db": "BID",
        "id": "36384"
      },
      {
        "date": "2009-10-28T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2009-002152"
      },
      {
        "date": "2021-11-10T15:52:54.030000",
        "db": "NVD",
        "id": "CVE-2009-2629"
      },
      {
        "date": "2023-05-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200909-302"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "81454"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200909-302"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Nginx ngx_http_parse_complex_uri() buffer underflow vulnerability",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#180065"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200909-302"
      }
    ],
    "trust": 0.6
  }
}

var-201307-0483

Vulnerability from variot

The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow. nginx is prone to a stack-based buffer-overflow vulnerability. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition. The issue is fixed in nginx 1.4.1 and 1.5.0. nginx is a lightweight web server/reverse proxy server and email (IMAP/POP3) proxy server developed by Russian programmer Igor Sysoev. A denial of service vulnerability exists in the 'ngx_http_parse_chunked' function in http/ngx_http_parse.c in nginx versions 1.3.9 to 1.4.0. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201310-04

                                        http://security.gentoo.org/

Severity: Normal Title: nginx: Multiple vulnerabilities Date: October 06, 2013 Bugs: #458726, #468870 ID: 201310-04

Synopsis

Multiple vulnerabilities have been found in nginx, the worst of which may allow execution of arbitrary code.

Background

nginx is a robust, small, and high performance HTTP and reverse proxy server.

Affected packages

-------------------------------------------------------------------
 Package              /     Vulnerable     /            Unaffected
-------------------------------------------------------------------

1 www-servers/nginx < 1.4.1-r2 >= 1.4.1-r2

Description

Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could send a specially crafted request, possibly resulting in execution of arbitrary code with the privileges of the process, or a Denial of Service condition. Furthermore, a context-dependent attacker may be able to obtain sensitive information.

Workaround

There is no known workaround at this time.

Resolution

All nginx users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.4.1-r2"

References

[ 1 ] CVE-2013-0337 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0337 [ 2 ] CVE-2013-2028 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2028 [ 3 ] CVE-2013-2070 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2070

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201310-04.xml

Concerns?

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5 . From: Maxim Dounin mdounin at mdounin.ru Tue May 7 11:30:26 UTC 2013

Hello!

Greg MacManus, of iSIGHT Partners Labs, found a security problem in several recent versions of nginx.

Patch for the problem can be found here:

http://nginx.org/download/patch.2013.chunked.txt

As a temporary workaround the following configuration can be used in each server{} block:

if ($http_transfer_encoding ~* chunked) {
    return 444;
}

-- Maxim Dounin http://nginx.org/en/donation.html

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201307-0483",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "19"
      },
      {
        "model": "nginx",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.3.9"
      },
      {
        "model": "nginx",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.4.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "1.3.9 to  1.4.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "1.3.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "igor sysoev",
        "version": "1.3.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "igor sysoev",
        "version": "1.4.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "nginx",
        "version": "1.4.0"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "1.4.4"
      },
      {
        "model": "sysoev nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "igor",
        "version": "1.3.9"
      },
      {
        "model": "linux",
        "scope": null,
        "trust": 0.3,
        "vendor": "gentoo",
        "version": null
      },
      {
        "model": "sysoev nginx",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "igor",
        "version": "1.5.7"
      },
      {
        "model": "sysoev nginx",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "igor",
        "version": "1.4.1"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "59699"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003473"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-2028"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-143"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.4.0",
                "versionStartIncluding": "1.3.9",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2013-2028"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Greg MacManus of iSIGHT Partners Labs",
    "sources": [
      {
        "db": "BID",
        "id": "59699"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-143"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2013-2028",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 7.5,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2013-2028",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-62030",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2013-2028",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201305-143",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-62030",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2013-2028",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-62030"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-2028"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003473"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-2028"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-143"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow. nginx is prone to a stack-based buffer-overflow vulnerability. \nSuccessfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition. \nThe issue is fixed in nginx 1.4.1 and 1.5.0. nginx is a lightweight web server/reverse proxy server and email (IMAP/POP3) proxy server developed by Russian programmer Igor Sysoev. A denial of service vulnerability exists in the \u0027ngx_http_parse_chunked\u0027 function in http/ngx_http_parse.c in nginx versions 1.3.9 to 1.4.0. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 201310-04\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                            http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n    Title: nginx: Multiple vulnerabilities\n     Date: October 06, 2013\n     Bugs: #458726, #468870\n       ID: 201310-04\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in nginx, the worst of which\nmay allow execution of arbitrary code. \n\nBackground\n==========\n\nnginx is a robust, small, and high performance HTTP and reverse proxy\nserver. \n\nAffected packages\n=================\n\n    -------------------------------------------------------------------\n     Package              /     Vulnerable     /            Unaffected\n    -------------------------------------------------------------------\n  1  www-servers/nginx           \u003c 1.4.1-r2               \u003e= 1.4.1-r2\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in nginx. Please review\nthe CVE identifiers referenced below for details. \n\nImpact\n======\n\nA remote attacker could send a specially crafted request, possibly\nresulting in execution of arbitrary code with the privileges of the\nprocess, or a Denial of Service condition. Furthermore, a\ncontext-dependent attacker may be able to obtain sensitive information. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll nginx users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=www-servers/nginx-1.4.1-r2\"\n\nReferences\n==========\n\n[ 1 ] CVE-2013-0337\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0337\n[ 2 ] CVE-2013-2028\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2028\n[ 3 ] CVE-2013-2070\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2070\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201310-04.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2013 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n. From: Maxim Dounin mdounin at mdounin.ru\nTue May 7 11:30:26 UTC 2013\n\nHello!\n\nGreg MacManus, of iSIGHT Partners Labs, found a security problem\nin several recent versions of nginx. \n\nPatch for the problem can be found here:\n\nhttp://nginx.org/download/patch.2013.chunked.txt\n\nAs a temporary workaround the following configuration\ncan be used in each server{} block:\n\n    if ($http_transfer_encoding ~* chunked) {\n        return 444;\n    }\n\n\n-- \nMaxim Dounin\nhttp://nginx.org/en/donation.html\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2013-2028"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003473"
      },
      {
        "db": "BID",
        "id": "59699"
      },
      {
        "db": "VULHUB",
        "id": "VHN-62030"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-2028"
      },
      {
        "db": "PACKETSTORM",
        "id": "123516"
      },
      {
        "db": "PACKETSTORM",
        "id": "121560"
      }
    ],
    "trust": 2.25
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=25499",
        "trust": 0.4,
        "type": "exploit"
      },
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-62030",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-62030"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-2028"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2013-2028",
        "trust": 3.1
      },
      {
        "db": "BID",
        "id": "59699",
        "trust": 2.1
      },
      {
        "db": "PACKETSTORM",
        "id": "121675",
        "trust": 1.8
      },
      {
        "db": "SECUNIA",
        "id": "55181",
        "trust": 1.8
      },
      {
        "db": "OSVDB",
        "id": "93037",
        "trust": 1.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003473",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-143",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "121560",
        "trust": 0.2
      },
      {
        "db": "EXPLOIT-DB",
        "id": "25499",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "125758",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "121712",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "122477",
        "trust": 0.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "26737",
        "trust": 0.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "25775",
        "trust": 0.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "32277",
        "trust": 0.1
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-85572",
        "trust": 0.1
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-79430",
        "trust": 0.1
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-79160",
        "trust": 0.1
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-80363",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-62030",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-2028",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "123516",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-62030"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-2028"
      },
      {
        "db": "BID",
        "id": "59699"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003473"
      },
      {
        "db": "PACKETSTORM",
        "id": "123516"
      },
      {
        "db": "PACKETSTORM",
        "id": "121560"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-2028"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-143"
      }
    ]
  },
  "id": "VAR-201307-0483",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-62030"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T11:22:29.143000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "GLSA 201310-04",
        "trust": 0.8,
        "url": "http://www.gentoo.org/security/en/glsa/glsa-201310-04.xml"
      },
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://nginx.org/ja/"
      },
      {
        "title": "CVE-2013-2028",
        "trust": 0.8,
        "url": "http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html"
      },
      {
        "title": "nginx \u0027ngx_http_parse.c\u0027 Repair measures for stack buffer error vulnerability",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=134168"
      },
      {
        "title": "nginxpwn",
        "trust": 0.1,
        "url": "https://github.com/kitctf/nginxpwn "
      },
      {
        "title": "hack4career",
        "trust": 0.1,
        "url": "https://github.com/mertsarica/hack4career "
      },
      {
        "title": "docker-cve-2013-2028",
        "trust": 0.1,
        "url": "https://github.com/mambroziak/docker-cve-2013-2028 "
      },
      {
        "title": "nginx-1.4.0",
        "trust": 0.1,
        "url": "https://github.com/danghvu/nginx-1.4.0 "
      },
      {
        "title": "zeus-software-security",
        "trust": 0.1,
        "url": "https://github.com/alexgeunholee/zeus-software-security "
      },
      {
        "title": "nginxhack",
        "trust": 0.1,
        "url": "https://github.com/jptr218/nginxhack "
      },
      {
        "title": "non-controlflow-hijacking-datasets",
        "trust": 0.1,
        "url": "https://github.com/camel-clarkson/non-controlflow-hijacking-datasets "
      },
      {
        "title": "exploit-development-case-studies",
        "trust": 0.1,
        "url": "https://github.com/dyjakan/exploit-development-case-studies "
      },
      {
        "title": "LinuxFlaw",
        "trust": 0.1,
        "url": "https://github.com/mudongliang/linuxflaw "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2013-2028"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003473"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-143"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-787",
        "trust": 1.1
      },
      {
        "problemtype": "CWE-189",
        "trust": 0.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-62030"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003473"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-2028"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.9,
        "url": "http://www.securityfocus.com/bid/59699"
      },
      {
        "trust": 1.9,
        "url": "http://security.gentoo.org/glsa/glsa-201310-04.xml"
      },
      {
        "trust": 1.9,
        "url": "http://nginx.org/download/patch.2013.chunked.txt"
      },
      {
        "trust": 1.8,
        "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-may/105176.html"
      },
      {
        "trust": 1.8,
        "url": "http://packetstormsecurity.com/files/121675/nginx-1.3.9-1.4.0-denial-of-service.html"
      },
      {
        "trust": 1.8,
        "url": "http://www.vnsecurity.net/2013/05/analysis-of-nginx-cve-2013-2028/"
      },
      {
        "trust": 1.8,
        "url": "https://github.com/rapid7/metasploit-framework/pull/1834"
      },
      {
        "trust": 1.8,
        "url": "http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html"
      },
      {
        "trust": 1.8,
        "url": "http://www.osvdb.org/93037"
      },
      {
        "trust": 1.8,
        "url": "http://secunia.com/advisories/55181"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-2028"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-2028"
      },
      {
        "trust": 0.3,
        "url": "http://nginx.org/"
      },
      {
        "trust": 0.3,
        "url": "http://int3pids.blogspot.com.es/2013/07/nginx-reliable-explotation-through.html"
      },
      {
        "trust": 0.3,
        "url": "http://seclists.org/oss-sec/2013/q2/290"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-2028"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/787.html"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/kitctf/nginxpwn"
      },
      {
        "trust": 0.1,
        "url": "https://www.exploit-db.com/exploits/25499/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "http://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-2070"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-0337"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2013-0337"
      },
      {
        "trust": 0.1,
        "url": "http://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-2028"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-2070"
      },
      {
        "trust": 0.1,
        "url": "http://nginx.org/en/donation.html"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-62030"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-2028"
      },
      {
        "db": "BID",
        "id": "59699"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003473"
      },
      {
        "db": "PACKETSTORM",
        "id": "123516"
      },
      {
        "db": "PACKETSTORM",
        "id": "121560"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-2028"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-143"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-62030"
      },
      {
        "db": "VULMON",
        "id": "CVE-2013-2028"
      },
      {
        "db": "BID",
        "id": "59699"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003473"
      },
      {
        "db": "PACKETSTORM",
        "id": "123516"
      },
      {
        "db": "PACKETSTORM",
        "id": "121560"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-2028"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-143"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2013-07-20T00:00:00",
        "db": "VULHUB",
        "id": "VHN-62030"
      },
      {
        "date": "2013-07-20T00:00:00",
        "db": "VULMON",
        "id": "CVE-2013-2028"
      },
      {
        "date": "2013-05-07T00:00:00",
        "db": "BID",
        "id": "59699"
      },
      {
        "date": "2013-07-23T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2013-003473"
      },
      {
        "date": "2013-10-07T22:29:42",
        "db": "PACKETSTORM",
        "id": "123516"
      },
      {
        "date": "2013-05-08T02:43:02",
        "db": "PACKETSTORM",
        "id": "121560"
      },
      {
        "date": "2013-07-20T03:37:20.730000",
        "db": "NVD",
        "id": "CVE-2013-2028"
      },
      {
        "date": "2013-05-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201305-143"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-11-10T00:00:00",
        "db": "VULHUB",
        "id": "VHN-62030"
      },
      {
        "date": "2021-11-10T00:00:00",
        "db": "VULMON",
        "id": "CVE-2013-2028"
      },
      {
        "date": "2015-04-13T21:40:00",
        "db": "BID",
        "id": "59699"
      },
      {
        "date": "2013-11-12T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2013-003473"
      },
      {
        "date": "2021-11-10T15:59:33.553000",
        "db": "NVD",
        "id": "CVE-2013-2028"
      },
      {
        "date": "2023-05-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201305-143"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-143"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "nginx of  http/ngx_http_parse.c Service disruption in  (DoS) Vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003473"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201305-143"
      }
    ],
    "trust": 0.6
  }
}

var-201012-0193

Vulnerability from variot

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. Fiery Network Controllers for Xerox DocuColor 242/252/260 Printer/Copier use a vulnerable version of OpenSSL (0.9.8o). OpenSSL is prone to a security weakness that may allow attackers to downgrade the ciphersuite. Successfully exploiting this issue in conjunction with other latent vulnerabilities may allow attackers to gain access to sensitive information or gain unauthorized access to an affected application that uses OpenSSL. Releases prior to OpenSSL 1.0.0c are affected. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c02824483 Version: 1

HPSBOV02670 SSRT100475 rev.1 - HP OpenVMS running SSL, Remote Denial of Service (DoS), Unauthorized Disclosure of Information, Unauthorized Modification

NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.

Release Date: 2011-05-05 Last Updated: 2011-05-05

Potential Security Impact: Remote Denial of Service (DoS), Unauthorized disclosure of information, unauthorized modification

Source: Hewlett-Packard Company, HP Software Security Response Team

VULNERABILITY SUMMARY Potential vulnerabilities have been identified with HP OpenVMS running SSL. The vulnerabilities could be remotely exploited to create a Denial of Service (DoS) or unauthorized disclosure of information, or by a remote unauthorized user to modify data, prompts, or responses.

References: CVE-2011-0014, CVE-2010-4180, CVE-2010-4252, CVE-2010-3864

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP SSL for OpenVMS v 1.4 and earlier.

BACKGROUND

CVSS 2.0 Base Metrics

Reference Base Vector Base Score CVE-2011-0014 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2010-4180 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2010-4252 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2010-3864 (AV:N/AC:H/Au:N/C:C/I:C/A:C) 7.6 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002

RESOLUTION

HP has made the following software updates available to resolve these vulnerabilities.

HP SSL V1.4-453 for OpenVMS Alpha and OpenVMS Integrity servers: http://h71000.www7.hp.com/openvms/products/ssl/ssl.html

HISTORY Version:1 (rev.1) - 5 May 2011 Initial release

Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.

Support: For further information, contact normal HP Services support channel.

Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information. To get the security-alert PGP key, please send an e-mail message as follows: To: security-alert@hp.com Subject: get key Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email: http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches -check ALL categories for which alerts are required and continue. Under Step2: your ITRC operating systems -verify your operating system selections are checked and save.

To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php Log in on the web page: Subscriber's choice for Business: sign-in. On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.

To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do

The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title:

GN = HP General SW MA = HP Management Agents MI = Misc. 3rd Party SW MP = HP MPE/iX NS = HP NonStop Servers OV = HP OpenVMS PI = HP Printing & Imaging ST = HP Storage SW TL = HP Trusted Linux TU = HP Tru64 UNIX UX = HP-UX VV = HP VirtualVault

System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.

"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."

Copyright 2011 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

                    VMware Security Advisory

Advisory ID: VMSA-2011-0013 Synopsis: VMware third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX Issue date: 2011-10-27 Updated on: 2011-10-27 (initial release of advisory) CVE numbers: --- openssl --- CVE-2008-7270 CVE-2010-4180 --- libuser --- CVE-2011-0002 --- nss, nspr --- CVE-2010-3170 CVE-2010-3173 --- Oracle (Sun) JRE 1.6.0 --- CVE-2010-1321 CVE-2010-3541 CVE-2010-3548 CVE-2010-3549 CVE-2010-3550 CVE-2010-3551 CVE-2010-3552 CVE-2010-3553 CVE-2010-3554 CVE-2010-3555 CVE-2010-3556 CVE-2010-3557 CVE-2010-3558 CVE-2010-3559 CVE-2010-3560 CVE-2010-3561 CVE-2010-3562 CVE-2010-3563 CVE-2010-3565 CVE-2010-3566 CVE-2010-3567 CVE-2010-3568 CVE-2010-3569 CVE-2010-3570 CVE-2010-3571 CVE-2010-3572 CVE-2010-3573 CVE-2010-3574 CVE-2010-4422 CVE-2010-4447 CVE-2010-4448 CVE-2010-4450 CVE-2010-4451 CVE-2010-4452 CVE-2010-4454 CVE-2010-4462 CVE-2010-4463 CVE-2010-4465 CVE-2010-4466 CVE-2010-4467 CVE-2010-4468 CVE-2010-4469 CVE-2010-4470 CVE-2010-4471 CVE-2010-4472 CVE-2010-4473 CVE-2010-4474 CVE-2010-4475 CVE-2010-4476 --- Oracle (Sun) JRE 1.5.0 --- CVE-2010-4447 CVE-2010-4448 CVE-2010-4450 CVE-2010-4454 CVE-2010-4462 CVE-2010-4465 CVE-2010-4466 CVE-2010-4468 CVE-2010-4469 CVE-2010-4473 CVE-2010-4475 CVE-2010-4476 CVE-2011-0862 CVE-2011-0873 CVE-2011-0815 CVE-2011-0864 CVE-2011-0802 CVE-2011-0814 CVE-2011-0871 CVE-2011-0867 CVE-2011-0865 --- SFCB --- CVE-2010-2054

Summary

Update 2 for vCenter Server 4.1, vCenter Update Manager 4.1, vSphere Hypervisor (ESXi) 4.1 and ESX 4.1 addresses several security issues.

Relevant releases

vCenter Server 4.1 without Update 2

vCenter Update Manager 4.1 without Update 2

ESXi 4.1 without patch ESX410-201110201-SG.

ESX 4.1 without patches ESX410-201110201-SG, ESX410-201110204-SG, ESX410-201110206-SG,ESX410-201110214-SG.

Problem Description

a. ESX third party update for Service Console openssl RPM

The Service Console openssl RPM is updated to
openssl-0.9.8e.12.el5_5.7 resolving two security issues.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2008-7270 and CVE-2010-4180 to these
issues.

Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.

VMware      Product     Running     Replace with/
Product     Version     on          Apply Patch
=========   ========    =======     =================
vCenter     any         Windows     not affected

hosted*     any         any         not affected

ESXi        any         any         not affected

ESX         4.1         ESX         ESX410-201110204-SG
ESX         4.0         ESX         patch pending
ESX         3.5         ESX         not applicable
ESX         3.0.3       ESX         not applicable

hosted products are VMware Workstation, Player, ACE, Fusion.

b. ESX third party update for Service Console libuser RPM

The Service Console libuser RPM is updated to version
0.54.7-2.1.el5_5.2 to resolve a security issue.

The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2011-0002 to this issue.

Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.

VMware      Product     Running     Replace with/
Product     Version     on          Apply Patch
=========   ========    =======     =================
vCenter     any         Windows     not affected

hosted*     any         any         not affected

ESXi        any         ESXi        not affected

ESX         4.1         ESX         ESX410-201110206-SG
ESX         4.0         ESX         patch pending
ESX         3.5         ESX         not applicable
ESX         3.0.3       ESX         not applicable

hosted products are VMware Workstation, Player, ACE, Fusion.

c. ESX third party update for Service Console nss and nspr RPMs

The Service Console Network Security Services (NSS) and Netscape
Portable Runtime (NSPR) libraries are updated to nspr-4.8.6-1
and nss-3.12.8-4 resolving multiple security issues.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2010-3170 and CVE-2010-3173 to these
issues.

Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.

VMware      Product     Running     Replace with/
Product     Version     on          Apply Patch
=========   ========    =======     =================
vCenter     any         Windows     not affected

hosted*     any         any         not affected

ESXi        any         ESXi        not affected

ESX         4.1         ESX         ESX410-201110214-SG
ESX         4.0         ESX         patch pending
ESX         3.5         ESX         not applicable
ESX         3.0.3       ESX         not applicable

hosted products are VMware Workstation, Player, ACE, Fusion.

d. vCenter Server and ESX, Oracle (Sun) JRE update 1.6.0_24

Oracle (Sun) JRE is updated to version 1.6.0_24, which addresses
multiple security issues that existed in earlier releases of
Oracle (Sun) JRE.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the following names to the security issues fixed in
JRE 1.6.0_24: CVE-2010-4422, CVE-2010-4447, CVE-2010-4448,
CVE-2010-4450, CVE-2010-4451, CVE-2010-4452, CVE-2010-4454,
CVE-2010-4462, CVE-2010-4463, CVE-2010-4465, CVE-2010-4466,
CVE-2010-4467, CVE-2010-4468, CVE-2010-4469, CVE-2010-4470,
CVE-2010-4471, CVE-2010-4472, CVE-2010-4473, CVE-2010-4474,
CVE-2010-4475 and CVE-2010-4476.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the following names to the security issues fixed in
JRE 1.6.0_22: CVE-2010-1321, CVE-2010-3541, CVE-2010-3548,
CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3552,
CVE-2010-3553, CVE-2010-3554, CVE-2010-3555, CVE-2010-3556,
CVE-2010-3557, CVE-2010-3558, CVE-2010-3559, CVE-2010-3560,
CVE-2010-3561, CVE-2010-3562, CVE-2010-3563, CVE-2010-3565,
CVE-2010-3566, CVE-2010-3567, CVE-2010-3568, CVE-2010-3569,
CVE-2010-3570, CVE-2010-3571, CVE-2010-3572, CVE-2010-3573 and
CVE-2010-3574.

Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.

VMware         Product   Running  Replace with/
Product        Version   on       Apply Patch
=============  ========  =======  =================
vCenter        5.0       Windows  not affected
vCenter        4.1       Windows  Update 2
vCenter        4.0       Windows  not applicable **
VirtualCenter  2.5       Windows  not applicable **

Update Manager 5.0       Windows  not affected
Update Manager 4.1       Windows  not applicable **
Update Manager 4.0       Windows  not applicable **

hosted *       any       any      not affected

ESXi           any       ESXi     not affected

ESX            4.1       ESX      ESX410-201110201-SG
ESX            4.0       ESX      not applicable **
ESX            3.5       ESX      not applicable **
ESX            3.0.3     ESX      not applicable **

hosted products are VMware Workstation, Player, ACE, Fusion. ** this product uses the Oracle (Sun) JRE 1.5.0 family

e. vCenter Update Manager Oracle (Sun) JRE update 1.5.0_30

Oracle (Sun) JRE is updated to version 1.5.0_30, which addresses
multiple security issues that existed in earlier releases of
Oracle (Sun) JRE.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the following names to the security issues fixed in
Oracle (Sun) JRE 1.5.0_30: CVE-2011-0862, CVE-2011-0873,
CVE-2011-0815, CVE-2011-0864, CVE-2011-0802, CVE-2011-0814,
CVE-2011-0871, CVE-2011-0867 and CVE-2011-0865.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the following names to the security issues fixed in
Oracle (Sun) JRE 1.5.0_28: CVE-2010-4447, CVE-2010-4448,
CVE-2010-4450, CVE-2010-4454, CVE-2010-4462, CVE-2010-4465,
CVE-2010-4466, CVE-2010-4468, CVE-2010-4469, CVE-2010-4473,
CVE-2010-4475, CVE-2010-4476.

Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.

VMware         Product   Running  Replace with/
Product        Version   on       Apply Patch
=============  ========  =======  =================
vCenter        5.0       Windows  not applicable **
vCenter        4.1       Windows  not applicable **
vCenter        4.0       Windows  patch pending
VirtualCenter  2.5       Windows  patch pending

Update Manager 5.0       Windows  not applicable **
Update Manager 4.1       Windows  Update 2
Update Manager 4.0       Windows  patch pending

hosted *       any       any      not affected

ESXi           any       ESXi     not affected

ESX            4.1       ESX      not applicable **
ESX            4.0       ESX      patch pending
ESX            3.5       ESX      patch pending
ESX            3.0.3     ESX      affected, no patch planned

hosted products are VMware Workstation, Player, ACE, Fusion. ** this product uses the Oracle (Sun) JRE 1.6.0 family

f. Integer overflow in VMware third party component sfcb

This release resolves an integer overflow issue present in the
third party library SFCB when the httpMaxContentLength has been
changed from its default value to 0 in in /etc/sfcb/sfcb.cfg. 
The integer overflow could allow remote attackers to cause a
denial of service (heap memory corruption) or possibly execute
arbitrary code via a large integer in the Content-Length HTTP
header.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-2054 to this issue.

Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.

VMware      Product     Running     Replace with/
Product     Version     on          Apply Patch
=========   ========    =======     =================
vCenter     any         Windows     not affected

hosted*     any         any         not affected

ESXi        5.0         ESXi        not affected
ESXi        4.1         ESXi        ESXi410-201110201-SG
ESXi        4.0         ESXi        not affected
ESXi        3.5         ESXi        not affected

ESX         4.1         ESX         ESX410-201110201-SG
ESX         4.0         ESX         not affected
ESX         3.5         ESX         not affected
ESX         3.0.3       ESX         not affected

hosted products are VMware Workstation, Player, ACE, Fusion.
Solution Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.

VMware vCenter Server 4.1

vCenter Server 4.1 Update 2 The download for vCenter Server includes VMware Update Manager.

Download link:

http://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_vsphere/4_1

Release Notes:

http://downloads.vmware.com/support/pubs/vs_pages/vsp_pubs_esx41_vc41.html https://www.vmware.com/support/pubs/vum_pubs.html

File: VMware-VIMSetup-all-4.1.0-493063.iso md5sum: d132326846a85bfc9ebbc53defeee6e1 sha1sum: 192c3e5d2a10bbe53c025cc7eedb3133a23e0541

File: VMware-VIMSetup-all-4.1.0-493063.zip md5sum: 7fd7b09e501bd8fde52649b395491222 sha1sum: 46dd00e7c594ac672a5d7c3c27d15be2f5a5f1f1

File: VMware-viclient-all-4.1.0-491557.exe md5sum: dafd31619ae66da65115ac3900697e3a sha1sum: 98be4d349c9a655621c068d105593be4a8e542ef

VMware ESXi 4.1

VMware ESXi 4.1 Update 2

Download link:

http://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_vsphere/4_1

Release Notes:

https://www.vmware.com/support/pubs/vs_pages/vsp_pubs_esxi41_i_vc41.html

File: VMware-VMvisor-Installer-4.1.0.update02-502767.x86_64.iso md5sum: 0aa78790a336c5fc6ba3d9807c98bfea sha1sum: 7eebd34ab5bdc81401ae20dcf59a8f8ae22086ce

File: upgrade-from-esxi4.0-to-4.1-update02-502767.zip md5sum: 459d9142a885854ef0fa6edd8d6a5677 sha1sum: 75978b6f0fc3b0ccc63babe6a65cfde6ec420d33

File: upgrade-from-ESXi3.5-to-4.1_update02.502767.zip md5sum: 3047fac78a4aaa05cf9528d62fad9d73 sha1sum: dc99b6ff352ace77d5513b4c6d8a2cb7e766a09f

File: VMware-tools-linux-8.3.12-493255.iso md5sum: 63028f2bf605d26798ac24525a0e6208 sha1sum: 95ca96eec7817da9d6e0c326ac44d8b050328932

File: VMware-viclient-all-4.1.0-491557.exe md5sum: dafd31619ae66da65115ac3900697e3a sha1sum: 98be4d349c9a655621c068d105593be4a8e542ef

VMware ESXi 4.1 Update 2 contains ESXi410-201110201-SG.

VMware ESX 4.1

VMware ESX 4.1 Update 2 Download link:

http://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_vsphere/4_1

Release Notes:

http://downloads.vmware.com/support/pubs/vs_pages/vsp_pubs_esx41_vc41.html

File: ESX-4.1.0-update02-502767.iso md5sum: 9a2b524446cbd756f0f1c7d8d88077f8 sha1sum: 2824c0628c341357a180b3ab20eb2b7ef1bee61c

File: pre-upgrade-from-esx4.0-to-4.1-502767.zip md5sum: 9060ad94d9d3bad7d4fa3e4af69a41cf sha1sum: 9b96ba630377946c42a8ce96f0b5745c56ca46b4

File: upgrade-from-esx4.0-to-4.1-update02-502767.zip md5sum: 4b60f36ee89db8cb7e1243aa02cdb549 sha1sum: 6b9168a1b01379dce7db9d79fd280509e16d013f

File: VMware-tools-linux-8.3.12-493255.iso md5sum: 63028f2bf605d26798ac24525a0e6208 sha1sum: 95ca96eec7817da9d6e0c326ac44d8b050328932

File: VMware-viclient-all-4.1.0-491557.exe md5sum: dafd31619ae66da65115ac3900697e3a sha1sum: 98be4d349c9a655621c068d105593be4a8e542ef

VMware ESX 4.1 Update 2 contains ESX410-201110204-SG, ESX410-201110206-SG, ESX410-201110201-SG and ESX410-201110214-SG.

References

CVE numbers http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7270 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1321 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2054 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3170 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3173 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3541 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3548 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3549 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3550 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3551 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3552 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3553 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3554 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3555 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3556 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3557 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3558 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3559 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3560 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3561 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3562 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3563 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3565 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3566 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3567 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3568 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3569 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3570 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3571 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3572 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3573 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3574 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4180 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4422 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4447 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4447 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4448 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4448 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4450 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4450 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4451 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4452 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4454 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4454 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4462 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4462 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4463 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4465 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4465 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4466 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4466 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4467 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4468 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4468 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4469 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4469 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4470 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4471 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4472 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4473 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4473 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4474 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4475 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4475 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4476 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4476 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0002 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0802 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0814 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0815 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0862 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0864 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0865 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0867 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0871 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0873

Change log

2011-10-27 VMSA-2011-0013 Initial security advisory in conjunction with the release of Update 2 for vCenter Server 4.1, vCenter Update Manager 4.1, vSphere Hypervisor (ESXi) 4.1 and ESX 4.1 on 2011-10-27.

Contact

E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

 * security-announce at lists.vmware.com
 * bugtraq at securityfocus.com
 * full-disclosure at lists.grok.org.uk

E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055

VMware Security Advisories http://www.vmware.com/security/advisories

VMware security response policy http://www.vmware.com/support/policies/security_response.html

General support life cycle policy http://www.vmware.com/support/policies/eos.html

VMware Infrastructure support life cycle policy http://www.vmware.com/support/policies/eos_vi.html

Copyright 2011 VMware Inc. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk6qRrIACgkQDEcm8Vbi9kPemwCeM4Q4S8aRp8X/8/LQ8NGVdU8l lJkAmweROyq5t0iWwM0EN2iP9ly6trbc =Dm8O -----END PGP SIGNATURE-----

Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201110-01

                                        http://security.gentoo.org/

Severity: High Title: OpenSSL: Multiple vulnerabilities Date: October 09, 2011 Bugs: #303739, #308011, #322575, #332027, #345767, #347623, #354139, #382069 ID: 201110-01

Synopsis

Multiple vulnerabilities were found in OpenSSL, allowing for the execution of arbitrary code and other attacks.

Background

OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.

Affected packages

-------------------------------------------------------------------
 Package              /     Vulnerable     /            Unaffected
-------------------------------------------------------------------

1 dev-libs/openssl < 1.0.0e >= 1.0.0e

Description

Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details.

Impact

A context-dependent attacker could cause a Denial of Service, possibly execute arbitrary code, bypass intended key requirements, force the downgrade to unintended ciphers, bypass the need for knowledge of shared secrets and successfully authenticate, bypass CRL validation, or obtain sensitive information in applications that use OpenSSL.

Workaround

There is no known workaround at this time.

Resolution

All OpenSSL users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.0e"

NOTE: This is a legacy GLSA. Updates for all affected architectures are available since September 17, 2011. It is likely that your system is already no longer affected by most of these issues.

References

[ 1 ] CVE-2009-3245 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3245 [ 2 ] CVE-2009-4355 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4355 [ 3 ] CVE-2010-0433 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0433 [ 4 ] CVE-2010-0740 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0740 [ 5 ] CVE-2010-0742 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0742 [ 6 ] CVE-2010-1633 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1633 [ 7 ] CVE-2010-2939 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2939 [ 8 ] CVE-2010-3864 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3864 [ 9 ] CVE-2010-4180 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4180 [ 10 ] CVE-2010-4252 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4252 [ 11 ] CVE-2011-0014 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0014 [ 12 ] CVE-2011-3207 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3207 [ 13 ] CVE-2011-3210 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3210

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201110-01.xml

Concerns?

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Debian Security Advisory DSA-2141-1 security@debian.org http://www.debian.org/security/ Stefan Fritsch January 06, 2011 http://www.debian.org/security/faq

Package : openssl Vulnerability : SSL/TLS insecure renegotiation protocol design flaw Problem type : remote Debian-specific: no CVE ID : CVE-2009-3555 CVE-2010-4180 Debian Bug : 555829

CVE-2009-3555:

Marsh Ray, Steve Dispensa, and Martin Rex discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user's session. This update adds backported support for the new RFC5746 renegotiation extension which fixes this issue.

If openssl is used in a server application, it will by default no longer accept renegotiation from clients that do not support the RFC5746 secure renegotiation extension. A separate advisory will add RFC5746 support for nss, the security library used by the iceweasel web browser. For apache2, there will be an update which allows to re-enable insecure renegotiation.

This version of openssl is not compatible with older versions of tor. You have to use at least tor version 0.2.1.26-1~lenny+1, which has been included in the point release 5.0.7 of Debian stable.

Currently we are not aware of other software with similar compatibility problems.

CVE-2010-4180:

In addition, this update fixes a flaw that allowed a client to bypass restrictions configured in the server for the used cipher suite.

For the stable distribution (lenny), this problem has been fixed in version 0.9.8g-15+lenny11.

For the unstable distribution (sid), and the testing distribution (squeeze), this problem has been fixed in version 0.9.8o-4.

We recommend that you upgrade your openssl package. In some cases the ciphersuite can be downgraded to a weaker one on subsequent connections.

The OpenSSL security team would like to thank Martin Rex for reporting this issue.

This vulnerability is tracked as CVE-2010-4180

OpenSSL JPAKE validation error

Sebastian Martini found an error in OpenSSL's J-PAKE implementation which could lead to successful validation by someone with no knowledge of the shared secret. This error is fixed in 1.0.0c. Details of the problem can be found here:

http://seb.dbzteam.org/crypto/jpake-session-key-retrieval.pdf

Note that the OpenSSL Team still consider our implementation of J-PAKE to be experimental and is not compiled by default.

Any OpenSSL based SSL/TLS server is vulnerable if it uses OpenSSL's internal caching mechanisms and the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG flag (many applications enable this by using the SSL_OP_ALL option).

All users of OpenSSL's experimental J-PAKE implementation are vulnerable to the J-PAKE validation error.

Alternatively do not set the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG and/or SSL_OP_ALL flags.

Users of OpenSSL 1.0.0 releases should update to the OpenSSL 1.0.0c release which contains a patch to correct this issue and also contains a corrected version of the CVE-2010-3864 vulnerability fix.

If upgrading is not immediately possible, the relevant source code patch provided in this advisory should be applied.

Any user of OpenSSL's J-PAKE implementaion (which is not compiled in by default) should upgrade to OpenSSL 1.0.0c.

Patch

Index: ssl/s3_clnt.c

RCS file: /v/openssl/cvs/openssl/ssl/s3_clnt.c,v retrieving revision 1.129.2.16 diff -u -r1.129.2.16 s3_clnt.c --- ssl/s3_clnt.c 10 Oct 2010 12:33:10 -0000 1.129.2.16 +++ ssl/s3_clnt.c 24 Nov 2010 14:32:37 -0000 @@ -866,8 +866,11 @@ s->session->cipher_id = s->session->cipher->id; if (s->hit && (s->session->cipher_id != c->id)) { +/ Workaround is now obsolete / +#if 0 if (!(s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG)) +#endif { al=SSL_AD_ILLEGAL_PARAMETER; SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED); Index: ssl/s3_srvr.c =================================================================== RCS file: /v/openssl/cvs/openssl/ssl/s3_srvr.c,v retrieving revision 1.171.2.22 diff -u -r1.171.2.22 s3_srvr.c --- ssl/s3_srvr.c 14 Nov 2010 13:50:29 -0000 1.171.2.22 +++ ssl/s3_srvr.c 24 Nov 2010 14:34:28 -0000 @@ -985,6 +985,10 @@ break; } } +/ Disabled because it can be used in a ciphersuite downgrade + * attack: CVE-2010-4180. + / +#if 0 if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1)) { / Special case as client bug workaround: the previously used cipher may @@ -999,6 +1003,7 @@ j = 1; } } +#endif if (j == 0) { / we need to have the cipher in the cipher

References

URL for this Security Advisory: http://www.openssl.org/news/secadv_20101202.txt

URL for updated CVS-2010-3864 Security Advisory: http://www.openssl.org/news/secadv_20101116-2.txt

. HP Integrated Lights-Out 2 (iLO2) firmware versions 2.05 and earlier. HP Integrated Lights-Out 3 (iLO3) firmware versions 1.16 and earlier.

The latest firmware and installation instructions are available from the HP Business Support Center: http://www.hp.com/go/bizsupport

HP Integrated Lights-Out 2 (iLO2) Online ROM Flash Component for Linux and Windows v2.06 or subsequent.

HP Integrated Lights-Out 3 (iLO3) Online ROM Flash Component for Linux and Windows v1.20 or subsequent

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201012-0193",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "openssl",
        "scope": "lt",
        "trust": 1.8,
        "vendor": "openssl",
        "version": "0.9.8q"
      },
      {
        "model": "openssl",
        "scope": "lt",
        "trust": 1.8,
        "vendor": "openssl",
        "version": "1.0.0c"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux enterprise server",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "suse",
        "version": "9"
      },
      {
        "model": "esx",
        "scope": "eq",
        "trust": 1.1,
        "vendor": "vmware",
        "version": "3.5"
      },
      {
        "model": "esx",
        "scope": "eq",
        "trust": 1.1,
        "vendor": "vmware",
        "version": "4.0"
      },
      {
        "model": "esx",
        "scope": "eq",
        "trust": 1.1,
        "vendor": "vmware",
        "version": "4.1"
      },
      {
        "model": "linux enterprise",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "suse",
        "version": "11.0"
      },
      {
        "model": "linux enterprise server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "suse",
        "version": "10"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "0.9.2"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "10.10"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "9.04"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "13"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "opensuse",
        "version": "11.1"
      },
      {
        "model": "linux enterprise desktop",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "suse",
        "version": "10"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "opensuse",
        "version": "11.4"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "14"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "8.04"
      },
      {
        "model": "linux enterprise desktop",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "suse",
        "version": "11"
      },
      {
        "model": "openssl",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.0.0"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "opensuse",
        "version": "11.3"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "6.06"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "opensuse",
        "version": "11.2"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "10.04"
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "efi",
        "version": null
      },
      {
        "model": "esx",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "vmware",
        "version": "3.0.3"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "v10.6 to  v10.6.7"
      },
      {
        "model": "mac os x server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "v10.6 to  v10.6.7"
      },
      {
        "model": "solaris",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "oracle",
        "version": "10"
      },
      {
        "model": "asianux server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "cybertrust",
        "version": "3 (x86)"
      },
      {
        "model": "asianux server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "cybertrust",
        "version": "3 (x86-64)"
      },
      {
        "model": "asianux server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "cybertrust",
        "version": "3.0"
      },
      {
        "model": "asianux server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "cybertrust",
        "version": "3.0 (x86-64)"
      },
      {
        "model": "hp-ux",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hewlett packard",
        "version": "11.11"
      },
      {
        "model": "hp-ux",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hewlett packard",
        "version": "11.23"
      },
      {
        "model": "hp-ux",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hewlett packard",
        "version": "11.31"
      },
      {
        "model": "cacheflow",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "blue coat",
        "version": "2.1.4.7"
      },
      {
        "model": "director",
        "scope": null,
        "trust": 0.8,
        "vendor": "blue coat",
        "version": null
      },
      {
        "model": "packetshaper",
        "scope": null,
        "trust": 0.8,
        "vendor": "blue coat",
        "version": null
      },
      {
        "model": "policycenter",
        "scope": null,
        "trust": 0.8,
        "vendor": "blue coat",
        "version": null
      },
      {
        "model": "proxyav",
        "scope": null,
        "trust": 0.8,
        "vendor": "blue coat",
        "version": null
      },
      {
        "model": "reporter",
        "scope": null,
        "trust": 0.8,
        "vendor": "blue coat",
        "version": null
      },
      {
        "model": "proxyone",
        "scope": null,
        "trust": 0.8,
        "vendor": "blue coat",
        "version": null
      },
      {
        "model": "proxysg",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "blue coat",
        "version": "6.1.2.1"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "red hat",
        "version": "4 (as)"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "red hat",
        "version": "4 (es)"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "red hat",
        "version": "4 (ws)"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "red hat",
        "version": "4.8 (as)"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "red hat",
        "version": "4.8 (es)"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "red hat",
        "version": "5 (server)"
      },
      {
        "model": "enterprise linux desktop",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "red hat",
        "version": "4.0"
      },
      {
        "model": "enterprise linux desktop",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "red hat",
        "version": "5.0 (client)"
      },
      {
        "model": "enterprise linux desktop",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "red hat",
        "version": "6"
      },
      {
        "model": "enterprise linux hpc node",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "red hat",
        "version": "6"
      },
      {
        "model": "enterprise linux server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "red hat",
        "version": "6"
      },
      {
        "model": "enterprise linux workstation",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "red hat",
        "version": "6"
      },
      {
        "model": "rhel desktop workstation",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "red hat",
        "version": "5 (client)"
      },
      {
        "model": "linux hppa",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "coat systems proxysg",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "4.3.3"
      },
      {
        "model": "linux enterprise sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "10"
      },
      {
        "model": "coat systems proxysg",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "5.2.4.3"
      },
      {
        "model": "project openssl 0.9.8f",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "model": "integrated lights out",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "21.16"
      },
      {
        "model": "proactive contact",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "3.0.4"
      },
      {
        "model": "hat jboss enterprise web server for rhel as",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "41.0"
      },
      {
        "model": "coat systems proxyav",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "3.2"
      },
      {
        "model": "project openssl g",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "proactive contact",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.1.1"
      },
      {
        "model": "hat jboss enterprise web server for rhel",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "61.0"
      },
      {
        "model": "project openssl b",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "model": "mac os server",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.6.8"
      },
      {
        "model": "voice portal sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.1"
      },
      {
        "model": "aura application enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.1"
      },
      {
        "model": "messaging storage server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.0"
      },
      {
        "model": "syslog-ng premium edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "balabit",
        "version": "3.0.6"
      },
      {
        "model": "project openssl k",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "model": "voice portal sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.1"
      },
      {
        "model": "project openssl b",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "linux amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "aura session manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "1.1"
      },
      {
        "model": "syslog-ng premium edition 3.2.1a",
        "scope": null,
        "trust": 0.3,
        "vendor": "balabit",
        "version": null
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3.7"
      },
      {
        "model": "project openssl b-36.8",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "coat systems proxyav",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "3.2.6.1"
      },
      {
        "model": "hat enterprise linux hpc node",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "6"
      },
      {
        "model": "linux i386",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "aura communication manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0"
      },
      {
        "model": "aura application enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.2.2"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.3"
      },
      {
        "model": "linux lts amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "6.06"
      },
      {
        "model": "aura system platform",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0"
      },
      {
        "model": "messaging storage server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2.8"
      },
      {
        "model": "coat systems proxysg",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "4.2.6"
      },
      {
        "model": "aura system platform sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0"
      },
      {
        "model": "insight control",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "6.1"
      },
      {
        "model": "linux powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.10"
      },
      {
        "model": "aura application enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.0.1"
      },
      {
        "model": "aura session manager sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2"
      },
      {
        "model": "aura communication manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.1"
      },
      {
        "model": "coat systems cacheflow",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "blue",
        "version": "2.1.47"
      },
      {
        "model": "linux enterprise server sp4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "10"
      },
      {
        "model": "linux enterprise sp4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "10"
      },
      {
        "model": "coat systems policy center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "8.6"
      },
      {
        "model": "ip office application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.1"
      },
      {
        "model": "linux sparc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "project openssl 0.9.8m",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "model": "linux mandrake x86 64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandriva",
        "version": "2010.1"
      },
      {
        "model": "project openssl j",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "model": "message networking",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "3.1"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3.11"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1"
      },
      {
        "model": "voice portal",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.0"
      },
      {
        "model": "aura sip enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.0"
      },
      {
        "model": "linux powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "9.10"
      },
      {
        "model": "syslog-ng premium edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "balabit",
        "version": "3.2"
      },
      {
        "model": "coat systems proxyav",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "5.2.4.8"
      },
      {
        "model": "project openssl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "1.0"
      },
      {
        "model": "coat systems proxysg",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "5.2.2.5"
      },
      {
        "model": "project openssl g",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "project openssl h",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "integrated lights out",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "32.05"
      },
      {
        "model": "edirectory sp6 patch",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "novell",
        "version": "8.83"
      },
      {
        "model": "aura system manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2"
      },
      {
        "model": "project openssl i",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "aura session manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0"
      },
      {
        "model": "project openssl 0.9.8n",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "model": "messaging storage server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2"
      },
      {
        "model": "project openssl b",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "aura system manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.1.1"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.1"
      },
      {
        "model": "project openssl 1.0.0c",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "model": "linux mandrake x86 64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandriva",
        "version": "2010.0"
      },
      {
        "model": "hat jboss enterprise web server for rhel",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "red",
        "version": "61.0.2"
      },
      {
        "model": "hat enterprise linux desktop optional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "6"
      },
      {
        "model": "linux mandrake x86 64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandriva",
        "version": "2009.0"
      },
      {
        "model": "edirectory sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "novell",
        "version": "8.8"
      },
      {
        "model": "proactive contact",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.2.2"
      },
      {
        "model": "coat systems proxysg",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "5.2.4.8"
      },
      {
        "model": "coat systems proxyav",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "2.4.2"
      },
      {
        "model": "project openssl 0.9.8p",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "model": "edirectory sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "novell",
        "version": "8.8"
      },
      {
        "model": "linux armel",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "project openssl a",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "message networking",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2.3"
      },
      {
        "model": "ssl for openvms",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "1.3"
      },
      {
        "model": "voice portal sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.0"
      },
      {
        "model": "coat systems proxyone",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "0"
      },
      {
        "model": "voice portal",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.1"
      },
      {
        "model": "esxi",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "5.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "rpath",
        "version": "1"
      },
      {
        "model": "corporate server x86 64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandrakesoft",
        "version": "4.0"
      },
      {
        "model": "aura sip enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.1"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.2.2"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "12.2"
      },
      {
        "model": "hat enterprise linux server optional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "6"
      },
      {
        "model": "voice portal sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.0"
      },
      {
        "model": "onboard administrator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "3.32"
      },
      {
        "model": "intuity audix lx sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "2.0"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5300-06"
      },
      {
        "model": "onboard administrator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "3.31"
      },
      {
        "model": "linux i386",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.10"
      },
      {
        "model": "aura application enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.0"
      },
      {
        "model": "edirectory sp4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "novell",
        "version": "8.8"
      },
      {
        "model": "linux sparc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.6"
      },
      {
        "model": "linux lts i386",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "6.06"
      },
      {
        "model": "aura session manager sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.1"
      },
      {
        "model": "aura sip enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2"
      },
      {
        "model": "enterprise linux ws",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4"
      },
      {
        "model": "aura presence services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.1"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5200-10"
      },
      {
        "model": "syslog-ng premium edition 3.2.1b",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "balabit",
        "version": null
      },
      {
        "model": "enterprise linux es",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4"
      },
      {
        "model": "project openssl h",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "linux lts sparc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "8.04"
      },
      {
        "model": "linux lts i386",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "8.04"
      },
      {
        "model": "project openssl a",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.5"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.5"
      },
      {
        "model": "aura application enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.2"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "11.4"
      },
      {
        "model": "project openssl i",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "project openssl d",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "messaging storage server sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2"
      },
      {
        "model": "messaging storage server sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.1"
      },
      {
        "model": "esxi",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "3.5"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "12.1"
      },
      {
        "model": "coat systems packetshaper",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "blue",
        "version": "8.7.1"
      },
      {
        "model": "hat jboss enterprise web server for rhel server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "51.0"
      },
      {
        "model": "corporate server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandrakesoft",
        "version": "4.0"
      },
      {
        "model": "linux enterprise sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "11"
      },
      {
        "model": "aura application enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.1"
      },
      {
        "model": "project openssl 0.9.8g",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "model": "coat systems proxysg",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "5.2.6"
      },
      {
        "model": "meeting exchange",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.0"
      },
      {
        "model": "enterprise linux desktop version",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.4"
      },
      {
        "model": "solaris 10 sparc",
        "scope": null,
        "trust": 0.3,
        "vendor": "sun",
        "version": null
      },
      {
        "model": "linux sparc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "9.10"
      },
      {
        "model": "appliance platform linux service",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "rpath",
        "version": "1"
      },
      {
        "model": "syslog-ng premium edition 3.0.7a",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "balabit",
        "version": null
      },
      {
        "model": "project openssl a",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "linux alpha",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "hat jboss enterprise web server for solaris",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "red",
        "version": "1.0.2"
      },
      {
        "model": "linux enterprise server sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "10"
      },
      {
        "model": "linux arm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "project openssl c",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "coat systems policy center",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "blue",
        "version": "8.7.1"
      },
      {
        "model": "project openssl f",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "project openssl beta2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "1.0"
      },
      {
        "model": "messaging storage server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.0"
      },
      {
        "model": "aura sip enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2.1"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.6.5"
      },
      {
        "model": "hp-ux b.11.11",
        "scope": null,
        "trust": 0.3,
        "vendor": "hp",
        "version": null
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.6"
      },
      {
        "model": "message networking sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2"
      },
      {
        "model": "project openssl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.3"
      },
      {
        "model": "coat systems proxysg",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "4.2.6.1"
      },
      {
        "model": "insight control",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "6.0"
      },
      {
        "model": "project openssl c",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.1"
      },
      {
        "model": "project openssl l",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "aura system manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.1"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1"
      },
      {
        "model": "proactive contact",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.0"
      },
      {
        "model": "aura system manager sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.1"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "11.2"
      },
      {
        "model": "project openssl 0.9.8l",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "model": "linux ia-32",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "messaging storage server sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2"
      },
      {
        "model": "enterprise server x86 64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandrakesoft",
        "version": "5"
      },
      {
        "model": "aura communication manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2"
      },
      {
        "model": "project openssl h",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "model": "aura session manager sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3.9"
      },
      {
        "model": "aura application enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.2.1"
      },
      {
        "model": "project openssl i",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "model": "message networking",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2"
      },
      {
        "model": "linux x86 64 -current",
        "scope": null,
        "trust": 0.3,
        "vendor": "slackware",
        "version": null
      },
      {
        "model": "linux mandrake",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandriva",
        "version": "2010.1"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "rpath",
        "version": "2"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.6.3"
      },
      {
        "model": "linux ia-64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "hat jboss enterprise web server for rhel es",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "red",
        "version": "41.0.2"
      },
      {
        "model": "project openssl d",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "proactive contact",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.2"
      },
      {
        "model": "meeting exchange",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.1"
      },
      {
        "model": "hat jboss enterprise web server for windows",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "red",
        "version": "1.0.2"
      },
      {
        "model": "linux powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "hp-ux b.11.23",
        "scope": null,
        "trust": 0.3,
        "vendor": "hp",
        "version": null
      },
      {
        "model": "project openssl beta2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.2"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.6.6"
      },
      {
        "model": "linux enterprise desktop sp4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "10"
      },
      {
        "model": "insight control",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "6.2"
      },
      {
        "model": "coat systems director",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "5.2.2.5"
      },
      {
        "model": "aura application enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2.3"
      },
      {
        "model": "enterprise server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandrakesoft",
        "version": "5"
      },
      {
        "model": "proactive contact",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.1"
      },
      {
        "model": "meeting exchange",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "11.1"
      },
      {
        "model": "project openssl a",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "model": "project openssl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.6.5"
      },
      {
        "model": "project openssl e",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3"
      },
      {
        "model": "project openssl c",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "model": "ssl for openvms",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "1.4"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3.12"
      },
      {
        "model": "hat enterprise linux desktop client",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "5"
      },
      {
        "model": "communication server 1000m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0"
      },
      {
        "model": "project openssl f",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "project openssl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "aix l",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.1"
      },
      {
        "model": "project openssl c",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "message networking",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2.2"
      },
      {
        "model": "linux mandrake",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandriva",
        "version": "2010.0"
      },
      {
        "model": "communication server 1000m signaling server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0"
      },
      {
        "model": "linux amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.10"
      },
      {
        "model": "linux mandrake",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mandriva",
        "version": "2009.0"
      },
      {
        "model": "hat enterprise linux hpc node optional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "6"
      },
      {
        "model": "communication server 1000e",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0"
      },
      {
        "model": "message networking",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2.1"
      },
      {
        "model": "syslog-ng premium edition 4.0.1a",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "balabit",
        "version": null
      },
      {
        "model": "project openssl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.4"
      },
      {
        "model": "project openssl l",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "aura session manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.1.1"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.6.3"
      },
      {
        "model": "coat systems proxysg",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "4.2.8.7"
      },
      {
        "model": "coat systems policy center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "8.7"
      },
      {
        "model": "appliance platform linux service",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "rpath",
        "version": "2"
      },
      {
        "model": "hat jboss enterprise web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "5.0"
      },
      {
        "model": "coat systems proxysg",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "5.2.2.4"
      },
      {
        "model": "linux arm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.10"
      },
      {
        "model": "linux lts sparc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "6.06"
      },
      {
        "model": "edirectory sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "novell",
        "version": "8.8"
      },
      {
        "model": "linux amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "9.10"
      },
      {
        "model": "coat systems proxyav",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "2.4.2.3"
      },
      {
        "model": "project openssl d",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "model": "proactive contact",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.2.1"
      },
      {
        "model": "aura system platform",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "1.1"
      },
      {
        "model": "syslog-ng premium edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "balabit",
        "version": "4.0.1"
      },
      {
        "model": "project openssl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.5"
      },
      {
        "model": "linux lts lpia",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "8.04"
      },
      {
        "model": "project openssl 1.0.0b",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "model": "linux i386",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "9.10"
      },
      {
        "model": "aura presence services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3.8"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.6.4"
      },
      {
        "model": "linux enterprise desktop sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "11"
      },
      {
        "model": "aura system manager sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0"
      },
      {
        "model": "aura application enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.2.3"
      },
      {
        "model": "aura system manager sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.1"
      },
      {
        "model": "aura communication manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.0"
      },
      {
        "model": "hp-ux b.11.31",
        "scope": null,
        "trust": 0.3,
        "vendor": "hp",
        "version": null
      },
      {
        "model": "aura system platform",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0.2"
      },
      {
        "model": "communication server 1000m signaling server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "7.0"
      },
      {
        "model": "project openssl e",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "messaging storage server sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2"
      },
      {
        "model": "project openssl f",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "model": "communication server 1000e",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "7.0"
      },
      {
        "model": "project openssl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "hat jboss enterprise web server for rhel as",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "red",
        "version": "41.0.2"
      },
      {
        "model": "coat systems packetshaper",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "8.3.2"
      },
      {
        "model": "linux mipsel",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "aura session manager sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0"
      },
      {
        "model": "linux enterprise teradata sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "10"
      },
      {
        "model": "syslog-ng premium edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "balabit",
        "version": "3.0.7"
      },
      {
        "model": "esxi",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "4.1"
      },
      {
        "model": "hat enterprise linux desktop",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "6"
      },
      {
        "model": "hat jboss enterprise web server for rhel server",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "red",
        "version": "51.0.2"
      },
      {
        "model": "hat enterprise linux as",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "4"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "11.3"
      },
      {
        "model": "linux x86 64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "13.1"
      },
      {
        "model": "proactive contact",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.1.2"
      },
      {
        "model": "aura session manager sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.1"
      },
      {
        "model": "hat jboss enterprise web server for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "1.0"
      },
      {
        "model": "project openssl k",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "linux x86 64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "13.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "12.0"
      },
      {
        "model": "coat systems proxysg",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "blue",
        "version": "6.1.21"
      },
      {
        "model": "coat systems proxysg",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "4.2.1.6"
      },
      {
        "model": "aura application enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2"
      },
      {
        "model": "syslog-ng premium edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "balabit",
        "version": "3.0.5"
      },
      {
        "model": "linux lts powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "6.06"
      },
      {
        "model": "project openssl beta3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.6.2"
      },
      {
        "model": "coat systems proxyav",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "3.2.6.0"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1.2"
      },
      {
        "model": "aura application enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.1.1"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.6.7"
      },
      {
        "model": "linux lts amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "8.04"
      },
      {
        "model": "hat jboss enterprise web server for rhel es",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "41.0"
      },
      {
        "model": "edirectory",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "novell",
        "version": "8.8"
      },
      {
        "model": "hat enterprise linux workstation optional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "6"
      },
      {
        "model": "aura system manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.6.4"
      },
      {
        "model": "linux lts powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "8.04"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "11.0"
      },
      {
        "model": "project openssl m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "intuity audix lx sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "2.0"
      },
      {
        "model": "project openssl 1.0.0a",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.6.1"
      },
      {
        "model": "voice portal",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.1.1"
      },
      {
        "model": "project openssl j",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "communication server 1000e signaling server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0"
      },
      {
        "model": "ssl for openvms",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "hp",
        "version": "1.4-453"
      },
      {
        "model": "messaging storage server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.1"
      },
      {
        "model": "project openssl 0.9.8o",
        "scope": null,
        "trust": 0.3,
        "vendor": "openssl",
        "version": null
      },
      {
        "model": "voice portal",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.0"
      },
      {
        "model": "linux -current",
        "scope": null,
        "trust": 0.3,
        "vendor": "slackware",
        "version": null
      },
      {
        "model": "project openssl e",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.8"
      },
      {
        "model": "aura system platform sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "13.1"
      },
      {
        "model": "aura sip enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.0"
      },
      {
        "model": "aura session manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.1"
      },
      {
        "model": "aura application enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2.2"
      },
      {
        "model": "hat enterprise linux server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "5"
      },
      {
        "model": "linux lpia",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "9.10"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "slackware",
        "version": "13.0"
      },
      {
        "model": "coat systems cacheflow",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "2.1.46"
      },
      {
        "model": "aura application enablement services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2.1"
      },
      {
        "model": "hat enterprise linux workstation",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "6"
      },
      {
        "model": "linux powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "aura communication manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0.1"
      },
      {
        "model": "enterprise linux desktop workstation client",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "5"
      },
      {
        "model": "aura session manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2"
      },
      {
        "model": "aura system platform",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0.1"
      },
      {
        "model": "project openssl k",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "communication server 1000e signaling server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "7.5"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.6.2"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1"
      },
      {
        "model": "voice portal",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.1"
      },
      {
        "model": "coat systems proxysg",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "4.2.10"
      },
      {
        "model": "edirectory sp5 patch",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "novell",
        "version": "8.84"
      },
      {
        "model": "linux s/390",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "aix l",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.2"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3.10"
      },
      {
        "model": "project openssl beta1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "iq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5"
      },
      {
        "model": "insight control",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "hp",
        "version": "6.3"
      },
      {
        "model": "linux amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.6.1"
      },
      {
        "model": "communication server 1000m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "7.5"
      },
      {
        "model": "solaris 10 x86",
        "scope": null,
        "trust": 0.3,
        "vendor": "sun",
        "version": null
      },
      {
        "model": "edirectory sp4 ftf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "novell",
        "version": "8.8"
      },
      {
        "model": "communication server 1000e signaling server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "7.0"
      },
      {
        "model": "proactive contact",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.0.1"
      },
      {
        "model": "iq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.1"
      },
      {
        "model": "hat enterprise linux server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "6"
      },
      {
        "model": "edirectory sp5 ftf1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "novell",
        "version": "8.8"
      },
      {
        "model": "aura conferencing standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "6.0"
      },
      {
        "model": "intuity audix lx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "2.0"
      },
      {
        "model": "project openssl m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "esxi",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "4.0"
      },
      {
        "model": "hat jboss enterprise web server for solaris",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "1.0"
      },
      {
        "model": "communication server 1000m signaling server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "7.5"
      },
      {
        "model": "linux mips",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "edirectory sp3 ftf3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "novell",
        "version": "8.8"
      },
      {
        "model": "project openssl b",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.2"
      },
      {
        "model": "aix l",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3"
      },
      {
        "model": "messaging storage server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.2.2"
      },
      {
        "model": "onboard administrator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "3.21"
      },
      {
        "model": "communication server 1000e",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "7.5"
      },
      {
        "model": "coat systems packetshaper",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "8.4"
      },
      {
        "model": "jboss enterprise web server el4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "0"
      },
      {
        "model": "project openssl j",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "linux arm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "9.10"
      },
      {
        "model": "messaging storage server sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5.1"
      },
      {
        "model": "linux m68k",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "linux arm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "debian",
        "version": "5.0"
      },
      {
        "model": "edirectory sp5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "novell",
        "version": "8.8"
      },
      {
        "model": "communication server 1000m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "7.0"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#737740"
      },
      {
        "db": "BID",
        "id": "45164"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-002548"
      },
      {
        "db": "NVD",
        "id": "CVE-2010-4180"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.0.0c",
                "versionStartIncluding": "1.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.9.8q",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_desktop:10:sp3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:suse:linux_enterprise:11.0:sp1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.9.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2010-4180"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Martin Rex",
    "sources": [
      {
        "db": "BID",
        "id": "45164"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2010-4180",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.3,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2010-4180",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2010-4180",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2010-4180",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2010-4180"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-002548"
      },
      {
        "db": "NVD",
        "id": "CVE-2010-4180"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. Fiery Network Controllers for Xerox DocuColor 242/252/260 Printer/Copier use a vulnerable version of OpenSSL (0.9.8o). OpenSSL is prone to a security weakness that may allow attackers to downgrade the ciphersuite. \nSuccessfully exploiting this issue in conjunction with other latent vulnerabilities may allow attackers to gain access to sensitive information or gain unauthorized access to an affected application that uses OpenSSL. \nReleases prior to OpenSSL 1.0.0c are affected. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c02824483\nVersion: 1\n\nHPSBOV02670 SSRT100475 rev.1 - HP OpenVMS running SSL, Remote Denial of Service (DoS), Unauthorized Disclosure of Information, Unauthorized Modification\n\nNOTICE: The information in this Security Bulletin should be acted upon as soon as possible. \n\nRelease Date: 2011-05-05\nLast Updated: 2011-05-05\n\nPotential Security Impact: Remote Denial of Service (DoS), Unauthorized disclosure of information, unauthorized modification\n\nSource: Hewlett-Packard Company, HP Software Security Response Team\n\nVULNERABILITY SUMMARY\nPotential vulnerabilities have been identified with HP OpenVMS running SSL. The vulnerabilities could be remotely exploited to create a Denial of Service (DoS) or unauthorized disclosure of information, or by a remote unauthorized user to modify data, prompts, or responses. \n\nReferences: CVE-2011-0014, CVE-2010-4180, CVE-2010-4252, CVE-2010-3864\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \nHP SSL for OpenVMS v 1.4 and earlier. \n\nBACKGROUND\n\nCVSS 2.0 Base Metrics\n===========================================================\n  Reference              Base Vector             Base Score\nCVE-2011-0014    (AV:N/AC:L/Au:N/C:N/I:N/A:P)       5.0\nCVE-2010-4180    (AV:N/AC:M/Au:N/C:N/I:P/A:N)       4.3\nCVE-2010-4252    (AV:N/AC:L/Au:N/C:P/I:P/A:P)       7.5\nCVE-2010-3864    (AV:N/AC:H/Au:N/C:C/I:C/A:C)       7.6\n===========================================================\n             Information on CVSS is documented\n            in HP Customer Notice: HPSN-2008-002\n\nRESOLUTION\n\nHP has made the following software updates available to resolve these vulnerabilities. \n\nHP SSL V1.4-453 for OpenVMS Alpha and OpenVMS Integrity servers:\nhttp://h71000.www7.hp.com/openvms/products/ssl/ssl.html\n\nHISTORY\nVersion:1 (rev.1) - 5 May 2011 Initial release\n\nThird Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer\u0027s patch management policy. \n\nSupport: For further information, contact normal HP Services support channel. \n\nReport: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com\nIt is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information. \nTo get the security-alert PGP key, please send an e-mail message as follows:\n  To: security-alert@hp.com\n  Subject: get key\nSubscribe: To initiate a subscription to receive future HP Security Bulletins via Email:\nhttp://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA\u0026langcode=USENG\u0026jumpid=in_SC-GEN__driverITRC\u0026topiccode=ITRC\nOn the web page: ITRC security bulletins and patch sign-up\nUnder Step1: your ITRC security bulletins and patches\n    -check ALL categories for which alerts are required and continue. \nUnder Step2: your ITRC operating systems\n    -verify your operating system selections are checked and save. \n\nTo update an existing subscription: http://h30046.www3.hp.com/subSignIn.php\nLog in on the web page: Subscriber\u0027s choice for Business: sign-in. \nOn the web page: Subscriber\u0027s Choice: your profile summary - use Edit Profile to update appropriate sections. \n\nTo review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do\n\n* The Software Product Category that this Security Bulletin\nrelates to is represented by the 5th and 6th characters\nof the Bulletin number in the title:\n\nGN = HP General SW\nMA = HP Management Agents\nMI = Misc. 3rd Party SW\nMP = HP MPE/iX\nNS = HP NonStop Servers\nOV = HP OpenVMS\nPI = HP Printing \u0026 Imaging\nST = HP Storage SW\nTL = HP Trusted Linux\nTU = HP Tru64 UNIX\nUX = HP-UX\nVV = HP VirtualVault\n\nSystem management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions. \n\n\"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user\u0027s use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement.\"\n\nCopyright 2011 Hewlett-Packard Development Company, L.P. \nHewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided \"as is\" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n- ------------------------------------------------------------------------\n                        VMware Security Advisory\n\nAdvisory ID: VMSA-2011-0013\nSynopsis:    VMware third party component updates for VMware vCenter\n             Server, vCenter Update Manager, ESXi and ESX\nIssue date:  2011-10-27\nUpdated on:  2011-10-27 (initial release of advisory)\nCVE numbers: --- openssl ---\n             CVE-2008-7270 CVE-2010-4180\n             --- libuser ---\n             CVE-2011-0002\n             --- nss, nspr ---\n             CVE-2010-3170 CVE-2010-3173\n             --- Oracle (Sun) JRE 1.6.0 ---\n             CVE-2010-1321 CVE-2010-3541 CVE-2010-3548 CVE-2010-3549\n             CVE-2010-3550 CVE-2010-3551 CVE-2010-3552 CVE-2010-3553\n             CVE-2010-3554 CVE-2010-3555 CVE-2010-3556 CVE-2010-3557\n             CVE-2010-3558 CVE-2010-3559 CVE-2010-3560 CVE-2010-3561\n             CVE-2010-3562 CVE-2010-3563 CVE-2010-3565 CVE-2010-3566\n             CVE-2010-3567 CVE-2010-3568 CVE-2010-3569 CVE-2010-3570\n             CVE-2010-3571 CVE-2010-3572 CVE-2010-3573 CVE-2010-3574\n             CVE-2010-4422 CVE-2010-4447 CVE-2010-4448 CVE-2010-4450\n             CVE-2010-4451 CVE-2010-4452 CVE-2010-4454 CVE-2010-4462\n             CVE-2010-4463 CVE-2010-4465 CVE-2010-4466 CVE-2010-4467\n             CVE-2010-4468 CVE-2010-4469 CVE-2010-4470 CVE-2010-4471\n             CVE-2010-4472 CVE-2010-4473 CVE-2010-4474 CVE-2010-4475\n             CVE-2010-4476\n             --- Oracle (Sun) JRE 1.5.0 ---\n             CVE-2010-4447 CVE-2010-4448 CVE-2010-4450 CVE-2010-4454\n             CVE-2010-4462 CVE-2010-4465 CVE-2010-4466 CVE-2010-4468\n             CVE-2010-4469 CVE-2010-4473 CVE-2010-4475 CVE-2010-4476\n             CVE-2011-0862 CVE-2011-0873 CVE-2011-0815 CVE-2011-0864\n             CVE-2011-0802 CVE-2011-0814 CVE-2011-0871 CVE-2011-0867\n             CVE-2011-0865\n             --- SFCB ---\n             CVE-2010-2054\n- ------------------------------------------------------------------------\n\n1. Summary\n\n   Update 2 for vCenter Server 4.1, vCenter Update Manager 4.1, vSphere\n   Hypervisor (ESXi) 4.1 and ESX 4.1 addresses several security issues. \n\n2. Relevant releases\n\n   vCenter Server 4.1 without Update 2\n\n   vCenter Update Manager 4.1 without Update 2\n\n   ESXi 4.1 without patch ESX410-201110201-SG. \n\n   ESX 4.1 without patches ESX410-201110201-SG,\n   ESX410-201110204-SG, ESX410-201110206-SG,ESX410-201110214-SG. \n\n3. Problem Description\n\n a. ESX third party update for Service Console openssl RPM\n\n    The Service Console openssl RPM is updated to\n    openssl-0.9.8e.12.el5_5.7 resolving two security issues. \n\n    The Common Vulnerabilities and Exposures project (cve.mitre.org)\n    has assigned the names CVE-2008-7270 and CVE-2010-4180 to these\n    issues. \n\n    Column 4 of the following table lists the action required to\n    remediate the vulnerability in each release, if a solution is\n    available. \n\n    VMware      Product     Running     Replace with/\n    Product     Version     on          Apply Patch\n    =========   ========    =======     =================\n    vCenter     any         Windows     not affected\n\n    hosted*     any         any         not affected\n\n    ESXi        any         any         not affected\n\n    ESX         4.1         ESX         ESX410-201110204-SG\n    ESX         4.0         ESX         patch pending\n    ESX         3.5         ESX         not applicable\n    ESX         3.0.3       ESX         not applicable\n\n  * hosted products are VMware Workstation, Player, ACE, Fusion. \n\n b. ESX third party update for Service Console libuser RPM\n\n    The Service Console libuser RPM is updated to version\n    0.54.7-2.1.el5_5.2 to resolve a security issue. \n\n    The Common Vulnerabilities and Exposures Project (cve.mitre.org)\n    has assigned the name CVE-2011-0002 to this issue. \n\n    Column 4 of the following table lists the action required to\n    remediate the vulnerability in each release, if a solution is\n    available. \n\n    VMware      Product     Running     Replace with/\n    Product     Version     on          Apply Patch\n    =========   ========    =======     =================\n    vCenter     any         Windows     not affected\n\n    hosted*     any         any         not affected\n\n    ESXi        any         ESXi        not affected\n\n    ESX         4.1         ESX         ESX410-201110206-SG\n    ESX         4.0         ESX         patch pending\n    ESX         3.5         ESX         not applicable\n    ESX         3.0.3       ESX         not applicable\n\n  * hosted products are VMware Workstation, Player, ACE, Fusion. \n\n c. ESX third party update for Service Console nss and nspr RPMs\n\n    The Service Console Network Security Services (NSS) and Netscape\n    Portable Runtime (NSPR) libraries are updated to nspr-4.8.6-1\n    and nss-3.12.8-4 resolving multiple security issues. \n\n    The Common Vulnerabilities and Exposures project (cve.mitre.org)\n    has assigned the names CVE-2010-3170 and CVE-2010-3173 to these\n    issues. \n\n    Column 4 of the following table lists the action required to\n    remediate the vulnerability in each release, if a solution is\n    available. \n\n    VMware      Product     Running     Replace with/\n    Product     Version     on          Apply Patch\n    =========   ========    =======     =================\n    vCenter     any         Windows     not affected\n\n    hosted*     any         any         not affected\n\n    ESXi        any         ESXi        not affected\n\n    ESX         4.1         ESX         ESX410-201110214-SG\n    ESX         4.0         ESX         patch pending\n    ESX         3.5         ESX         not applicable\n    ESX         3.0.3       ESX         not applicable\n\n  * hosted products are VMware Workstation, Player, ACE, Fusion. \n\n d. vCenter Server and ESX, Oracle (Sun) JRE update 1.6.0_24\n\n    Oracle (Sun) JRE is updated to version 1.6.0_24, which addresses\n    multiple security issues that existed in earlier releases of\n    Oracle (Sun) JRE. \n\n    The Common Vulnerabilities and Exposures project (cve.mitre.org)\n    has assigned the following names to the security issues fixed in\n    JRE 1.6.0_24: CVE-2010-4422, CVE-2010-4447, CVE-2010-4448,\n    CVE-2010-4450, CVE-2010-4451, CVE-2010-4452, CVE-2010-4454,\n    CVE-2010-4462, CVE-2010-4463, CVE-2010-4465, CVE-2010-4466,\n    CVE-2010-4467, CVE-2010-4468, CVE-2010-4469, CVE-2010-4470,\n    CVE-2010-4471, CVE-2010-4472, CVE-2010-4473, CVE-2010-4474,\n    CVE-2010-4475 and CVE-2010-4476. \n\n    The Common Vulnerabilities and Exposures project (cve.mitre.org)\n    has assigned the following names to the security issues fixed in\n    JRE 1.6.0_22: CVE-2010-1321, CVE-2010-3541, CVE-2010-3548,\n    CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3552,\n    CVE-2010-3553, CVE-2010-3554, CVE-2010-3555, CVE-2010-3556,\n    CVE-2010-3557, CVE-2010-3558, CVE-2010-3559, CVE-2010-3560,\n    CVE-2010-3561, CVE-2010-3562, CVE-2010-3563, CVE-2010-3565,\n    CVE-2010-3566, CVE-2010-3567, CVE-2010-3568, CVE-2010-3569,\n    CVE-2010-3570, CVE-2010-3571, CVE-2010-3572, CVE-2010-3573 and\n    CVE-2010-3574. \n\n    Column 4 of the following table lists the action required to\n    remediate the vulnerability in each release, if a solution is\n    available. \n\n    VMware         Product   Running  Replace with/\n    Product        Version   on       Apply Patch\n    =============  ========  =======  =================\n    vCenter        5.0       Windows  not affected\n    vCenter        4.1       Windows  Update 2\n    vCenter        4.0       Windows  not applicable **\n    VirtualCenter  2.5       Windows  not applicable **\n\n    Update Manager 5.0       Windows  not affected\n    Update Manager 4.1       Windows  not applicable **\n    Update Manager 4.0       Windows  not applicable **\n\n    hosted *       any       any      not affected\n\n    ESXi           any       ESXi     not affected\n\n    ESX            4.1       ESX      ESX410-201110201-SG\n    ESX            4.0       ESX      not applicable **\n    ESX            3.5       ESX      not applicable **\n    ESX            3.0.3     ESX      not applicable **\n\n  * hosted products are VMware Workstation, Player, ACE, Fusion. \n ** this product uses the Oracle (Sun) JRE 1.5.0 family\n\n e. vCenter Update Manager Oracle (Sun) JRE update 1.5.0_30\n\n    Oracle (Sun) JRE is updated to version 1.5.0_30, which addresses\n    multiple security issues that existed in earlier releases of\n    Oracle (Sun) JRE. \n\n    The Common Vulnerabilities and Exposures project (cve.mitre.org)\n    has assigned the following names to the security issues fixed in\n    Oracle (Sun) JRE 1.5.0_30: CVE-2011-0862, CVE-2011-0873,\n    CVE-2011-0815, CVE-2011-0864, CVE-2011-0802, CVE-2011-0814,\n    CVE-2011-0871, CVE-2011-0867 and CVE-2011-0865. \n\n    The Common Vulnerabilities and Exposures project (cve.mitre.org)\n    has assigned the following names to the security issues fixed in\n    Oracle (Sun) JRE 1.5.0_28: CVE-2010-4447, CVE-2010-4448,\n    CVE-2010-4450, CVE-2010-4454, CVE-2010-4462, CVE-2010-4465,\n    CVE-2010-4466, CVE-2010-4468, CVE-2010-4469, CVE-2010-4473,\n    CVE-2010-4475, CVE-2010-4476. \n\n    Column 4 of the following table lists the action required to\n    remediate the vulnerability in each release, if a solution is\n    available. \n\n    VMware         Product   Running  Replace with/\n    Product        Version   on       Apply Patch\n    =============  ========  =======  =================\n    vCenter        5.0       Windows  not applicable **\n    vCenter        4.1       Windows  not applicable **\n    vCenter        4.0       Windows  patch pending\n    VirtualCenter  2.5       Windows  patch pending\n\n    Update Manager 5.0       Windows  not applicable **\n    Update Manager 4.1       Windows  Update 2\n    Update Manager 4.0       Windows  patch pending\n\n    hosted *       any       any      not affected\n\n    ESXi           any       ESXi     not affected\n\n    ESX            4.1       ESX      not applicable **\n    ESX            4.0       ESX      patch pending\n    ESX            3.5       ESX      patch pending\n    ESX            3.0.3     ESX      affected, no patch planned\n\n  * hosted products are VMware Workstation, Player, ACE, Fusion. \n ** this product uses the Oracle (Sun) JRE 1.6.0 family\n\n f. Integer overflow in VMware third party component sfcb\n\n    This release resolves an integer overflow issue present in the\n    third party library SFCB when the httpMaxContentLength has been\n    changed from its default value to 0 in in /etc/sfcb/sfcb.cfg. \n    The integer overflow could allow remote attackers to cause a\n    denial of service (heap memory corruption) or possibly execute\n    arbitrary code via a large integer in the Content-Length HTTP\n    header. \n\n    The Common Vulnerabilities and Exposures project (cve.mitre.org)\n    has assigned the name CVE-2010-2054 to this issue. \n\n    Column 4 of the following table lists the action required to\n    remediate the vulnerability in each release, if a solution is\n    available. \n\n    VMware      Product     Running     Replace with/\n    Product     Version     on          Apply Patch\n    =========   ========    =======     =================\n    vCenter     any         Windows     not affected\n\n    hosted*     any         any         not affected\n\n    ESXi        5.0         ESXi        not affected\n    ESXi        4.1         ESXi        ESXi410-201110201-SG\n    ESXi        4.0         ESXi        not affected\n    ESXi        3.5         ESXi        not affected\n\n    ESX         4.1         ESX         ESX410-201110201-SG\n    ESX         4.0         ESX         not affected\n    ESX         3.5         ESX         not affected\n    ESX         3.0.3       ESX         not affected\n\n  * hosted products are VMware Workstation, Player, ACE, Fusion. \n\n4. Solution\n   Please review the patch/release notes for your product and version\n   and verify the checksum of your downloaded file. \n\n   VMware vCenter Server 4.1\n   ----------------------------------------------\n   vCenter Server 4.1 Update 2\n   The download for vCenter Server includes VMware Update Manager. \n\n   Download link:\n\nhttp://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_vsphere/4_1\n\n   Release Notes:\n\nhttp://downloads.vmware.com/support/pubs/vs_pages/vsp_pubs_esx41_vc41.html\n   https://www.vmware.com/support/pubs/vum_pubs.html\n\n   File: VMware-VIMSetup-all-4.1.0-493063.iso\n   md5sum: d132326846a85bfc9ebbc53defeee6e1\n   sha1sum: 192c3e5d2a10bbe53c025cc7eedb3133a23e0541\n\n   File: VMware-VIMSetup-all-4.1.0-493063.zip\n   md5sum: 7fd7b09e501bd8fde52649b395491222\n   sha1sum: 46dd00e7c594ac672a5d7c3c27d15be2f5a5f1f1\n\n   File: VMware-viclient-all-4.1.0-491557.exe\n   md5sum: dafd31619ae66da65115ac3900697e3a\n   sha1sum: 98be4d349c9a655621c068d105593be4a8e542ef\n\n   VMware ESXi 4.1\n   ---------------\n   VMware ESXi 4.1 Update 2\n\n   Download link:\n\nhttp://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_vsphere/4_1\n\n   Release Notes:\n\nhttps://www.vmware.com/support/pubs/vs_pages/vsp_pubs_esxi41_i_vc41.html\n\n   File: VMware-VMvisor-Installer-4.1.0.update02-502767.x86_64.iso\n   md5sum: 0aa78790a336c5fc6ba3d9807c98bfea\n   sha1sum: 7eebd34ab5bdc81401ae20dcf59a8f8ae22086ce\n\n   File: upgrade-from-esxi4.0-to-4.1-update02-502767.zip\n   md5sum: 459d9142a885854ef0fa6edd8d6a5677\n   sha1sum: 75978b6f0fc3b0ccc63babe6a65cfde6ec420d33\n\n   File: upgrade-from-ESXi3.5-to-4.1_update02.502767.zip\n   md5sum: 3047fac78a4aaa05cf9528d62fad9d73\n   sha1sum: dc99b6ff352ace77d5513b4c6d8a2cb7e766a09f\n\n   File: VMware-tools-linux-8.3.12-493255.iso\n   md5sum: 63028f2bf605d26798ac24525a0e6208\n   sha1sum: 95ca96eec7817da9d6e0c326ac44d8b050328932\n\n   File: VMware-viclient-all-4.1.0-491557.exe\n   md5sum: dafd31619ae66da65115ac3900697e3a\n   sha1sum: 98be4d349c9a655621c068d105593be4a8e542ef\n\n   VMware ESXi 4.1 Update 2 contains ESXi410-201110201-SG. \n\n   VMware ESX 4.1\n   --------------\n   VMware ESX 4.1 Update 2\n   Download link:\n\nhttp://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_vsphere/4_1\n\n   Release Notes:\n\nhttp://downloads.vmware.com/support/pubs/vs_pages/vsp_pubs_esx41_vc41.html\n\n   File: ESX-4.1.0-update02-502767.iso\n   md5sum: 9a2b524446cbd756f0f1c7d8d88077f8\n   sha1sum: 2824c0628c341357a180b3ab20eb2b7ef1bee61c\n\n   File: pre-upgrade-from-esx4.0-to-4.1-502767.zip\n   md5sum: 9060ad94d9d3bad7d4fa3e4af69a41cf\n   sha1sum: 9b96ba630377946c42a8ce96f0b5745c56ca46b4\n\n   File: upgrade-from-esx4.0-to-4.1-update02-502767.zip\n   md5sum: 4b60f36ee89db8cb7e1243aa02cdb549\n   sha1sum: 6b9168a1b01379dce7db9d79fd280509e16d013f\n\n   File: VMware-tools-linux-8.3.12-493255.iso\n   md5sum: 63028f2bf605d26798ac24525a0e6208\n   sha1sum: 95ca96eec7817da9d6e0c326ac44d8b050328932\n\n   File: VMware-viclient-all-4.1.0-491557.exe\n   md5sum: dafd31619ae66da65115ac3900697e3a\n   sha1sum: 98be4d349c9a655621c068d105593be4a8e542ef\n\n   VMware ESX 4.1 Update 2 contains ESX410-201110204-SG,\n   ESX410-201110206-SG, ESX410-201110201-SG and\n   ESX410-201110214-SG. \n\n5. References\n\n   CVE numbers\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7270\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1321\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2054\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3170\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3173\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3541\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3548\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3549\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3550\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3551\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3552\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3553\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3554\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3555\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3556\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3557\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3558\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3559\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3560\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3561\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3562\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3563\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3565\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3566\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3567\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3568\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3569\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3570\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3571\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3572\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3573\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3574\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4180\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4422\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4447\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4447\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4448\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4448\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4450\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4450\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4451\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4452\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4454\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4454\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4462\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4462\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4463\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4465\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4465\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4466\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4466\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4467\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4468\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4468\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4469\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4469\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4470\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4471\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4472\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4473\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4473\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4474\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4475\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4475\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4476\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4476\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0002\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0802\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0814\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0815\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0862\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0864\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0865\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0867\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0871\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0873\n\n- ------------------------------------------------------------------------\n6. Change log\n\n   2011-10-27 VMSA-2011-0013\n   Initial security advisory in conjunction with the release of\n   Update 2 for vCenter Server 4.1, vCenter Update Manager 4.1,\n   vSphere Hypervisor (ESXi) 4.1 and ESX 4.1 on 2011-10-27. \n\n- ------------------------------------------------------------------------\n\n7. Contact\n\n   E-mail list for product security notifications and announcements:\n   http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce\n\n   This Security Advisory is posted to the following lists:\n\n     * security-announce at lists.vmware.com\n     * bugtraq at securityfocus.com\n     * full-disclosure at lists.grok.org.uk\n\n   E-mail:  security at vmware.com\n   PGP key at: http://kb.vmware.com/kb/1055\n\n   VMware Security Advisories\n   http://www.vmware.com/security/advisories\n\n   VMware security response policy\n   http://www.vmware.com/support/policies/security_response.html\n\n   General support life cycle policy\n   http://www.vmware.com/support/policies/eos.html\n\n   VMware Infrastructure support life cycle policy\n   http://www.vmware.com/support/policies/eos_vi.html\n\n   Copyright 2011 VMware Inc.  All rights reserved. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG/MacGPG2 v2.0.17 (Darwin)\nComment: GPGTools - http://gpgtools.org\nComment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/\n\niEYEARECAAYFAk6qRrIACgkQDEcm8Vbi9kPemwCeM4Q4S8aRp8X/8/LQ8NGVdU8l\nlJkAmweROyq5t0iWwM0EN2iP9ly6trbc\n=Dm8O\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 201110-01\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                            http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: High\n    Title: OpenSSL: Multiple vulnerabilities\n     Date: October 09, 2011\n     Bugs: #303739, #308011, #322575, #332027, #345767, #347623,\n           #354139, #382069\n       ID: 201110-01\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities were found in OpenSSL, allowing for the\nexecution of arbitrary code and other attacks. \n\nBackground\n==========\n\nOpenSSL is an Open Source toolkit implementing the Secure Sockets Layer\n(SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general\npurpose cryptography library. \n\nAffected packages\n=================\n\n    -------------------------------------------------------------------\n     Package              /     Vulnerable     /            Unaffected\n    -------------------------------------------------------------------\n  1  dev-libs/openssl             \u003c 1.0.0e                  \u003e= 1.0.0e\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in OpenSSL. Please review\nthe CVE identifiers referenced below for details. \n\nImpact\n======\n\nA context-dependent attacker could cause a Denial of Service, possibly\nexecute arbitrary code, bypass intended key requirements, force the\ndowngrade to unintended ciphers, bypass the need for knowledge of\nshared secrets and successfully authenticate, bypass CRL validation, or\nobtain sensitive information in applications that use OpenSSL. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll OpenSSL users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=dev-libs/openssl-1.0.0e\"\n\nNOTE: This is a legacy GLSA. Updates for all affected architectures are\navailable since September 17, 2011. It is likely that your system is\nalready no longer affected by most of these issues. \n\nReferences\n==========\n\n[  1 ] CVE-2009-3245\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3245\n[  2 ] CVE-2009-4355\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4355\n[  3 ] CVE-2010-0433\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0433\n[  4 ] CVE-2010-0740\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0740\n[  5 ] CVE-2010-0742\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0742\n[  6 ] CVE-2010-1633\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1633\n[  7 ] CVE-2010-2939\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2939\n[  8 ] CVE-2010-3864\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3864\n[  9 ] CVE-2010-4180\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4180\n[ 10 ] CVE-2010-4252\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4252\n[ 11 ] CVE-2011-0014\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0014\n[ 12 ] CVE-2011-3207\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3207\n[ 13 ] CVE-2011-3210\n       http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3210\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201110-01.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2011 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n- ------------------------------------------------------------------------\nDebian Security Advisory DSA-2141-1                  security@debian.org\nhttp://www.debian.org/security/                           Stefan Fritsch\nJanuary 06, 2011                      http://www.debian.org/security/faq\n- ------------------------------------------------------------------------\n\nPackage        : openssl\nVulnerability  : SSL/TLS insecure renegotiation protocol design flaw\nProblem type   : remote\nDebian-specific: no\nCVE ID         : CVE-2009-3555 CVE-2010-4180\nDebian Bug     : 555829\n\nCVE-2009-3555:\n\nMarsh Ray, Steve Dispensa, and Martin Rex discovered a flaw in the TLS\nand SSLv3 protocols. If an attacker could perform a man in the middle\nattack at the start of a TLS connection, the attacker could inject\narbitrary content at the beginning of the user\u0027s session. This update\nadds backported support for the new RFC5746 renegotiation extension\nwhich fixes this issue. \n\nIf openssl is used in a server application, it will by default no\nlonger accept renegotiation from clients that do not support the\nRFC5746 secure renegotiation extension. A separate advisory will add\nRFC5746 support for nss, the security library used by the iceweasel\nweb browser. For apache2, there will be an update which allows to\nre-enable insecure renegotiation. \n\nThis version of openssl is not compatible with older versions of tor. \nYou have to use at least tor version 0.2.1.26-1~lenny+1, which has\nbeen included in the point release 5.0.7 of Debian stable. \n\nCurrently we are not aware of other software with similar compatibility\nproblems. \n\n\nCVE-2010-4180:\n \nIn addition, this update fixes a flaw that allowed a client to bypass\nrestrictions configured in the server for the used cipher suite. \n\n\nFor the stable distribution (lenny), this problem has been fixed\nin version 0.9.8g-15+lenny11. \n\nFor the unstable distribution (sid), and the testing distribution\n(squeeze), this problem has been fixed in version 0.9.8o-4. \n\nWe recommend that you upgrade your openssl package. In some cases the ciphersuite can be downgraded to a weaker one\non subsequent connections. \n\nThe OpenSSL security team would like to thank Martin Rex for reporting this\nissue. \n\nThis vulnerability is tracked as CVE-2010-4180\n\nOpenSSL JPAKE validation error\n===============================\n\nSebastian Martini found an error in OpenSSL\u0027s J-PAKE implementation\nwhich could lead to successful validation by someone with no knowledge\nof the shared secret. This error is fixed in 1.0.0c. Details of the\nproblem can be found here:\n\nhttp://seb.dbzteam.org/crypto/jpake-session-key-retrieval.pdf\n\nNote that the OpenSSL Team still consider our implementation of J-PAKE\nto be experimental and is not compiled by default. \n\nAny OpenSSL based SSL/TLS server is vulnerable if it uses\nOpenSSL\u0027s internal caching mechanisms and the\nSSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG flag (many applications enable this\nby using the SSL_OP_ALL option). \n\nAll users of OpenSSL\u0027s experimental J-PAKE implementation are vulnerable\nto the J-PAKE validation error. \n\nAlternatively do not set the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG\nand/or SSL_OP_ALL flags. \n\nUsers of OpenSSL 1.0.0 releases should update to the OpenSSL 1.0.0c release\nwhich contains a patch to correct this issue and also contains a corrected\nversion of the CVE-2010-3864 vulnerability fix. \n\nIf upgrading is not immediately possible, the relevant source code patch\nprovided in this advisory should be applied. \n\nAny user of OpenSSL\u0027s J-PAKE implementaion (which is not compiled in by \ndefault) should upgrade to OpenSSL 1.0.0c. \n\nPatch\n=====\n\nIndex: ssl/s3_clnt.c\n===================================================================\nRCS file: /v/openssl/cvs/openssl/ssl/s3_clnt.c,v\nretrieving revision 1.129.2.16\ndiff -u -r1.129.2.16 s3_clnt.c\n--- ssl/s3_clnt.c\t10 Oct 2010 12:33:10 -0000\t1.129.2.16\n+++ ssl/s3_clnt.c\t24 Nov 2010 14:32:37 -0000\n@@ -866,8 +866,11 @@\n \t\ts-\u003esession-\u003ecipher_id = s-\u003esession-\u003ecipher-\u003eid;\n \tif (s-\u003ehit \u0026\u0026 (s-\u003esession-\u003ecipher_id != c-\u003eid))\n \t\t{\n+/* Workaround is now obsolete */\n+#if 0\n \t\tif (!(s-\u003eoptions \u0026\n \t\t\tSSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG))\n+#endif\n \t\t\t{\n \t\t\tal=SSL_AD_ILLEGAL_PARAMETER;\n \t\t\tSSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);\nIndex: ssl/s3_srvr.c\n===================================================================\nRCS file: /v/openssl/cvs/openssl/ssl/s3_srvr.c,v\nretrieving revision 1.171.2.22\ndiff -u -r1.171.2.22 s3_srvr.c\n--- ssl/s3_srvr.c\t14 Nov 2010 13:50:29 -0000\t1.171.2.22\n+++ ssl/s3_srvr.c\t24 Nov 2010 14:34:28 -0000\n@@ -985,6 +985,10 @@\n \t\t\t\tbreak;\n \t\t\t\t}\n \t\t\t}\n+/* Disabled because it can be used in a ciphersuite downgrade\n+ * attack: CVE-2010-4180. \n+ */\n+#if 0\n \t\tif (j == 0 \u0026\u0026 (s-\u003eoptions \u0026 SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) \u0026\u0026 (sk_SSL_CIPHER_num(ciphers) == 1))\n \t\t\t{\n \t\t\t/* Special case as client bug workaround: the previously used cipher may\n@@ -999,6 +1003,7 @@\n \t\t\t\tj = 1;\n \t\t\t\t}\n \t\t\t}\n+#endif\n \t\tif (j == 0)\n \t\t\t{\n \t\t\t/* we need to have the cipher in the cipher\n\n\n\nReferences\n===========\n\nURL for this Security Advisory:\nhttp://www.openssl.org/news/secadv_20101202.txt\n\nURL for updated CVS-2010-3864 Security Advisory:\nhttp://www.openssl.org/news/secadv_20101116-2.txt\n\n\n. \nHP Integrated Lights-Out 2 (iLO2) firmware versions 2.05 and earlier. \nHP Integrated Lights-Out 3 (iLO3) firmware versions 1.16 and earlier. \n\nThe latest firmware and installation instructions are available from the HP Business Support Center: http://www.hp.com/go/bizsupport\n\nHP Integrated Lights-Out 2 (iLO2) Online ROM Flash Component for Linux and Windows v2.06 or subsequent. \n\nHP Integrated Lights-Out 3 (iLO3) Online ROM Flash Component for Linux and Windows v1.20 or subsequent",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2010-4180"
      },
      {
        "db": "CERT/CC",
        "id": "VU#737740"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-002548"
      },
      {
        "db": "BID",
        "id": "45164"
      },
      {
        "db": "VULMON",
        "id": "CVE-2010-4180"
      },
      {
        "db": "PACKETSTORM",
        "id": "101256"
      },
      {
        "db": "PACKETSTORM",
        "id": "106330"
      },
      {
        "db": "PACKETSTORM",
        "id": "105638"
      },
      {
        "db": "PACKETSTORM",
        "id": "97287"
      },
      {
        "db": "PACKETSTORM",
        "id": "96498"
      },
      {
        "db": "PACKETSTORM",
        "id": "106754"
      }
    ],
    "trust": 3.24
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2010-4180",
        "trust": 2.9
      },
      {
        "db": "CERT/CC",
        "id": "VU#737740",
        "trust": 2.2
      },
      {
        "db": "BID",
        "id": "45164",
        "trust": 2.2
      },
      {
        "db": "SECUNIA",
        "id": "42473",
        "trust": 1.9
      },
      {
        "db": "VUPEN",
        "id": "ADV-2010-3120",
        "trust": 1.9
      },
      {
        "db": "SECTRACK",
        "id": "1024822",
        "trust": 1.9
      },
      {
        "db": "OSVDB",
        "id": "69565",
        "trust": 1.9
      },
      {
        "db": "SECUNIA",
        "id": "43169",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "42811",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "42469",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "43172",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "42571",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "42493",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "43173",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "44269",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "43170",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "42620",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "42877",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "43171",
        "trust": 1.1
      },
      {
        "db": "VUPEN",
        "id": "ADV-2011-0076",
        "trust": 1.1
      },
      {
        "db": "VUPEN",
        "id": "ADV-2010-3188",
        "trust": 1.1
      },
      {
        "db": "VUPEN",
        "id": "ADV-2011-0268",
        "trust": 1.1
      },
      {
        "db": "VUPEN",
        "id": "ADV-2010-3122",
        "trust": 1.1
      },
      {
        "db": "VUPEN",
        "id": "ADV-2011-0032",
        "trust": 1.1
      },
      {
        "db": "VUPEN",
        "id": "ADV-2010-3134",
        "trust": 1.1
      },
      {
        "db": "JVN",
        "id": "JVNVU91284469",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-002548",
        "trust": 0.8
      },
      {
        "db": "VULMON",
        "id": "CVE-2010-4180",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "116124",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "101256",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "106330",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "105638",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "97287",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "96498",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "106754",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#737740"
      },
      {
        "db": "VULMON",
        "id": "CVE-2010-4180"
      },
      {
        "db": "BID",
        "id": "45164"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-002548"
      },
      {
        "db": "PACKETSTORM",
        "id": "116124"
      },
      {
        "db": "PACKETSTORM",
        "id": "101256"
      },
      {
        "db": "PACKETSTORM",
        "id": "106330"
      },
      {
        "db": "PACKETSTORM",
        "id": "105638"
      },
      {
        "db": "PACKETSTORM",
        "id": "97287"
      },
      {
        "db": "PACKETSTORM",
        "id": "96498"
      },
      {
        "db": "PACKETSTORM",
        "id": "106754"
      },
      {
        "db": "NVD",
        "id": "CVE-2010-4180"
      }
    ]
  },
  "id": "VAR-201012-0193",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.41666666
  },
  "last_update_date": "2024-07-23T19:37:04.941000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "HT4723",
        "trust": 0.8,
        "url": "http://support.apple.com/kb/ht4723"
      },
      {
        "title": "openssl-0.9.8e-12.AXS3.7",
        "trust": 0.8,
        "url": "https://tsn.miraclelinux.com/tsn_local/index.php?m=errata\u0026a=detail\u0026eid=1324"
      },
      {
        "title": "HPSBUX02638",
        "trust": 0.8,
        "url": "http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?lang=en\u0026cc=us\u0026objectid=c02737002"
      },
      {
        "title": "2168",
        "trust": 0.8,
        "url": "http://www.miraclelinux.com/support/index.php?q=node/99\u0026errata_id=2168"
      },
      {
        "title": "20131",
        "trust": 0.8,
        "url": "http://cvs.openssl.org/chngview?cn=20131"
      },
      {
        "title": "secadv_20101202",
        "trust": 0.8,
        "url": "http://openssl.org/news/secadv_20101202.txt"
      },
      {
        "title": "RHSA-2010:0977",
        "trust": 0.8,
        "url": "https://rhn.redhat.com/errata/rhsa-2010-0977.html"
      },
      {
        "title": "RHSA-2010:0978",
        "trust": 0.8,
        "url": "https://rhn.redhat.com/errata/rhsa-2010-0978.html"
      },
      {
        "title": "RHSA-2010:0979",
        "trust": 0.8,
        "url": "https://rhn.redhat.com/errata/rhsa-2010-0979.html"
      },
      {
        "title": "SA53",
        "trust": 0.8,
        "url": "https://kb.bluecoat.com/index?page=content\u0026id=sa53"
      },
      {
        "title": "cve_2010_4180_affects_openssl",
        "trust": 0.8,
        "url": "http://blogs.oracle.com/sunsecurity/entry/cve_2010_4180_affects_openssl"
      },
      {
        "title": "Multiple OpenSSL vulnerabilities in Sun SPARC Enterprise M-series XCP Firmware",
        "trust": 0.8,
        "url": "https://blogs.oracle.com/sunsecurity/entry/multiple_openssl_vulnerabilities_in_sun"
      },
      {
        "title": "TLSA-2013-3",
        "trust": 0.8,
        "url": "http://www.turbolinux.co.jp/security/2013/tlsa-2013-3j.html"
      },
      {
        "title": "VMSA-2011-0013",
        "trust": 0.8,
        "url": "http://www.vmware.com/jp/support/support-resources/advisories/vmsa-2011-0013.html"
      },
      {
        "title": "Ubuntu Security Notice: openssl vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-1029-1"
      },
      {
        "title": "Debian Security Advisories: DSA-2141-1 openssl -- SSL/TLS insecure renegotiation protocol design flaw",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=1c00cc4c6dbe7bb057db61e10ff97d6d"
      },
      {
        "title": "Symantec Security Advisories: SA53 : OpenSSL Ciphersuite Downgrade Attack (CVE-2010-4180)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=symantec_security_advisories\u0026qid=92a9a237511ca120aa4255feb5bdf611"
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/hrbrmstr/internetdb "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/khulnasoft-labs/awesome-security "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2010-4180"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-002548"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-DesignError",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-002548"
      },
      {
        "db": "NVD",
        "id": "CVE-2010-4180"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.9,
        "url": "http://www.vupen.com/english/advisories/2010/3120"
      },
      {
        "trust": 1.9,
        "url": "http://secunia.com/advisories/42473"
      },
      {
        "trust": 1.9,
        "url": "http://osvdb.org/69565"
      },
      {
        "trust": 1.9,
        "url": "http://www.securitytracker.com/id?1024822"
      },
      {
        "trust": 1.9,
        "url": "http://www.securityfocus.com/bid/45164"
      },
      {
        "trust": 1.5,
        "url": "http://www.kb.cert.org/vuls/id/737740"
      },
      {
        "trust": 1.1,
        "url": "http://w3.efi.com/fiery"
      },
      {
        "trust": 1.1,
        "url": "http://cvs.openssl.org/chngview?cn=20131"
      },
      {
        "trust": 1.1,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=659462"
      },
      {
        "trust": 1.1,
        "url": "http://openssl.org/news/secadv_20101202.txt"
      },
      {
        "trust": 1.1,
        "url": "http://www.vupen.com/english/advisories/2010/3122"
      },
      {
        "trust": 1.1,
        "url": "http://ubuntu.com/usn/usn-1029-1"
      },
      {
        "trust": 1.1,
        "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2010\u0026m=slackware-security.668471"
      },
      {
        "trust": 1.1,
        "url": "http://www.vupen.com/english/advisories/2010/3134"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/42493"
      },
      {
        "trust": 1.1,
        "url": "http://www.mandriva.com/security/advisories?name=mdvsa-2010:248"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/42469"
      },
      {
        "trust": 1.1,
        "url": "http://www.vupen.com/english/advisories/2010/3188"
      },
      {
        "trust": 1.1,
        "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-december/052027.html"
      },
      {
        "trust": 1.1,
        "url": "http://www.redhat.com/support/errata/rhsa-2010-0979.html"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/42620"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/42571"
      },
      {
        "trust": 1.1,
        "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-december/052315.html"
      },
      {
        "trust": 1.1,
        "url": "http://www.debian.org/security/2011/dsa-2141"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/42811"
      },
      {
        "trust": 1.1,
        "url": "http://www.vupen.com/english/advisories/2011/0032"
      },
      {
        "trust": 1.1,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html"
      },
      {
        "trust": 1.1,
        "url": "http://www.redhat.com/support/errata/rhsa-2010-0977.html"
      },
      {
        "trust": 1.1,
        "url": "http://www.redhat.com/support/errata/rhsa-2010-0978.html"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/42877"
      },
      {
        "trust": 1.1,
        "url": "http://www.vupen.com/english/advisories/2011/0076"
      },
      {
        "trust": 1.1,
        "url": "http://www.vupen.com/english/advisories/2011/0268"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/43171"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/43172"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/43169"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/43173"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/43170"
      },
      {
        "trust": 1.1,
        "url": "https://kb.bluecoat.com/index?page=content\u0026id=sa53\u0026actp=list"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/44269"
      },
      {
        "trust": 1.1,
        "url": "http://support.apple.com/kb/ht4723"
      },
      {
        "trust": 1.1,
        "url": "http://lists.apple.com/archives/security-announce/2011//jun/msg00000.html"
      },
      {
        "trust": 1.1,
        "url": "http://www.redhat.com/support/errata/rhsa-2011-0896.html"
      },
      {
        "trust": 1.1,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html"
      },
      {
        "trust": 1.1,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=132077688910227\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/archive/1/522176"
      },
      {
        "trust": 1.1,
        "url": "http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c02794777"
      },
      {
        "trust": 1.1,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=129916880600544\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=130497251507577\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a18910"
      },
      {
        "trust": 0.9,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4180"
      },
      {
        "trust": 0.8,
        "url": "http://www.support.xerox.com/support/docucolor-242-252-260/downloads/enus.html?associatedproduct=fiery-exp260\u0026operatingsystem=win7x64"
      },
      {
        "trust": 0.8,
        "url": "https://www.openssl.org/news/vulnerabilities.html"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/cert/jvnvu976710"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/cert/jvnvu91284469/"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-4180"
      },
      {
        "trust": 0.6,
        "url": "http://support.avaya.com/css/p8/documents/100124969"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-4180"
      },
      {
        "trust": 0.3,
        "url": "https://lists.balabit.hu/pipermail/syslog-ng-announce/2011-february/000107.html"
      },
      {
        "trust": 0.3,
        "url": "https://lists.balabit.hu/pipermail/syslog-ng-announce/2011-february/000111.html"
      },
      {
        "trust": 0.3,
        "url": "https://lists.balabit.hu/pipermail/syslog-ng-announce/2011-february/000108.html"
      },
      {
        "trust": 0.3,
        "url": "http://blogs.sun.com/security/entry/cve_2010_4180_affects_openssl"
      },
      {
        "trust": 0.3,
        "url": "http://www.novell.com/support/viewcontent.do?externalid=3426981"
      },
      {
        "trust": 0.3,
        "url": "http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c03263573"
      },
      {
        "trust": 0.3,
        "url": "https://blogs.oracle.com/sunsecurity/entry/multiple_openssl_vulnerabilities_in_sun"
      },
      {
        "trust": 0.3,
        "url": "http://openssl.org/"
      },
      {
        "trust": 0.3,
        "url": "http://www.openssl.org/news/secadv_20101202.txt\\"
      },
      {
        "trust": 0.3,
        "url": "http://www.vmware.com/security/advisories/vmsa-2011-0013.html"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/516801"
      },
      {
        "trust": 0.3,
        "url": "http://support.avaya.com/css/p8/documents/100124972"
      },
      {
        "trust": 0.3,
        "url": "http://support.avaya.com/css/p8/documents/100131810"
      },
      {
        "trust": 0.3,
        "url": "https://kb.bluecoat.com/index?page=content\u0026id=sa53"
      },
      {
        "trust": 0.3,
        "url": "http://h20565.www2.hp.com/portal/site/hpsc/public/kb/docdisplay/?docid=emr_na-c03024266\u0026ac.admitted=1320706848406.876444892.492883150"
      },
      {
        "trust": 0.3,
        "url": "http://itrc.hp.com/service/cki/docdisplay.do?docid=emr_na-c02794777"
      },
      {
        "trust": 0.3,
        "url": "http://aix.software.ibm.com/aix/efixes/security/openssl_advisory2.asc"
      },
      {
        "trust": 0.3,
        "url": "https://downloads.avaya.com/css/p8/documents/100124969"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21625170"
      },
      {
        "trust": 0.3,
        "url": "http://www.vmware.com/security/advisories/vmsa-2012-0013.html"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-4252"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-0014"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2008-7270"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3555"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/1029-1/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-4410"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-1020"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-4109"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-4325"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-3209"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0830"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-4110"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-4128"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-3363"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2009-5029"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-1833"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-2496"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-4108"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-2761"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-3188"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-4577"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2009-5064"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-1089"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-2699"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-4609"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-3597"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-4132"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-4324"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-2484"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-4576"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3864"
      },
      {
        "trust": 0.1,
        "url": "http://www.itrc.hp.com/service/cki/secbullarchive.do"
      },
      {
        "trust": 0.1,
        "url": "http://h30046.www3.hp.com/driveralertprofile.php?regioncode=na\u0026langcode=useng\u0026jumpid=in_sc-gen__driveritrc\u0026topiccode=itrc"
      },
      {
        "trust": 0.1,
        "url": "http://h30046.www3.hp.com/subsignin.php"
      },
      {
        "trust": 0.1,
        "url": "http://h71000.www7.hp.com/openvms/products/ssl/ssl.html"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4473"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3556"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3563"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3560"
      },
      {
        "trust": 0.1,
        "url": "https://www.vmware.com/support/pubs/vs_pages/vsp_pubs_esxi41_i_vc41.html"
      },
      {
        "trust": 0.1,
        "url": "http://kb.vmware.com/kb/1055"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3571"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4472"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4474"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0862"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3554"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3562"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3170"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3562"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3567"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3556"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3550"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-1321"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3557"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3550"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3173"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3567"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4451"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3553"
      },
      {
        "trust": 0.1,
        "url": "http://www.vmware.com/support/policies/eos_vi.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3568"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2054"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3555"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3558"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3541"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4465"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3566"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0864"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4469"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3561"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3541"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3559"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3565"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0802"
      },
      {
        "trust": 0.1,
        "url": "http://www.vmware.com/support/policies/eos.html"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3574"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3559"
      },
      {
        "trust": 0.1,
        "url": "http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4466"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3554"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3563"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4452"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3569"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3573"
      },
      {
        "trust": 0.1,
        "url": "http://www.vmware.com/security/advisories"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3548"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4422"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3549"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3565"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3549"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3548"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3552"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0873"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4450"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3568"
      },
      {
        "trust": 0.1,
        "url": "http://www.vmware.com/support/policies/security_response.html"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4471"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1321"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3560"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3572"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4463"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3553"
      },
      {
        "trust": 0.1,
        "url": "http://gpgtools.org"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0815"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4447"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3566"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4476"
      },
      {
        "trust": 0.1,
        "url": "http://enigmail.mozdev.org/"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4467"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0865"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0867"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3558"
      },
      {
        "trust": 0.1,
        "url": "http://downloads.vmware.com/support/pubs/vs_pages/vsp_pubs_esx41_vc41.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3570"
      },
      {
        "trust": 0.1,
        "url": "http://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_vsphere/4_1"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0871"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3552"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4448"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-7270"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3570"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0002"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4475"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4454"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4470"
      },
      {
        "trust": 0.1,
        "url": "http://lists.grok.org.uk/full-disclosure-charter.html"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4462"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3173"
      },
      {
        "trust": 0.1,
        "url": "https://www.vmware.com/support/pubs/vum_pubs.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3561"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3170"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-2054"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3569"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0814"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4468"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3551"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3551"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-3557"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-0742"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-4355"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-4180"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-3207"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-3864"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-2939"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-1633"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-3210"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-0740"
      },
      {
        "trust": 0.1,
        "url": "http://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "http://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2009-3245"
      },
      {
        "trust": 0.1,
        "url": "http://security.gentoo.org/glsa/glsa-201110-01.xml"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-3245"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-0433"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-0014"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2009-4355"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-4252"
      },
      {
        "trust": 0.1,
        "url": "http://www.debian.org/security/faq"
      },
      {
        "trust": 0.1,
        "url": "http://www.debian.org/security/"
      },
      {
        "trust": 0.1,
        "url": "http://www.openssl.org/news/secadv_20101202.txt"
      },
      {
        "trust": 0.1,
        "url": "http://seb.dbzteam.org/crypto/jpake-session-key-retrieval.pdf"
      },
      {
        "trust": 0.1,
        "url": "http://www.openssl.org/news/secadv_20101116-2.txt"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2009-3555"
      },
      {
        "trust": 0.1,
        "url": "http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/"
      },
      {
        "trust": 0.1,
        "url": "http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins"
      },
      {
        "trust": 0.1,
        "url": "https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docdisplay/?docid=emr_na-c02964430"
      },
      {
        "trust": 0.1,
        "url": "http://www.hp.com/go/bizsupport"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#737740"
      },
      {
        "db": "VULMON",
        "id": "CVE-2010-4180"
      },
      {
        "db": "BID",
        "id": "45164"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-002548"
      },
      {
        "db": "PACKETSTORM",
        "id": "116124"
      },
      {
        "db": "PACKETSTORM",
        "id": "101256"
      },
      {
        "db": "PACKETSTORM",
        "id": "106330"
      },
      {
        "db": "PACKETSTORM",
        "id": "105638"
      },
      {
        "db": "PACKETSTORM",
        "id": "97287"
      },
      {
        "db": "PACKETSTORM",
        "id": "96498"
      },
      {
        "db": "PACKETSTORM",
        "id": "106754"
      },
      {
        "db": "NVD",
        "id": "CVE-2010-4180"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#737740"
      },
      {
        "db": "VULMON",
        "id": "CVE-2010-4180"
      },
      {
        "db": "BID",
        "id": "45164"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-002548"
      },
      {
        "db": "PACKETSTORM",
        "id": "116124"
      },
      {
        "db": "PACKETSTORM",
        "id": "101256"
      },
      {
        "db": "PACKETSTORM",
        "id": "106330"
      },
      {
        "db": "PACKETSTORM",
        "id": "105638"
      },
      {
        "db": "PACKETSTORM",
        "id": "97287"
      },
      {
        "db": "PACKETSTORM",
        "id": "96498"
      },
      {
        "db": "PACKETSTORM",
        "id": "106754"
      },
      {
        "db": "NVD",
        "id": "CVE-2010-4180"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2013-03-18T00:00:00",
        "db": "CERT/CC",
        "id": "VU#737740"
      },
      {
        "date": "2010-12-06T00:00:00",
        "db": "VULMON",
        "id": "CVE-2010-4180"
      },
      {
        "date": "2010-12-02T00:00:00",
        "db": "BID",
        "id": "45164"
      },
      {
        "date": "2010-12-24T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2010-002548"
      },
      {
        "date": "2012-09-01T00:00:25",
        "db": "PACKETSTORM",
        "id": "116124"
      },
      {
        "date": "2011-05-10T00:44:30",
        "db": "PACKETSTORM",
        "id": "101256"
      },
      {
        "date": "2011-10-28T14:46:28",
        "db": "PACKETSTORM",
        "id": "106330"
      },
      {
        "date": "2011-10-09T16:42:00",
        "db": "PACKETSTORM",
        "id": "105638"
      },
      {
        "date": "2011-01-06T16:22:22",
        "db": "PACKETSTORM",
        "id": "97287"
      },
      {
        "date": "2010-12-03T12:12:12",
        "db": "PACKETSTORM",
        "id": "96498"
      },
      {
        "date": "2011-11-09T00:58:11",
        "db": "PACKETSTORM",
        "id": "106754"
      },
      {
        "date": "2010-12-06T21:05:48.687000",
        "db": "NVD",
        "id": "CVE-2010-4180"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2013-05-02T00:00:00",
        "db": "CERT/CC",
        "id": "VU#737740"
      },
      {
        "date": "2022-08-04T00:00:00",
        "db": "VULMON",
        "id": "CVE-2010-4180"
      },
      {
        "date": "2015-04-13T21:15:00",
        "db": "BID",
        "id": "45164"
      },
      {
        "date": "2012-12-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2010-002548"
      },
      {
        "date": "2022-08-04T19:59:42.243000",
        "db": "NVD",
        "id": "CVE-2010-4180"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "network",
    "sources": [
      {
        "db": "BID",
        "id": "45164"
      }
    ],
    "trust": 0.3
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Fiery Network Controllers for Xerox DocuColor 242/252/260 Printer/Copier use a vulnerable version of OpenSSL",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#737740"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Design Error",
    "sources": [
      {
        "db": "BID",
        "id": "45164"
      }
    ],
    "trust": 0.3
  }
}

var-201811-0988

Vulnerability from variot

nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file. nginx Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. nginx is prone to multiple denial-of-service vulnerabilities. Attackers can exploit these issues to cause denial-of-service conditions. Versions prior to nginx 1.15.6 and 1.14.1 are vulnerable. nginx is a lightweight web server/reverse proxy server and email (IMAP/POP3) proxy server developed by Russian programmer Igor Sysoev. An attacker can exploit this vulnerability to consume a large amount of memory space.

For the stable distribution (stretch), these problems have been fixed in version 1.10.3-1+deb9u2.

We recommend that you upgrade your nginx packages. ========================================================================== Ubuntu Security Notice USN-3812-1 November 07, 2018

nginx vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 18.10
Ubuntu 18.04 LTS
Ubuntu 16.04 LTS
Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in nginx.

Software Description: - nginx: small, powerful, scalable web/proxy server

Details:

It was discovered that nginx incorrectly handled the HTTP/2 implementation. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-16843)

Gal Goldshtein discovered that nginx incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to cause excessive CPU usage, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-16844)

It was discovered that nginx incorrectly handled the ngx_http_mp4_module module. A remote attacker could possibly use this issue with a specially crafted mp4 file to cause nginx to crash, stop responding, or access arbitrary memory. (CVE-2018-16845)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.10: nginx-common 1.15.5-0ubuntu2.1 nginx-core 1.15.5-0ubuntu2.1 nginx-extras 1.15.5-0ubuntu2.1 nginx-full 1.15.5-0ubuntu2.1 nginx-light 1.15.5-0ubuntu2.1

Ubuntu 18.04 LTS: nginx-common 1.14.0-0ubuntu1.2 nginx-core 1.14.0-0ubuntu1.2 nginx-extras 1.14.0-0ubuntu1.2 nginx-full 1.14.0-0ubuntu1.2 nginx-light 1.14.0-0ubuntu1.2

Ubuntu 16.04 LTS: nginx-common 1.10.3-0ubuntu0.16.04.3 nginx-core 1.10.3-0ubuntu0.16.04.3 nginx-extras 1.10.3-0ubuntu0.16.04.3 nginx-full 1.10.3-0ubuntu0.16.04.3 nginx-light 1.10.3-0ubuntu0.16.04.3

Ubuntu 14.04 LTS: nginx-common 1.4.6-1ubuntu3.9 nginx-core 1.4.6-1ubuntu3.9 nginx-extras 1.4.6-1ubuntu3.9 nginx-full 1.4.6-1ubuntu3.9 nginx-light 1.4.6-1ubuntu3.9

In general, a standard system update will make all the necessary changes.

The following packages have been upgraded to a later upstream version: rh-nginx114-nginx (1.14.1). -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

===================================================================== Red Hat Security Advisory

Synopsis: Important: rh-nginx110-nginx security update Advisory ID: RHSA-2018:3653-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2018:3653 Issue date: 2018-11-26 CVE Names: CVE-2018-16843 CVE-2018-16845 =====================================================================

Summary:

An update for rh-nginx110-nginx is now available for Red Hat Software Collections.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Relevant releases/architectures:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64

Description:

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Red Hat would like to thank the Nginx project for reporting these issues.

Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The rh-nginx110-nginx service must be restarted for this update to take effect.

Package List:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):

Source: rh-nginx110-nginx-1.10.2-8.el6.1.src.rpm

x86_64: rh-nginx110-nginx-1.10.2-8.el6.1.x86_64.rpm rh-nginx110-nginx-debuginfo-1.10.2-8.el6.1.x86_64.rpm rh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el6.1.x86_64.rpm rh-nginx110-nginx-mod-http-perl-1.10.2-8.el6.1.x86_64.rpm rh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el6.1.x86_64.rpm rh-nginx110-nginx-mod-mail-1.10.2-8.el6.1.x86_64.rpm rh-nginx110-nginx-mod-stream-1.10.2-8.el6.1.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):

Source: rh-nginx110-nginx-1.10.2-8.el6.1.src.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):

Source: rh-nginx110-nginx-1.10.2-8.el7.1.src.rpm

x86_64: rh-nginx110-nginx-1.10.2-8.el7.1.x86_64.rpm rh-nginx110-nginx-debuginfo-1.10.2-8.el7.1.x86_64.rpm rh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el7.1.x86_64.rpm rh-nginx110-nginx-mod-http-perl-1.10.2-8.el7.1.x86_64.rpm rh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el7.1.x86_64.rpm rh-nginx110-nginx-mod-mail-1.10.2-8.el7.1.x86_64.rpm rh-nginx110-nginx-mod-stream-1.10.2-8.el7.1.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4):

Source: rh-nginx110-nginx-1.10.2-8.el7.1.src.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5):

Source: rh-nginx110-nginx-1.10.2-8.el7.1.src.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6):

Source: rh-nginx110-nginx-1.10.2-8.el7.1.src.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):

Source: rh-nginx110-nginx-1.10.2-8.el7.1.src.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2018-16843 https://access.redhat.com/security/cve/CVE-2018-16845 https://access.redhat.com/security/updates/classification/#important

Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

iQIVAwUBW/vmotzjgjWX9erEAQgLFQ//c0AzsoAslgezACNt/7IQuf7IJy0o3ZJS RivGOSPey3gjDQDioSB5LYv5W89fmX5lQ8NsSmx/K+soAPpsz2OmwkFrJ3Mu9D/U DvE5WxP0TQcJOizA9k6huKhwtLYLmkMrnRmZUIJ/E6BiLVZbAP8/1CnoryK+JBum Ml1oFeOZUgwz2x0pvBPVPqGsRBFK3cE1SRxnSHgvwchMxYKSTwrHMARYFUavOrmZ VVRbL8xIiCPCEl7/OPKO3QD4M2vXhMHRwaquZJS/A6+Vls53qGAjJ9q3iLE+sEl5 Lb3B3AkbOtURmmoKOb8wdWlo9YRHckG+4mLXonNCIUteSZDWukns8gKti+AcSyOs gZ4e+IXDahfnP1+Lg9StFthKexpGGwp/ASBi0OZ8ZmyA6IVQzGyXW7nADlrdolKj 9q2zXQMPVFEtYu7tvDb/eJZq+ch/fkjIywps6+lQKRTkRSkT7SzUuopRj4z0eWt7 hy7/WXdf9+55sR6VM2XTQi5Oj4xjJkzmrFuYc2tG9oLSc2M+11ouuY/DgaMGnilE HVFQ5L9OjV7fV3yPbxFIA2avu4BuCR2xwggQ0fNihAtcqmCiYSESfIsCvHcM+V4P AQIcEgyuW0KOPH7ygRcBFbniri+sYRAk96jRpZtccmCjw45DUZcFdeHWJheWcZNc chCvd465nBo= =EyM5 -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

APPLE-SA-2021-09-20-4 Xcode 13

Xcode 13 addresses the following issues.

Installation note:

Xcode 13 may be obtained from:

https://developer.apple.com/xcode/downloads/

To check that the Xcode has been updated:

Select Xcode in the menu bar
Select About Xcode
The version after applying this update will be "Xcode 13"

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201811-0988",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "canonical",
        "version": "18.04"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "canonical",
        "version": "14.04"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "canonical",
        "version": "16.04"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "canonical",
        "version": "18.10"
      },
      {
        "model": "nginx",
        "scope": "gt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.15.0"
      },
      {
        "model": "xcode",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "13.0"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.15.6"
      },
      {
        "model": "leap",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "opensuse",
        "version": "15.1"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.14.1"
      },
      {
        "model": "nginx",
        "scope": "gt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "1.9.5"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "9.0"
      },
      {
        "model": "ubuntu",
        "scope": null,
        "trust": 0.8,
        "vendor": "canonical",
        "version": null
      },
      {
        "model": "gnu/linux",
        "scope": null,
        "trust": 0.8,
        "vendor": "debian",
        "version": null
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "1.14.1"
      },
      {
        "model": "nginx",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "igor sysoev",
        "version": "1.15.6"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "18.10"
      },
      {
        "model": "linux lts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "18.04"
      },
      {
        "model": "linux lts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "16.04"
      },
      {
        "model": "linux lts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "14.04"
      },
      {
        "model": "software collections for rhel",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.15.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.13.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.12.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.11.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.11.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.10.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.10.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.9.15"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.9.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.9.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.9.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.8.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.7.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.6.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.4.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.16"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.15"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.2.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.18"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.17"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.6.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.6.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.5.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.4.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.4.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.4.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.4.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.3.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.2.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.6"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.5"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.4"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.3"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.2"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.19"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.16"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.15"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.11"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.10"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.1"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.1.0"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.9"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.8"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.7"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.15"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.14"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.13"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.12"
      },
      {
        "model": "nginx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.0.10"
      },
      {
        "model": "nginx",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.15.6"
      },
      {
        "model": "nginx",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "nginx",
        "version": "1.14.1"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "105868"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011775"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-16843"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201811-131"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.14.1",
                "versionStartExcluding": "1.9.5",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.15.6",
                "versionStartExcluding": "1.15.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "13.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-16843"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Gal Goldshtein from F5 Networks, and Maxim Konovalov (Nginx)",
    "sources": [
      {
        "db": "BID",
        "id": "105868"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2018-16843",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 7.8,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2018-16843",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "VHN-127243",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "secalert@redhat.com",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "impactScore": 1.4,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2018-16843",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2018-16843",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "secalert@redhat.com",
            "id": "CVE-2018-16843",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201811-131",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-127243",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2018-16843",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-127243"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-16843"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011775"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-16843"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-16843"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201811-131"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the \u0027http2\u0027 option of the \u0027listen\u0027 directive is used in a configuration file. nginx Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. nginx is prone to multiple denial-of-service vulnerabilities. \nAttackers can exploit these issues to cause denial-of-service conditions. \nVersions prior to nginx 1.15.6 and 1.14.1 are vulnerable. nginx is a lightweight web server/reverse proxy server and email (IMAP/POP3) proxy server developed by Russian programmer Igor Sysoev. An attacker can exploit this vulnerability to consume a large amount of memory space. \n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 1.10.3-1+deb9u2. \n\nWe recommend that you upgrade your nginx packages. ==========================================================================\nUbuntu Security Notice USN-3812-1\nNovember 07, 2018\n\nnginx vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 18.10\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS\n- Ubuntu 14.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in nginx. \n\nSoftware Description:\n- nginx: small, powerful, scalable web/proxy server\n\nDetails:\n\nIt was discovered that nginx incorrectly handled the HTTP/2 implementation. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-16843)\n\nGal Goldshtein discovered that nginx incorrectly handled the HTTP/2\nimplementation. A remote attacker could possibly use this issue to cause\nexcessive CPU usage, leading to a denial of service. This issue only\naffected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. \n(CVE-2018-16844)\n\nIt was discovered that nginx incorrectly handled the ngx_http_mp4_module\nmodule. A remote attacker could possibly use this issue with a specially\ncrafted mp4 file to cause nginx to crash, stop responding, or access\narbitrary memory. (CVE-2018-16845)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 18.10:\n  nginx-common                    1.15.5-0ubuntu2.1\n  nginx-core                      1.15.5-0ubuntu2.1\n  nginx-extras                    1.15.5-0ubuntu2.1\n  nginx-full                      1.15.5-0ubuntu2.1\n  nginx-light                     1.15.5-0ubuntu2.1\n\nUbuntu 18.04 LTS:\n  nginx-common                    1.14.0-0ubuntu1.2\n  nginx-core                      1.14.0-0ubuntu1.2\n  nginx-extras                    1.14.0-0ubuntu1.2\n  nginx-full                      1.14.0-0ubuntu1.2\n  nginx-light                     1.14.0-0ubuntu1.2\n\nUbuntu 16.04 LTS:\n  nginx-common                    1.10.3-0ubuntu0.16.04.3\n  nginx-core                      1.10.3-0ubuntu0.16.04.3\n  nginx-extras                    1.10.3-0ubuntu0.16.04.3\n  nginx-full                      1.10.3-0ubuntu0.16.04.3\n  nginx-light                     1.10.3-0ubuntu0.16.04.3\n\nUbuntu 14.04 LTS:\n  nginx-common                    1.4.6-1ubuntu3.9\n  nginx-core                      1.4.6-1ubuntu3.9\n  nginx-extras                    1.4.6-1ubuntu3.9\n  nginx-full                      1.4.6-1ubuntu3.9\n  nginx-light                     1.4.6-1ubuntu3.9\n\nIn general, a standard system update will make all the necessary changes. \n\nThe following packages have been upgraded to a later upstream version:\nrh-nginx114-nginx (1.14.1). -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Important: rh-nginx110-nginx security update\nAdvisory ID:       RHSA-2018:3653-01\nProduct:           Red Hat Software Collections\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2018:3653\nIssue date:        2018-11-26\nCVE Names:         CVE-2018-16843 CVE-2018-16845 \n=====================================================================\n\n1. Summary:\n\nAn update for rh-nginx110-nginx is now available for Red Hat Software\nCollections. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64\n\n3. Description:\n\nnginx is a web and proxy server supporting HTTP and other protocols, with a\nfocus on high concurrency, performance, and low memory usage. \n\nRed Hat would like to thank the Nginx project for reporting these issues. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe rh-nginx110-nginx service must be restarted for this update to take\neffect. \n\n5. Package List:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):\n\nSource:\nrh-nginx110-nginx-1.10.2-8.el6.1.src.rpm\n\nx86_64:\nrh-nginx110-nginx-1.10.2-8.el6.1.x86_64.rpm\nrh-nginx110-nginx-debuginfo-1.10.2-8.el6.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el6.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-perl-1.10.2-8.el6.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el6.1.x86_64.rpm\nrh-nginx110-nginx-mod-mail-1.10.2-8.el6.1.x86_64.rpm\nrh-nginx110-nginx-mod-stream-1.10.2-8.el6.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nrh-nginx110-nginx-1.10.2-8.el6.1.src.rpm\n\nx86_64:\nrh-nginx110-nginx-1.10.2-8.el6.1.x86_64.rpm\nrh-nginx110-nginx-debuginfo-1.10.2-8.el6.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el6.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-perl-1.10.2-8.el6.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el6.1.x86_64.rpm\nrh-nginx110-nginx-mod-mail-1.10.2-8.el6.1.x86_64.rpm\nrh-nginx110-nginx-mod-stream-1.10.2-8.el6.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):\n\nSource:\nrh-nginx110-nginx-1.10.2-8.el7.1.src.rpm\n\nx86_64:\nrh-nginx110-nginx-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-debuginfo-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-perl-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-mail-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-stream-1.10.2-8.el7.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4):\n\nSource:\nrh-nginx110-nginx-1.10.2-8.el7.1.src.rpm\n\nx86_64:\nrh-nginx110-nginx-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-debuginfo-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-perl-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-mail-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-stream-1.10.2-8.el7.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5):\n\nSource:\nrh-nginx110-nginx-1.10.2-8.el7.1.src.rpm\n\nx86_64:\nrh-nginx110-nginx-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-debuginfo-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-perl-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-mail-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-stream-1.10.2-8.el7.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6):\n\nSource:\nrh-nginx110-nginx-1.10.2-8.el7.1.src.rpm\n\nx86_64:\nrh-nginx110-nginx-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-debuginfo-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-perl-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-mail-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-stream-1.10.2-8.el7.1.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nrh-nginx110-nginx-1.10.2-8.el7.1.src.rpm\n\nx86_64:\nrh-nginx110-nginx-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-debuginfo-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-image-filter-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-perl-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-http-xslt-filter-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-mail-1.10.2-8.el7.1.x86_64.rpm\nrh-nginx110-nginx-mod-stream-1.10.2-8.el7.1.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2018-16843\nhttps://access.redhat.com/security/cve/CVE-2018-16845\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2018 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBW/vmotzjgjWX9erEAQgLFQ//c0AzsoAslgezACNt/7IQuf7IJy0o3ZJS\nRivGOSPey3gjDQDioSB5LYv5W89fmX5lQ8NsSmx/K+soAPpsz2OmwkFrJ3Mu9D/U\nDvE5WxP0TQcJOizA9k6huKhwtLYLmkMrnRmZUIJ/E6BiLVZbAP8/1CnoryK+JBum\nMl1oFeOZUgwz2x0pvBPVPqGsRBFK3cE1SRxnSHgvwchMxYKSTwrHMARYFUavOrmZ\nVVRbL8xIiCPCEl7/OPKO3QD4M2vXhMHRwaquZJS/A6+Vls53qGAjJ9q3iLE+sEl5\nLb3B3AkbOtURmmoKOb8wdWlo9YRHckG+4mLXonNCIUteSZDWukns8gKti+AcSyOs\ngZ4e+IXDahfnP1+Lg9StFthKexpGGwp/ASBi0OZ8ZmyA6IVQzGyXW7nADlrdolKj\n9q2zXQMPVFEtYu7tvDb/eJZq+ch/fkjIywps6+lQKRTkRSkT7SzUuopRj4z0eWt7\nhy7/WXdf9+55sR6VM2XTQi5Oj4xjJkzmrFuYc2tG9oLSc2M+11ouuY/DgaMGnilE\nHVFQ5L9OjV7fV3yPbxFIA2avu4BuCR2xwggQ0fNihAtcqmCiYSESfIsCvHcM+V4P\nAQIcEgyuW0KOPH7ygRcBFbniri+sYRAk96jRpZtccmCjw45DUZcFdeHWJheWcZNc\nchCvd465nBo=\n=EyM5\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2021-09-20-4 Xcode 13\n\nXcode 13 addresses the following issues. \n\nIDE Xcode Server\nAvailable for: macOS Big Sur 11.3 and later\nImpact: Multiple issues in nginx\nDescription: Multiple issues were addressed by updating nginx to\nversion 1.21.0. \nCVE-2016-0742\nCVE-2016-0746\nCVE-2016-0747\nCVE-2017-7529\nCVE-2018-16843\nCVE-2018-16844\nCVE-2018-16845\nCVE-2019-20372\n\nInstallation note:\n\nXcode 13 may be obtained from:\n\nhttps://developer.apple.com/xcode/downloads/\n\nTo check that the Xcode has been updated:\n\n* Select Xcode in the menu bar\n* Select About Xcode\n* The version after applying this update will be \"Xcode 13\"",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-16843"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011775"
      },
      {
        "db": "BID",
        "id": "105868"
      },
      {
        "db": "VULHUB",
        "id": "VHN-127243"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-16843"
      },
      {
        "db": "PACKETSTORM",
        "id": "150253"
      },
      {
        "db": "PACKETSTORM",
        "id": "150214"
      },
      {
        "db": "PACKETSTORM",
        "id": "150480"
      },
      {
        "db": "PACKETSTORM",
        "id": "150481"
      },
      {
        "db": "PACKETSTORM",
        "id": "150458"
      },
      {
        "db": "PACKETSTORM",
        "id": "164240"
      }
    ],
    "trust": 2.61
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-16843",
        "trust": 3.5
      },
      {
        "db": "BID",
        "id": "105868",
        "trust": 2.0
      },
      {
        "db": "SECTRACK",
        "id": "1042038",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011775",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201811-131",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "164240",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.3384",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.3157",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.0464",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.0451",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022042571",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "150214",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "150458",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "150480",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "150481",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "150253",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-127243",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-16843",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-127243"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-16843"
      },
      {
        "db": "BID",
        "id": "105868"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011775"
      },
      {
        "db": "PACKETSTORM",
        "id": "150253"
      },
      {
        "db": "PACKETSTORM",
        "id": "150214"
      },
      {
        "db": "PACKETSTORM",
        "id": "150480"
      },
      {
        "db": "PACKETSTORM",
        "id": "150481"
      },
      {
        "db": "PACKETSTORM",
        "id": "150458"
      },
      {
        "db": "PACKETSTORM",
        "id": "164240"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-16843"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201811-131"
      }
    ]
  },
  "id": "VAR-201811-0988",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-127243"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T11:40:26.729000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "DSA-4335",
        "trust": 0.8,
        "url": "https://www.debian.org/security/2018/dsa-4335"
      },
      {
        "title": "USN-3812-1",
        "trust": 0.8,
        "url": "https://usn.ubuntu.com/3812-1/"
      },
      {
        "title": "CVE-2018-16843, CVE-2018-16844",
        "trust": 0.8,
        "url": "http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html"
      },
      {
        "title": "nginx Security vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=86634"
      },
      {
        "title": "Red Hat: Important: rh-nginx110-nginx security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20183653 - security advisory"
      },
      {
        "title": "Red Hat: Important: rh-nginx114-nginx security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20183681 - security advisory"
      },
      {
        "title": "Red Hat: Important: rh-nginx112-nginx security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20183680 - security advisory"
      },
      {
        "title": "Ubuntu Security Notice: nginx vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-3812-1"
      },
      {
        "title": "Debian CVElist Bug Report Logs: nginx: CVE-2018-16843 CVE-2018-16844 CVE-2018-16845",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=f21dcb5d073b4fb671c738fa256c2347"
      },
      {
        "title": "Red Hat: CVE-2018-16843",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=cve-2018-16843"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2018-1125",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=alas-2018-1125"
      },
      {
        "title": "anitazhaochen.github.io",
        "trust": 0.1,
        "url": "https://github.com/anitazhaochen/anitazhaochen.github.io "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2018-16843"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011775"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201811-131"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-400",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-127243"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011775"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-16843"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.0,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=cve-2018-16843"
      },
      {
        "trust": 2.0,
        "url": "http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html"
      },
      {
        "trust": 2.0,
        "url": "https://usn.ubuntu.com/3812-1/"
      },
      {
        "trust": 1.8,
        "url": "https://access.redhat.com/errata/rhsa-2018:3653"
      },
      {
        "trust": 1.8,
        "url": "https://access.redhat.com/errata/rhsa-2018:3680"
      },
      {
        "trust": 1.8,
        "url": "https://access.redhat.com/errata/rhsa-2018:3681"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/105868"
      },
      {
        "trust": 1.7,
        "url": "https://support.apple.com/kb/ht212818"
      },
      {
        "trust": 1.7,
        "url": "https://www.debian.org/security/2018/dsa-4335"
      },
      {
        "trust": 1.7,
        "url": "http://seclists.org/fulldisclosure/2021/sep/36"
      },
      {
        "trust": 1.7,
        "url": "http://www.securitytracker.com/id/1042038"
      },
      {
        "trust": 1.7,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16843"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-16843"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/cve/cve-2018-16843"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/cve/cve-2018-16845"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16845"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/support/pages/node/1489143"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20192309-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.0464/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.3384/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/75522"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/support/docview.wss?uid=ibm10960610"
      },
      {
        "trust": 0.6,
        "url": "https://support.apple.com/en-us/ht212818"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.3157"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022042571"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-aspera-web-shares-application-is-affected-by-nginx-vulnerabilities-cve-2018-16845-cve-2018-16843-cve-2019-7401/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/164240/apple-security-advisory-2021-09-20-4.html"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2018-16844"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16844"
      },
      {
        "trust": 0.3,
        "url": "http://nginx.org/"
      },
      {
        "trust": 0.3,
        "url": "http://mailman.nginx.org/pipermail/nginx-announce/2018/000221.html"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=cve-2018-16845"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=cve-2018-16844"
      },
      {
        "trust": 0.3,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.1,
        "url": "https://security-tracker.debian.org/tracker/nginx"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/faq"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.14.0-0ubuntu1.2"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/usn/usn-3812-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.4.6-1ubuntu3.9"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.15.5-0ubuntu2.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nginx/1.10.3-0ubuntu0.16.04.3"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20372"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/kb/ht201222"
      },
      {
        "trust": 0.1,
        "url": "https://www.apple.com/support/security/pgp/"
      },
      {
        "trust": 0.1,
        "url": "https://developer.apple.com/xcode/downloads/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0746"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0747"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/ht212818."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0742"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-7529"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-127243"
      },
      {
        "db": "BID",
        "id": "105868"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011775"
      },
      {
        "db": "PACKETSTORM",
        "id": "150253"
      },
      {
        "db": "PACKETSTORM",
        "id": "150214"
      },
      {
        "db": "PACKETSTORM",
        "id": "150480"
      },
      {
        "db": "PACKETSTORM",
        "id": "150481"
      },
      {
        "db": "PACKETSTORM",
        "id": "150458"
      },
      {
        "db": "PACKETSTORM",
        "id": "164240"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-16843"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201811-131"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-127243"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-16843"
      },
      {
        "db": "BID",
        "id": "105868"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011775"
      },
      {
        "db": "PACKETSTORM",
        "id": "150253"
      },
      {
        "db": "PACKETSTORM",
        "id": "150214"
      },
      {
        "db": "PACKETSTORM",
        "id": "150480"
      },
      {
        "db": "PACKETSTORM",
        "id": "150481"
      },
      {
        "db": "PACKETSTORM",
        "id": "150458"
      },
      {
        "db": "PACKETSTORM",
        "id": "164240"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-16843"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201811-131"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-11-07T00:00:00",
        "db": "VULHUB",
        "id": "VHN-127243"
      },
      {
        "date": "2018-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-16843"
      },
      {
        "date": "2018-11-06T00:00:00",
        "db": "BID",
        "id": "105868"
      },
      {
        "date": "2019-01-23T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-011775"
      },
      {
        "date": "2018-11-12T16:57:53",
        "db": "PACKETSTORM",
        "id": "150253"
      },
      {
        "date": "2018-11-07T17:35:27",
        "db": "PACKETSTORM",
        "id": "150214"
      },
      {
        "date": "2018-11-27T17:24:35",
        "db": "PACKETSTORM",
        "id": "150480"
      },
      {
        "date": "2018-11-27T17:24:48",
        "db": "PACKETSTORM",
        "id": "150481"
      },
      {
        "date": "2018-11-26T10:02:22",
        "db": "PACKETSTORM",
        "id": "150458"
      },
      {
        "date": "2021-09-22T16:28:58",
        "db": "PACKETSTORM",
        "id": "164240"
      },
      {
        "date": "2018-11-07T14:29:00.777000",
        "db": "NVD",
        "id": "CVE-2018-16843"
      },
      {
        "date": "2018-11-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201811-131"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-11-10T00:00:00",
        "db": "VULHUB",
        "id": "VHN-127243"
      },
      {
        "date": "2022-02-22T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-16843"
      },
      {
        "date": "2018-11-06T00:00:00",
        "db": "BID",
        "id": "105868"
      },
      {
        "date": "2019-01-23T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-011775"
      },
      {
        "date": "2022-02-22T19:27:12.350000",
        "db": "NVD",
        "id": "CVE-2018-16843"
      },
      {
        "date": "2023-05-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201811-131"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "150214"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201811-131"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "nginx Vulnerable to resource exhaustion",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-011775"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201811-131"
      }
    ],
    "trust": 0.6
  }
}

var-201204-0228

Vulnerability from variot

Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request. nginx is prone to an information-disclosure vulnerability. Attackers can exploit this issue to harvest sensitive information that may lead to further attacks. BUGTRAQ ID: 52578 CVE ID: CVE-2012-1180 nginx is a widely used high-performance web server. There is an information disclosure vulnerability in nginx's implementation of processing malformed HTTP responses from upstream servers. 0 nginx 1.0.9 nginx 1.0.8 nginx 1.0.10 Vendor patch: Igor Sysoev ----------- At present, the vendor has released an upgrade patch to fix this security problem, please go to the vendor's homepage to download: http ://nginx.net/. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201203-22

                                        http://security.gentoo.org/

Severity: High Title: nginx: Multiple vulnerabilities Date: March 28, 2012 Bugs: #293785, #293786, #293788, #389319, #408367 ID: 201203-22

Synopsis

Multiple vulnerabilities have been found in nginx, the worst of which may allow execution of arbitrary code.

Background

nginx is a robust, small, and high performance HTTP and reverse proxy server.

Affected packages

-------------------------------------------------------------------
 Package              /     Vulnerable     /            Unaffected
-------------------------------------------------------------------

1 www-servers/nginx < 1.0.14 >= 1.0.14

Description

Multiple vulnerabilities have been found in nginx:

The TLS protocol does not properly handle session renegotiation requests (CVE-2009-3555).
The "ngx_http_process_request_headers()" function in ngx_http_parse.c could cause a NULL pointer dereference (CVE-2009-3896).
nginx does not properly sanitize user input for the the WebDAV COPY or MOVE methods (CVE-2009-3898).
The "ngx_resolver_copy()" function in ngx_resolver.c contains a boundary error which could cause a heap-based buffer overflow (CVE-2011-4315).
nginx does not properly parse HTTP header responses which could expose sensitive information (CVE-2012-1180).

Impact

Workaround

There is no known workaround at this time.

Resolution

All nginx users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.0.14"

References

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201203-22.xml

Concerns?

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Mandriva Linux Security Advisory MDVSA-2012:043 http://www.mandriva.com/security/

Package : nginx Date : March 29, 2012 Affected: 2010.1, 2011.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1180

Updated Packages:

Mandriva Linux 2010.1: 44b081cef04380c1b45336962f9e9c4a 2010.1/i586/nginx-0.8.41-1.1mdv2010.2.i586.rpm ba57a417d0064fb122694b5dacedb1dd 2010.1/SRPMS/nginx-0.8.41-1.1mdv2010.2.src.rpm

Mandriva Linux 2010.1/X86_64: 0008b13952f6f57c14efabeba5fbc717 2010.1/x86_64/nginx-0.8.41-1.1mdv2010.2.x86_64.rpm ba57a417d0064fb122694b5dacedb1dd 2010.1/SRPMS/nginx-0.8.41-1.1mdv2010.2.src.rpm

Mandriva Linux 2011: dd738ba12a2127a78731eabb19129045 2011/i586/nginx-1.0.5-1.1-mdv2011.0.i586.rpm 5ee13d12672c9cd141449bd0dc024479 2011/SRPMS/nginx-1.0.5-1.1.src.rpm

Mandriva Linux 2011/X86_64: d4af6f92f3508722e79dad2a5d12f269 2011/x86_64/nginx-1.0.5-1.1-mdv2011.0.x86_64.rpm 5ee13d12672c9cd141449bd0dc024479 2011/SRPMS/nginx-1.0.5-1.1.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFPc/zbmqjQ0CJFipgRAsXqAKCDpT1SDD6heEKkG4xtUvKB19ofhgCgihpF qZLFGHfgElxAFfkUZ3nIlDw= =VETw -----END PGP SIGNATURE----- .

For the stable distribution (squeeze), this problem has been fixed in version 0.7.67-3+squeeze2.

For the unstable distribution (sid), this problem has been fixed in version 1.1.17-1.

We recommend that you upgrade your nginx packages. ----------------------------------------------------------------------

TITLE: Debian update for nginx

SECUNIA ADVISORY ID: SA48465

VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/48465/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=48465

RELEASE DATE: 2012-03-20

DISCUSS ADVISORY: http://secunia.com/advisories/48465/#comments

AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)

http://secunia.com/advisories/48465/

https://ca.secunia.com/?page=viewadvisory&vuln_id=48465

ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING

http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

DESCRIPTION: Debian has issued an update for nginx. This fixes a weakness, which can be exploited by malicious people to disclose certain sensitive information.

For more information: SA48366

SOLUTION: Apply updated packages via the apt-get package manager.

ORIGINAL ADVISORY: DSA-2434-1: http://www.debian.org/security/2012/dsa-2434