Medium WID-SEC-2023-0907 4 CVEs

NGINX: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Apr 10, 2023 · Updated Apr 10, 2023 · de-DE

Vendor: nginx Product: NGINX NJS < v0.7.10 Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in NGINX ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

NGINX ist eine Webserver-, Reverse Proxy- und E-Mail-Proxy Software.

Vulnerabilities 4

High 7.5

CVE-2023-27727

Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_function_frame at src/njs_fun…

Apr 9, 2023
High 7.5

CVE-2023-27728

Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_dump_is_recursive at src/njs_…

Apr 9, 2023
High 7.5

CVE-2023-27729

Nginx NJS v0.7.10 was discovered to contain an illegal memcpy via the function njs_vmcode_return at src/njs_vmcode.c.

Apr 9, 2023
High 7.5

CVE-2023-27730

Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_lvlhsh_find at src/njs_lvlhsh…

Apr 9, 2023

Revision history

2023-04-10 #1
Initiale Fassung

References

Github Security Advisory vom 2023-04-10
https://github.com/advisories/GHSA-rc94-438g-7v38
Github Security Advisory vom 2023-04-10
https://github.com/advisories/GHSA-qmh7-2w4g-hwv8
Github Security Advisory vom 2023-04-10
https://github.com/advisories/GHSA-c799-xf29-f54x
Github Security Advisory vom 2023-04-10
https://github.com/advisories/GHSA-2jqf-9377-3hhp