Skip to content
OpenAdvisories
Unscored Public exploit CVE-2017-7529 EUVD-2017-16545GHSA-85mj-h68w-w736

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulti…

Published Jul 13, 2017 · Updated Sep 16, 2024 · Assigned by redhat

Vendor: nginx Product: nginx Package: nginx Package: nginx Package: nginx Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Affected products

VendorProductAffectedFixed
nginx nginx 0.5.6 - 1.13.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 nginx 1.13.3-1 —
Debian 13 nginx 1.13.3-1 —
Debian 12 nginx 1.13.3-1 —
Debian 9 nginx 1.10.3-1+deb9u1 DSA-3908-1
Debian 8 nginx 1.6.2-5+deb8u5 DSA-3908-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Debian 7 nginx 1.2.1-2.2+wheezy4+deb7u1 DLA-1024-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS nginx 1.10.3-0ubuntu0.16.04.2 USN-3352-1
Ubuntu 14.04 LTS nginx 1.4.6-1ubuntu3.8 USN-3352-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 2 rh-nginx110-nginx +5 1:1.10.2-8.el6 RHSA-2017:2538

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE WebYast 1.3 nginx-1.0 1.0.15-0.35.3.1 SUSE-SU-2017:2387-1
SUSE Studio Onsite 1.3 nginx-1.0 1.0.15-0.35.3.1 SUSE-SU-2017:2387-1
SUSE Package Hub 12 nginx 1.13.9-12.1 openSUSE-SU-2018:0813-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Lifecycle Management Server 1.3 nginx-1.0 1.0.15-0.35.3.1 SUSE-SU-2017:2387-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed nginx 1.21.3-1.4 openSUSE-SU-2024:11092-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 nginx 1.12.1-r0 —
Alpine v3.23 nginx 1.12.1-r0 —
Alpine v3.22 nginx 1.12.1-r0 —
Alpine v3.21 nginx 1.12.1-r0 —
Alpine v3.20 nginx 1.12.1-r0 —
Show 16 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 nginx 1.12.1-r0 —
Alpine v3.18 nginx 1.12.1-r0 —
Alpine v3.17 nginx 1.12.1-r0 —
Alpine v3.16 nginx 1.12.1-r0 —
Alpine v3.15 nginx 1.12.1-r0 —
Alpine v3.14 nginx 1.12.1-r0 —
Alpine v3.13 nginx 1.12.1-r0 —
Alpine v3.12 nginx 1.12.1-r0 —
Alpine v3.11 nginx 1.12.1-r0 —
Alpine v3.10 nginx 1.12.1-r0 —
Alpine v3.9 nginx 1.12.1-r0 —
Alpine v3.8 nginx 1.12.1-r0 —
Alpine v3.7 nginx 1.12.1-r0 —
Alpine v3.6 nginx 1.12.1-r0 —
Alpine v3.5 nginx 1.10.3-r1 —
Alpine v3.4 nginx 1.10.3-r0 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 nginx +7 1:1.17.7-2.el7 ELSA-2020-5862, ELSA-2020-5859
Oracle Linux 7 olcne-istio-chart +1 1.1.6-1.el7 ELSA-2020-5859
Oracle Linux 7 olcnectl +4 1.0.8-2.el7 ELSA-2020-5862, ELSA-2020-5859

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 18 repositories · most starred shown

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 9

References