CVE-2013-2028
- State
- Published
- Severity
- Not scored
- Published
- Jul 18, 2013
- Updated
- Aug 6, 2024
- Reserved
- Feb 19, 2013
Description
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [nginx-announce] 20130507 nginx security advisory (CVE-2013-2028)mailing-list
- 93037vdb-entry
- FEDORA-2013-7560vendor-advisory
- http://www.vnsecurity.net/2013/05/analysis-of-nginx-cve-2013-2028/
- 55181third-party-advisory
- 59699vdb-entry
- GLSA-201310-04vendor-advisory
- https://github.com/rapid7/metasploit-framework/pull/1834
- http://nginx.org/download/patch.2013.chunked.txt
- http://packetstormsecurity.com/files/121675/Nginx-1.3.9-1.4.0-Denial-Of-Service.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.