Security update for nginx-1.0 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2387-1 Final 1 1 2017-09-07T14:38:39Z current 2017-09-07T14:38:39Z 2017-09-07T14:38:39Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nginx-1.0 This update for NGINX fixes the following issues: Security issue fixed: - CVE-2017-7529: Integer overflow in nginx range filter module leading to memory disclosure. (bsc#1048265) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleslms13-nginx-1.0-13271,slestso13-nginx-1.0-13271,slewyst13-nginx-1.0-13271 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172387-1/ Link for SUSE-SU-2017:2387-1 https://lists.suse.com/pipermail/sle-security-updates/2017-September/003192.html E-Mail link for SUSE-SU-2017:2387-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1048265 SUSE Bug 1048265 https://www.suse.com/security/cve/CVE-2017-7529/ SUSE CVE CVE-2017-7529 page SUSE Lifecycle Management Server 1.3 SUSE Studio Onsite 1.3 SUSE WebYast 1.3 nginx-1.0-1.0.15-0.35.3.1 nginx-1.0-1.0.15-0.35.3.1 as a component of SUSE Lifecycle Management Server 1.3 nginx-1.0-1.0.15-0.35.3.1 as a component of SUSE Studio Onsite 1.3 nginx-1.0-1.0.15-0.35.3.1 as a component of SUSE WebYast 1.3 Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request. CVE-2017-7529 SUSE Lifecycle Management Server 1.3:nginx-1.0-1.0.15-0.35.3.1 SUSE Studio Onsite 1.3:nginx-1.0-1.0.15-0.35.3.1 SUSE WebYast 1.3:nginx-1.0-1.0.15-0.35.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172387-1/ https://www.suse.com/security/cve/CVE-2017-7529.html CVE-2017-7529 https://bugzilla.suse.com/1048265 SUSE Bug 1048265