CVE-2017-7529 Integer overflow in nginx
An integer overflow in the Nginx range filter module allows attackers to leak sensitive information via specially crafted requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-7529?
CVE-2017-7529 is a high-severity vulnerability in Apple Xcode, published on 13 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
Weakness: CWE-190
Which versions are affected by CVE-2017-7529?
It affects 3 products.
Linux distribution packages (18)
rh-nginx110-nginx Red Hat:rhel_software_collections:2::el6 | All versions | 1:1.10.2-8.el6 |
rh-nginx110-nginx-debuginfo Red Hat:rhel_software_collections:2::el6 | All versions | 1:1.10.2-8.el6 |
rh-nginx110-nginx-mod-http-image-filter Red Hat:rhel_software_collections:2::el6 | All versions | 1:1.10.2-8.el6 |
rh-nginx110-nginx-mod-http-perl Red Hat:rhel_software_collections:2::el6 | All versions | 1:1.10.2-8.el6 |
rh-nginx110-nginx-mod-http-xslt-filter Red Hat:rhel_software_collections:2::el6 | All versions | 1:1.10.2-8.el6 |
rh-nginx110-nginx-mod-mail Red Hat:rhel_software_collections:2::el6 | All versions | 1:1.10.2-8.el6 |
rh-nginx110-nginx-mod-stream Red Hat:rhel_software_collections:2::el6 | All versions | 1:1.10.2-8.el6 |
rh-nginx110-nginx Red Hat:rhel_software_collections:2::el7 | All versions | 1:1.10.2-8.el7 |
rh-nginx110-nginx-debuginfo Red Hat:rhel_software_collections:2::el7 | All versions | 1:1.10.2-8.el7 |
rh-nginx110-nginx-mod-http-image-filter Red Hat:rhel_software_collections:2::el7 | All versions | 1:1.10.2-8.el7 |
rh-nginx110-nginx-mod-http-perl Red Hat:rhel_software_collections:2::el7 | All versions | 1:1.10.2-8.el7 |
rh-nginx110-nginx-mod-http-xslt-filter Red Hat:rhel_software_collections:2::el7 | All versions | 1:1.10.2-8.el7 |
rh-nginx110-nginx-mod-mail Red Hat:rhel_software_collections:2::el7 | All versions | 1:1.10.2-8.el7 |
rh-nginx110-nginx-mod-stream Red Hat:rhel_software_collections:2::el7 | All versions | 1:1.10.2-8.el7 |
nginx-1.0 SUSE:Lifecycle Management Server 1.3 | All versions | 1.0.15-0.35.3.1 |
nginx SUSE:Package Hub 12 | All versions | 1.13.9-12.1 |
nginx-1.0 SUSE:Studio Onsite 1.3 | All versions | 1.0.15-0.35.3.1 |
nginx-1.0 SUSE:WebYast 1.3 | All versions | 1.0.15-0.35.3.1 |
Products include Apple Xcode, F5 Nginx, Puppet Puppet Enterprise.
How do I fix CVE-2017-7529?
Upgrade to a fixed version.
Is CVE-2017-7529 being exploited?
There is no known exploitation of CVE-2017-7529 in the wild and no public exploit code.
Public exploit code: 18 proofs of concept on GitHub.
Other vulnerabilities in Apple Xcode
Sources
Also known as ALPINE-CVE-2017-7529, CLEANSTART-2026-IH30576, DEBIAN-CVE-2017-7529, DLA-1024-1, DSA-3908-1, GHSA-85mj-h68w-w736 and 6 more.