ALAS2NGINX1-2023-003 --- nginxID: oval:org.secpod.oval:def:1701658 | Date: (C)2023-10-26 (M)2023-11-13 |
Class: PATCH | Family: unix |
A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap allocated buffer which can allow overwriting the least significant byte of next heap chunk metadata likely leading to a remote code execution in certain circumstances. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability