MGASA-2024-0286

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2024-0286.html
Import Source
https://advisories.mageia.org/MGASA-2024-0286.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2024-0286
Upstream
Published
2024-09-10T16:40:31Z
Modified
2026-05-30T05:15:04Z
Summary
Nginx has been updated to the latest stable release to fix CVE
Details

CVE-2024-7347: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

References
Credits

Affected packages

Mageia:9 / nginx

Package

Name
nginx
Purl
pkg:rpm/mageia/nginx?arch=source&distro=mageia-9

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.26.2-1.mga9

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2024-0286.json"