Nginx SPDY heap buffer overflow (affects 1.3.15

Re:Nginx SPDY heap buffer overflow (affects 1.3.15 – 1.5.11) by yeukhon on Tuesday March 18, 2014 @03:38PM (#7424452)

It said it affected 1.3.15 to 1.5.11 but the fix is available in nginx 1.5.12, 1.4.7.

So for those who are using legacy version are they going to rely on distro vendor to push the patch? Just curious, even though I guess the number of users who have activated this experimental SPDY is low and people who actually have it enabled probably know how to fix it themselves.

[ Parent | on HN ]

Re:Nginx SPDY heap buffer overflow (affects 1.3.15 – 1.5.11) by aroch on Tuesday March 18, 2014 @03:47PM (#7424518)

1.5.12 is the latest devel branch and 1.4.7 is the latest release branch (released in response to this CVE and excepted from the vuln range). The patch works for any of the intervening versions.

As far as I'm aware, all the major distros backport nginx stable release

[ Parent | on HN ]