Bug#742059: nginx: CVE-2014-0133: SPDY heap buffer overflow

2014-03-18 Thread Thomas Ward
Assuming it follows similar build rules in its Debian packaging in Experimental, then I'm assuming it also is covered. On Tue, Mar 18, 2014 at 7:06 PM, James Cloos wrote: >> "y" == yatiohi writes: > > y> we are not vulnerable since nginx is compiled with the --with-debug > y> configure opti

Bug#742059: nginx: CVE-2014-0133: SPDY heap buffer overflow

2014-03-18 Thread James Cloos
> "y" == yatiohi writes: y> we are not vulnerable since nginx is compiled with the --with-debug y> configure option. Does that also apply to 1.5.11 in experimental? y> Although, we will release 1.4.7-1 shortly to follow y> upstream and include a few module updates as well. Updating experi

Bug#742059: nginx: CVE-2014-0133: SPDY heap buffer overflow

2014-03-18 Thread yatiohi
Hello Henri, On Tue, Mar 18, 2014 at 08:02:25PM +0200, Henri Salo wrote: Source: nginx Version: 1.4.6-1 Severity: grave Tags: security, fixed-upstream http://nginx.org/en/security_advisories.html http://nginx.org/download/patch.2014.spdy2.txt Not vulnerable: 1.5.12+, 1.4.7+ Vulnerable: 1.3.15-

Bug#742059: nginx: CVE-2014-0133: SPDY heap buffer overflow

2014-03-18 Thread Henri Salo
Source: nginx Version: 1.4.6-1 Severity: grave Tags: security, fixed-upstream http://nginx.org/en/security_advisories.html http://nginx.org/download/patch.2014.spdy2.txt Not vulnerable: 1.5.12+, 1.4.7+ Vulnerable: 1.3.15-1.5.11 --- Henri Salo signature.asc Description: Digital signature