FYI:

__

http://nginx.org/en/CHANGES-1.0

Changes with nginx 1.0.14 15 Mar 2012

Security: content of previously freed memory might be sent to a client if backend returned specially crafted response. Thanks to Matthew Daley.

__

in regards to the repo .12 package.

Thanks.

Another one huh. Thanks for the report!

Thanks for the quick update.

FYI, another one:

__

A vulnerability has been reported in nginx, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an error within the ngx_http_mp4_module module when parsing certain atoms and can be exploited to cause a buffer overflow via a specially crafted MP4 file placed on the server.

Successful exploitation may allow execution of arbitrary code but requires that ngx_http_mp4_module module is enabled and the "mp4" directive is configured.

The vulnerability is reported in versions 1.1.3 through 1.1.18 and 1.0.7 through 1.0.14.

Solution
Update to version 1.1.19 or 1.0.15.

__

Systems running ASL with the ASL kernel are immune to this. If you are not running ASL, or if you are and are not running the ASL kernel then you will need to upgrade nginx.

Mike:

Thanks. Figured it wasn't an issue for ASL but was posting in regards to the repo package version.

Wise, not everyone is running ASL, and some ASL users don't use the ASL kernel. We just pushed an nginx update btw.

Great, thanks!

Nginx is now supported in ASL. Please see the configuration guide here:

https://www.atomicorp.com/wiki/index.php/Nginx