CVE-2017-7529

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
nginx	nginx	0.5.6 - 1.13.2

References

http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.htmlVendor Advisory
http://seclists.org/fulldisclosure/2021/Sep/36Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/99534Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039238Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:2538Third Party Advisory
https://puppet.com/security/cve/cve-2017-7529Third Party Advisory
https://support.apple.com/kb/HT212818Third Party Advisory
http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.htmlVendor Advisory
http://seclists.org/fulldisclosure/2021/Sep/36Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/99534Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039238Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:2538Third Party Advisory
https://puppet.com/security/cve/cve-2017-7529Third Party Advisory
https://support.apple.com/kb/HT212818Third Party Advisory

Timeline

Published: Jul 13, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-75308.8In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbit CVE-2017-75314.3In Moodle 3.3, the course overview block reveals activities in hidden courses.CVE-2017-75326.5In Moodle 3.x, course creators are able to change system default settings for courses.CVE-2017-75337.0Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges or cause a denial of CVE-2017-75345.4OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user in CVE-2017-75356.1foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user CVE-2017-75367.0In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, whi CVE-2017-75377.5It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package befor CVE-2017-75385.4A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an or CVE-2017-75397.5An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where CVE-2017-75409.8rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. CVE-2017-75417.8The brcmf_cfg80211_mgmt_tx function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.12.3 allows