CVE-2014-0133: f5 nginx Out-of-bounds Write
CVSS: 7.5v2.0HighModified
AliasesMGASA-2014-0136DEBIAN-CVE-2014-0133
Published 28-03-2014Last modified 06-08-2024
Vulnerability summary
CVE-2014-0133 is a high (CVSS 7.5) Out-of-bounds Write vulnerability in f5 nginx. EPSS estimates a 9.55% chance of exploitation in the next 30 days, higher than 95.4% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v2.0 (NVD)EPSS score
9.55%
0%100%
Low · +0.25 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 28-03-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request.
CVSS metrics
1 score · 1 source · 1 versionHigh 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
9.55%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
+0.25 pp
From 9.29% on 18-09-2026
18-09-202618-10-2026
EPSS score9.55%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- nginx< 1.4.7-1
F51 product
- nginx≥ 1.3.15, < 1.4.7 | ≥ 1.5.0, ≤ 1.5.11
Mageia1 product
- nginx< 1.4.7-1.mga4
Opensuse1 product
- opensuseEOL13.1
4 vendors · 4 products
References
7 links- mailman.nginx.org/pipermail/nginx-announce/2014/000135.htmlMailing ListX Refsource MLISTVendor AdvisoryWEB
- lists.opensuse.org/opensuse-updates/2014-03/msg00095.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
