[CLSA-2026:1790586276] nginx: Fix of 5 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-07 12:56:24 UTC
Description:
- CVE-2026-27651: properly clear s->passwd in mail auth http requests to fix a null pointer dereference on CRAM-MD5/APOP retry - CVE-2026-27654: validate the Destination length for Dav COPY and MOVE to prevent an integer underflow and heap buffer overwrite when alias is used - CVE-2026-27654: also require the COPY/MOVE Destination to match the aliased location prefix, and tighten ngx_http_map_uri_to_path() accordingly - CVE-2026-27784: fix a possible integer overflow on 32-bit platforms while validating mp4 atom entry counts
CVEs fixed:
Updated packages:
  • nginx-1.10.3-4.el6.tuxcare.els15.i686.rpm
    sha:384e8ab9b39c731737d0e69087929a30eff08a272dff44c2bf06fc4160dee9e9
  • nginx-1.10.3-4.el6.tuxcare.els15.x86_64.rpm
    sha:c3e569083766745f1018bd885a82e7b989a0354a416a06b5862289819f0dfee8
  • nginx-all-modules-1.10.3-4.el6.tuxcare.els15.noarch.rpm
    sha:ca9328bf5c4ddaf2a3e8b3422a4d91ba8d3d55a8c3a675869f2def9cfbee35aa
  • nginx-filesystem-1.10.3-4.el6.tuxcare.els15.noarch.rpm
    sha:505094417ec4bfad8002214309ba97e56df2b467c8252b4fd691154e1849cb0e
  • nginx-mod-http-geoip-1.10.3-4.el6.tuxcare.els15.i686.rpm
    sha:3575af1f0ee2d0e8620fcf48c813348ee4dfd853734561f9958d3cd6b2a1b411
  • nginx-mod-http-geoip-1.10.3-4.el6.tuxcare.els15.x86_64.rpm
    sha:0a1147a432410665e6c76464a8de78fbf7f71e724ce196d2eff326400e556405
  • nginx-mod-http-image-filter-1.10.3-4.el6.tuxcare.els15.i686.rpm
    sha:609645dbf60771bed5d776edb601fd3be8fb8e729bac62ee10c3d146ba5fca7e
  • nginx-mod-http-image-filter-1.10.3-4.el6.tuxcare.els15.x86_64.rpm
    sha:120e661983456cc19610c1cef187c743f819f3d394c2c57e0055a4ab6a9cffb6
  • nginx-mod-http-perl-1.10.3-4.el6.tuxcare.els15.i686.rpm
    sha:376e4bd4302cfc3e8bac9486dc9cf508fc690ff10b1131322f516ef8889afa26
  • nginx-mod-http-perl-1.10.3-4.el6.tuxcare.els15.x86_64.rpm
    sha:af1e789ef5baaf7acf5f5fded36707a3ac08a49a8df52c137dccdb4b3ed580fb
  • nginx-mod-http-xslt-filter-1.10.3-4.el6.tuxcare.els15.i686.rpm
    sha:49be59b3f280a003297d2d4d4a528782cf76f8523736c3b666c8894f708d0c72
  • nginx-mod-http-xslt-filter-1.10.3-4.el6.tuxcare.els15.x86_64.rpm
    sha:7102e191d80d21c84e833f57d581a07922cd8ef95ae427310c311e382c66713d
  • nginx-mod-mail-1.10.3-4.el6.tuxcare.els15.i686.rpm
    sha:61412fbf085031d13b0884f3bcc4096e13d98637164d19896fea1918857c053a
  • nginx-mod-mail-1.10.3-4.el6.tuxcare.els15.x86_64.rpm
    sha:917c2048b8b21b3c54abf803de2c7bbd639c1322edc7690374d5dee5beed9096
  • nginx-mod-stream-1.10.3-4.el6.tuxcare.els15.i686.rpm
    sha:e290d675c234fa3b35c808885e210089c074f2c25db4a8dab371e355bf384f6b
  • nginx-mod-stream-1.10.3-4.el6.tuxcare.els15.x86_64.rpm
    sha:0c7134895704ac7226e44a70eb54d9a42d575a6d6caf183c18a2e2e293ce7a9b
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.