CVE-2012-1180: Debian Linux

Medium severity, CVSS 5.0. EPSS: 10.6% chance of exploitation in the next 30 days.

Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request.

Affected products

• Debian Debian Linux: version 6.0 only
• F5 Nginx: from 0.1.0, before 1.0.14 (fixed in 1.0.14); from 1.1.0, before 1.1.17 (fixed in 1.1.17)
• Fedoraproject Fedora: version 15 only; version 16 only; version 17 only

Published 2012-04-17. Last modified 2026-06-16.