Summary
generated automatically from NVD dataCVE-2014-0133 is a heap-based buffer overflow (CWE-787) in the SPDY implementation of nginx, affecting versions from 1.3.15 before 1.4.7 and 1.5.x before 1.5.12. A remote attacker could send a crafted request to trigger the overflow and potentially execute arbitrary code on the server. openSUSE 13.1 is also listed among the affected products. The flaw has a CVSS v2.0 score of 7.5 (HIGH).
NVD description
Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request.
EPSS · FIRST.org
9.5%probability of exploitation in the next 30 days
Higher than 95% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-11-01, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 28 mars 2014
- Updated
- 17 juin 2026
- Status
- Modified
- Source
- secalert@redhat.com
Affected products
Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.
Weaknesses (CWE)
References (6)
- http://lists.opensuse.org/opensuse-updates/2014-03/msg00095.htmlMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/66537Third Party AdvisoryVDB Entry
- http://lists.opensuse.org/opensuse-updates/2014-03/msg00095.htmlMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/66537Third Party AdvisoryVDB Entry
Similar CVEs
Other vulnerabilities of type CWE-787
Running nginx? Know which CVEs hit your version.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.