# Security advisory

**URL:** <https://www.ruby-forum.com/t/security-advisory/218807>\
**Category:** NGINX\
**Created:** [April 12, 2012, 3:28pm UTC](https://www.ruby-forum.com/t/security-advisory/218807 "2012-04-12T15:28:48Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [April 12, 2012, 3:28pm UTC](https://www.ruby-forum.com/t/security-advisory/218807/1 "2012-04-12T15:28:48Z")

</div>

Hello!

Matthew Daley discovered a security problem in the  
ngx\_http\_mp4\_module, CVE-2012-2089.

A specially crafted mp4 file might allow to overwrite memory  
locations in a worker process if the ngx\_http\_mp4\_module is  
used, potentially resulting in arbitrary code execution.

The problem affects nginx 1.1.3+, 1.0.7+ built with the  
ngx\_http\_mp4\_module (the module is not built by default) and  
the “mp4” directive is used in a configuration file.

The problem is fixed in 1.1.19, 1.0.15.

Patch for the problem can be found here:

[http://nginx.org/download/patch.2012.mp4.txt](http://nginx.org/download/patch.2012.mp4.txt)

Maxim D.