Cyril Lavier uploaded new packages for nginx which fixed the 
following security problems:

CVE-2012-2089 - nginx -- arbitrary code execution in mp4
pseudo-streaming module

A flaw was reported in the nginx standard mp4 pseudo-streaming module. A
specially-crafted mp4 file could allow for the overwriting of memory
locations in a worker process if ngx_http_mp4_module were used. This
could potentially result in arbitrary code execution with the privileges
of the unprivileged nginx user.

This has been corrected in upstream 1.0.15 and 1.1.9 versions, and only
affected versions newer than 1.1.3 and 1.0.7 when built with the
ngx_http_mp4_module and had the "mp4" directive set in the configuration

For the squeeze-backports distribution the problems have been fixed in


For wheezy (testing) and sid (unstable) this was fixed in version


Squeeze (stable) is not vulnerable to this security issue.