Action not permitted
Modal body text goes here.
cve-2016-0747
Vulnerability from cvelistv5
Published
2016-02-15 19:00
Modified
2024-08-05 22:30
Severity ?
EPSS score ?
Summary
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T22:30:04.106Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2016:0371",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bto.bluecoat.com/security-advisory/sa115"
},
{
"name": "GLSA-201606-06",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201606-06"
},
{
"name": "1034869",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1034869"
},
{
"name": "[nginx] 20160126 nginx security advisory (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html"
},
{
"name": "RHSA-2016:1425",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2016:1425"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302589"
},
{
"name": "DSA-3473",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3473"
},
{
"name": "USN-2892-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2892-1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/kb/HT212818"
},
{
"name": "20210921 APPLE-SA-2021-09-20-4 Xcode 13",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2021/Sep/36"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-01-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-21T23:07:07",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "openSUSE-SU-2016:0371",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bto.bluecoat.com/security-advisory/sa115"
},
{
"name": "GLSA-201606-06",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201606-06"
},
{
"name": "1034869",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1034869"
},
{
"name": "[nginx] 20160126 nginx security advisory (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html"
},
{
"name": "RHSA-2016:1425",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2016:1425"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302589"
},
{
"name": "DSA-3473",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3473"
},
{
"name": "USN-2892-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2892-1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/kb/HT212818"
},
{
"name": "20210921 APPLE-SA-2021-09-20-4 Xcode 13",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2021/Sep/36"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2016-0747",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:0371",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html"
},
{
"name": "https://bto.bluecoat.com/security-advisory/sa115",
"refsource": "CONFIRM",
"url": "https://bto.bluecoat.com/security-advisory/sa115"
},
{
"name": "GLSA-201606-06",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201606-06"
},
{
"name": "1034869",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1034869"
},
{
"name": "[nginx] 20160126 nginx security advisory (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747)",
"refsource": "MLIST",
"url": "http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html"
},
{
"name": "RHSA-2016:1425",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2016:1425"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1302589",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302589"
},
{
"name": "DSA-3473",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3473"
},
{
"name": "USN-2892-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-2892-1"
},
{
"name": "https://support.apple.com/kb/HT212818",
"refsource": "CONFIRM",
"url": "https://support.apple.com/kb/HT212818"
},
{
"name": "20210921 APPLE-SA-2021-09-20-4 Xcode 13",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2021/Sep/36"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2016-0747",
"datePublished": "2016-02-15T19:00:00",
"dateReserved": "2015-12-16T00:00:00",
"dateUpdated": "2024-08-05T22:30:04.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2016-0747\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2016-02-15T19:59:02.123\",\"lastModified\":\"2021-12-16T18:43:52.677\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.\"},{\"lang\":\"es\",\"value\":\"El traductor de direcciones en nginx en versiones anteriores a 1.8.1 y 1.9.x en versiones anteriores a 1.9.10 no limita correctamente la resoluci\u00f3n CNAME, lo que permite a atacantes remotos provocar una denegaci\u00f3n de servicio (consumo de recursos por el proceso trabajador) a trav\u00e9s de vectores relacionados con la resoluci\u00f3n de nombre arbitrario.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":5.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.6.18\",\"versionEndExcluding\":\"1.8.1\",\"matchCriteriaId\":\"FB42AA9F-E2F7-471C-AAC1-953469630349\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.9.0\",\"versionEndExcluding\":\"1.9.10\",\"matchCriteriaId\":\"E90F693D-8EEF-4222-B562-67629C7C72DF\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*\",\"matchCriteriaId\":\"815D70A8-47D3-459C-A32C-9FEACA0659D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E88A537F-F4D0-46B9-9E37-965233C2A355\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16F59A04-14CF-49E2-9973-645477EA09DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4863BE36-D16A-4D75-90D9-FD76DB5B48B7\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4863BE36-D16A-4D75-90D9-FD76DB5B48B7\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"13.0\",\"matchCriteriaId\":\"BB279F6B-EE4C-4885-9CD4-657F6BD2548F\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2021/Sep/36\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3473\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securitytracker.com/id/1034869\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-2892-1\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2016:1425\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bto.bluecoat.com/security-advisory/sa115\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1302589\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/201606-06\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.apple.com/kb/HT212818\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
rhsa-2016_1425
Vulnerability from csaf_redhat
Published
2016-07-14 05:50
Modified
2024-11-05 19:22
Summary
Red Hat Security Advisory: rh-nginx18-nginx security update
Notes
Topic
An update for rh-nginx18-nginx is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Nginx is a web and proxy server with a focus on high concurrency, performance, and low memory usage.
The following packages have been upgraded to a newer upstream version: rh-nginx18-nginx (1.8.1).
Security Fix(es):
* A NULL pointer dereference flaw was found in the nginx code responsible for saving client request body to a temporary file. A remote attacker could send a specially crafted request that would cause nginx worker process to crash. (CVE-2016-4450)
* It was discovered that nginx could perform an out of bound read and dereference an invalid pointer when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash if nginx enabled the resolver in its configuration. (CVE-2016-0742)
* A use-after-free flaw was found in the way nginx resolved certain CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash or, possibly, execute arbitrary code if nginx enabled the resolver in its configuration. (CVE-2016-0746)
* It was discovered that nginx did not limit recursion when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to use an excessive amount of resources if nginx enabled the resolver in its configuration. (CVE-2016-0747)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rh-nginx18-nginx is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Nginx is a web and proxy server with a focus on high concurrency, performance, and low memory usage.\n\nThe following packages have been upgraded to a newer upstream version: rh-nginx18-nginx (1.8.1).\n\nSecurity Fix(es):\n\n* A NULL pointer dereference flaw was found in the nginx code responsible for saving client request body to a temporary file. A remote attacker could send a specially crafted request that would cause nginx worker process to crash. (CVE-2016-4450)\n\n* It was discovered that nginx could perform an out of bound read and dereference an invalid pointer when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash if nginx enabled the resolver in its configuration. (CVE-2016-0742)\n\n* A use-after-free flaw was found in the way nginx resolved certain CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash or, possibly, execute arbitrary code if nginx enabled the resolver in its configuration. (CVE-2016-0746)\n\n* It was discovered that nginx did not limit recursion when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to use an excessive amount of resources if nginx enabled the resolver in its configuration. (CVE-2016-0747)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1425",
"url": "https://access.redhat.com/errata/RHSA-2016:1425"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1302587",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302587"
},
{
"category": "external",
"summary": "1302588",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302588"
},
{
"category": "external",
"summary": "1302589",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302589"
},
{
"category": "external",
"summary": "1341462",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1341462"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1425.json"
}
],
"title": "Red Hat Security Advisory: rh-nginx18-nginx security update",
"tracking": {
"current_release_date": "2024-11-05T19:22:56+00:00",
"generator": {
"date": "2024-11-05T19:22:56+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2016:1425",
"initial_release_date": "2016-07-14T05:50:00+00:00",
"revision_history": [
{
"date": "2016-07-14T05:50:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-07-14T05:50:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:22:56+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"product": {
"name": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"product_id": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-nginx18-nginx-debuginfo@1.8.1-1.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"product": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"product_id": "rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-nginx18-nginx@1.8.1-1.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"product": {
"name": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"product_id": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-nginx18-nginx-debuginfo@1.8.1-1.el6?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"product": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"product_id": "rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-nginx18-nginx@1.8.1-1.el6?arch=x86_64\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-nginx18-nginx-1:1.8.1-1.el7.src",
"product": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el7.src",
"product_id": "rh-nginx18-nginx-1:1.8.1-1.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-nginx18-nginx@1.8.1-1.el7?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-nginx18-nginx-1:1.8.1-1.el6.src",
"product": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el6.src",
"product_id": "rh-nginx18-nginx-1:1.8.1-1.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-nginx18-nginx@1.8.1-1.el6?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64"
},
"product_reference": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64"
},
"product_reference": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64"
},
"product_reference": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64"
},
"product_reference": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
},
"product_reference": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
},
"product_reference": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
},
"product_reference": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-1:1.8.1-1.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64"
},
"product_reference": "rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
},
"product_reference": "rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-0742",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2016-01-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1302587"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that nginx could perform an out of bound read and dereference an invalid pointer when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash if nginx enabled the resolver in its configuration.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nginx: invalid pointer dereference in resolver",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0742"
},
{
"category": "external",
"summary": "RHBZ#1302587",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302587"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0742",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0742"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0742",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0742"
},
{
"category": "external",
"summary": "http://mailman.nginx.org/pipermail/nginx-announce/2016/000169.html",
"url": "http://mailman.nginx.org/pipermail/nginx-announce/2016/000169.html"
}
],
"release_date": "2016-01-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-07-14T05:50:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe rh-nginx18-nginx service must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1425"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nginx: invalid pointer dereference in resolver"
},
{
"cve": "CVE-2016-0746",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2016-01-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1302588"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free flaw was found in the way nginx resolved certain CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash or, possibly, execute arbitrary code if nginx enabled the resolver in its configuration.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nginx: use-after-free during CNAME response processing in resolver",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0746"
},
{
"category": "external",
"summary": "RHBZ#1302588",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302588"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0746",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0746"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0746",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0746"
},
{
"category": "external",
"summary": "http://mailman.nginx.org/pipermail/nginx-announce/2016/000169.html",
"url": "http://mailman.nginx.org/pipermail/nginx-announce/2016/000169.html"
}
],
"release_date": "2016-01-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-07-14T05:50:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe rh-nginx18-nginx service must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1425"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nginx: use-after-free during CNAME response processing in resolver"
},
{
"cve": "CVE-2016-0747",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2016-01-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1302589"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that nginx did not limit recursion when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to use an excessive amount of resources if nginx enabled the resolver in its configuration.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nginx: Insufficient limits of CNAME resolution in resolver",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0747"
},
{
"category": "external",
"summary": "RHBZ#1302589",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302589"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0747",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0747"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0747",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0747"
},
{
"category": "external",
"summary": "http://mailman.nginx.org/pipermail/nginx-announce/2016/000169.html",
"url": "http://mailman.nginx.org/pipermail/nginx-announce/2016/000169.html"
}
],
"release_date": "2016-01-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-07-14T05:50:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe rh-nginx18-nginx service must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1425"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nginx: Insufficient limits of CNAME resolution in resolver"
},
{
"cve": "CVE-2016-4450",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2016-05-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1341462"
}
],
"notes": [
{
"category": "description",
"text": "A NULL pointer dereference flaw was found in the nginx code responsible for saving client request body to a temporary file. A remote attacker could send a specially crafted request that would cause nginx worker process to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nginx: NULL pointer dereference while writing client request body",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-4450"
},
{
"category": "external",
"summary": "RHBZ#1341462",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1341462"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-4450",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-4450"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-4450",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4450"
},
{
"category": "external",
"summary": "http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html",
"url": "http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html"
}
],
"release_date": "2016-05-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-07-14T05:50:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe rh-nginx18-nginx service must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1425"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.6.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2-6.7.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.src",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el6.x86_64",
"6Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el6.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.1.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2-7.2.Z:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Server-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Server-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.src",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-1:1.8.1-1.el7.x86_64",
"7Workstation-RHSCL-2.2:rh-nginx18-nginx-debuginfo-1:1.8.1-1.el7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nginx: NULL pointer dereference while writing client request body"
}
]
}
ghsa-769v-gfhq-g2w7
Vulnerability from github
Published
2022-05-13 01:04
Modified
2022-05-13 01:04
Severity ?
Details
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.
{
"affected": [],
"aliases": [
"CVE-2016-0747"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-02-15T19:59:00Z",
"severity": "MODERATE"
},
"details": "The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.",
"id": "GHSA-769v-gfhq-g2w7",
"modified": "2022-05-13T01:04:26Z",
"published": "2022-05-13T01:04:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0747"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1425"
},
{
"type": "WEB",
"url": "https://bto.bluecoat.com/security-advisory/sa115"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302589"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201606-06"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT212818"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html"
},
{
"type": "WEB",
"url": "http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Sep/36"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3473"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1034869"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2892-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
var-201602-0391
Vulnerability from variot
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution. nginx is prone to multiple denial-of-service vulnerabilities. Attackers can exploit these issues to cause denial-of-service conditions. There is a security vulnerability in the resolver of nginx versions prior to 1.8.1 and versions 1.9.x prior to 1.9.10. The vulnerability stems from the fact that the program does not limit CNAME resolution. These only affect nginx if the "resolver" directive is used in a configuration file.
For the oldstable distribution (wheezy), these problems have been fixed in version 1.2.1-2.2+wheezy4.
For the stable distribution (jessie), these problems have been fixed in version 1.6.2-5+deb8u1.
For the testing distribution (stretch), these problems have been fixed in version 1.9.10-1.
For the unstable distribution (sid), these problems have been fixed in version 1.9.10-1.
We recommend that you upgrade your nginx packages. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
===================================================================== Red Hat Security Advisory
Synopsis: Moderate: rh-nginx18-nginx security update Advisory ID: RHSA-2016:1425-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2016:1425 Issue date: 2016-07-14 CVE Names: CVE-2016-0742 CVE-2016-0746 CVE-2016-0747 CVE-2016-4450 =====================================================================
- Summary:
An update for rh-nginx18-nginx is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64
- Description:
Nginx is a web and proxy server with a focus on high concurrency, performance, and low memory usage.
The following packages have been upgraded to a newer upstream version: rh-nginx18-nginx (1.8.1).
Security Fix(es):
-
A NULL pointer dereference flaw was found in the nginx code responsible for saving client request body to a temporary file. A remote attacker could send a specially crafted request that would cause nginx worker process to crash. (CVE-2016-4450)
-
It was discovered that nginx could perform an out of bound read and dereference an invalid pointer when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash if nginx enabled the resolver in its configuration. (CVE-2016-0742)
-
A use-after-free flaw was found in the way nginx resolved certain CNAME DNS records. (CVE-2016-0746)
-
It was discovered that nginx did not limit recursion when resolving CNAME DNS records. (CVE-2016-0747)
-
Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
The rh-nginx18-nginx service must be restarted for this update to take effect.
- Bugs fixed (https://bugzilla.redhat.com/):
1302587 - CVE-2016-0742 nginx: invalid pointer dereference in resolver 1302588 - CVE-2016-0746 nginx: use-after-free during CNAME response processing in resolver 1302589 - CVE-2016-0747 nginx: Insufficient limits of CNAME resolution in resolver 1341462 - CVE-2016-4450 nginx: NULL pointer dereference while writing client request body
- Package List:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):
Source: rh-nginx18-nginx-1.8.1-1.el6.src.rpm
x86_64: rh-nginx18-nginx-1.8.1-1.el6.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el6.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6):
Source: rh-nginx18-nginx-1.8.1-1.el6.src.rpm
x86_64: rh-nginx18-nginx-1.8.1-1.el6.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el6.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):
Source: rh-nginx18-nginx-1.8.1-1.el6.src.rpm
x86_64: rh-nginx18-nginx-1.8.1-1.el6.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el6.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):
Source: rh-nginx18-nginx-1.8.1-1.el6.src.rpm
x86_64: rh-nginx18-nginx-1.8.1-1.el6.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el6.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source: rh-nginx18-nginx-1.8.1-1.el7.src.rpm
x86_64: rh-nginx18-nginx-1.8.1-1.el7.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1):
Source: rh-nginx18-nginx-1.8.1-1.el7.src.rpm
x86_64: rh-nginx18-nginx-1.8.1-1.el7.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2):
Source: rh-nginx18-nginx-1.8.1-1.el7.src.rpm
x86_64: rh-nginx18-nginx-1.8.1-1.el7.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):
Source: rh-nginx18-nginx-1.8.1-1.el7.src.rpm
x86_64: rh-nginx18-nginx-1.8.1-1.el7.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2016-0742 https://access.redhat.com/security/cve/CVE-2016-0746 https://access.redhat.com/security/cve/CVE-2016-0747 https://access.redhat.com/security/cve/CVE-2016-4450 https://access.redhat.com/security/updates/classification/#moderate
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iD8DBQFXhy2gXlSAg2UNWIIRAjOgAJ9QjuFMrvK50IeJq8Ky7VkefuMBUwCeM+Cp ZhbDRXs2sdXbnakZ6oJi/K8= =7RBd -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201606-06
https://security.gentoo.org/
Severity: Normal Title: nginx: Multiple vulnerabilities Date: June 17, 2016 Bugs: #560854, #573046, #584744 ID: 201606-06
Synopsis
Multiple vulnerabilities have been found in nginx, the worst of which may allow a remote attacker to cause a Denial of Service.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-servers/nginx < 1.10.1 >= 1.10.1
Description
Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below for details.
Workaround
There is no known workaround at this time.
Resolution
All nginx users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.10.1"
References
[ 1 ] CVE-2013-3587 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3587 [ 2 ] CVE-2016-0742 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0742 [ 3 ] CVE-2016-0746 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0746 [ 4 ] CVE-2016-0747 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0747 [ 5 ] CVE-2016-4450 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4450 [ 6 ] CVE-2016-4450 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4450
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/201606-06
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5 . ============================================================================ Ubuntu Security Notice USN-2892-1 February 09, 2016
nginx vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.10
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in nginx. (CVE-2016-0747)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 15.10: nginx-core 1.9.3-1ubuntu1.1 nginx-extras 1.9.3-1ubuntu1.1 nginx-full 1.9.3-1ubuntu1.1 nginx-light 1.9.3-1ubuntu1.1
Ubuntu 14.04 LTS: nginx-core 1.4.6-1ubuntu3.4 nginx-extras 1.4.6-1ubuntu3.4 nginx-full 1.4.6-1ubuntu3.4 nginx-light 1.4.6-1ubuntu3.4 nginx-naxsi 1.4.6-1ubuntu3.4
In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
APPLE-SA-2021-09-20-4 Xcode 13
Xcode 13 addresses the following issues.
IDE Xcode Server Available for: macOS Big Sur 11.3 and later Impact: Multiple issues in nginx Description: Multiple issues were addressed by updating nginx to version 1.21.0. CVE-2016-0742 CVE-2016-0746 CVE-2016-0747 CVE-2017-7529 CVE-2018-16843 CVE-2018-16844 CVE-2018-16845 CVE-2019-20372
Installation note:
Xcode 13 may be obtained from:
https://developer.apple.com/xcode/downloads/
To check that the Xcode has been updated:
- Select Xcode in the menu bar
- Select About Xcode
- The version after applying this update will be "Xcode 13"
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201602-0391",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "linux",
"scope": "eq",
"trust": 1.6,
"vendor": "debian",
"version": "8.0"
},
{
"model": "leap",
"scope": "eq",
"trust": 1.4,
"vendor": "novell",
"version": "42.1"
},
{
"model": "nginx",
"scope": "gte",
"trust": 1.0,
"vendor": "f5",
"version": "1.9.0"
},
{
"model": "nginx",
"scope": "lt",
"trust": 1.0,
"vendor": "f5",
"version": "1.9.10"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "7.0"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "15.10"
},
{
"model": "nginx",
"scope": "gte",
"trust": 1.0,
"vendor": "f5",
"version": "0.6.18"
},
{
"model": "nginx",
"scope": "lt",
"trust": 1.0,
"vendor": "f5",
"version": "1.8.1"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"model": "leap",
"scope": "eq",
"trust": 1.0,
"vendor": "opensuse",
"version": "42.1"
},
{
"model": "xcode",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "13.0"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "14.04"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.8,
"vendor": "igor sysoev",
"version": "1.9.10"
},
{
"model": "nginx",
"scope": "lt",
"trust": 0.8,
"vendor": "igor sysoev",
"version": "1.9.x"
},
{
"model": "ubuntu",
"scope": "eq",
"trust": 0.8,
"vendor": "canonical",
"version": "15.10"
},
{
"model": "ubuntu",
"scope": "eq",
"trust": 0.8,
"vendor": "canonical",
"version": "14.04 lts"
},
{
"model": "gnu/linux",
"scope": "eq",
"trust": 0.8,
"vendor": "debian",
"version": "8.0"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.9.9"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.16"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.15"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.14"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.11"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.18"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.17"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "0.6.18"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.6.1"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.6.0"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.5.9"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.5.8"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.5.7"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.5.6"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.5.5"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.5.4"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.5.2"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.5.12"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.5.11"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.5.10"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.5.1"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.5.0"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.4.3"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.4.1"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.9"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.8"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.7"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.6"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.5"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.4"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.3"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.2"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.13"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.12"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.10"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.3.0"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.9"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.8"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.7"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.6"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.5"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.4"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.3"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.2"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.19"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.16"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.15"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.14"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.13"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.12"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.11"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.1"
},
{
"model": "nginx",
"scope": "eq",
"trust": 0.3,
"vendor": "nginx",
"version": "1.1.0"
},
{
"model": "powerkvm",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "3.1"
},
{
"model": "powerkvm",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "2.1"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "nginx",
"scope": "ne",
"trust": 0.3,
"vendor": "nginx",
"version": "1.9.10"
},
{
"model": "nginx",
"scope": "ne",
"trust": 0.3,
"vendor": "nginx",
"version": "1.8.1"
}
],
"sources": [
{
"db": "BID",
"id": "82230"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-001780"
},
{
"db": "NVD",
"id": "CVE-2016-0747"
},
{
"db": "CNNVD",
"id": "CNNVD-201602-059"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.8.1",
"versionStartIncluding": "0.6.18",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.9.10",
"versionStartIncluding": "1.9.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2016-0747"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The vendor reported this issue.",
"sources": [
{
"db": "BID",
"id": "82230"
}
],
"trust": 0.3
},
"cve": "CVE-2016-0747",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2016-0747",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-88257",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2016-0747",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201602-059",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-88257",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2016-0747",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-88257"
},
{
"db": "VULMON",
"id": "CVE-2016-0747"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-001780"
},
{
"db": "NVD",
"id": "CVE-2016-0747"
},
{
"db": "CNNVD",
"id": "CNNVD-201602-059"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution. nginx is prone to multiple denial-of-service vulnerabilities. \nAttackers can exploit these issues to cause denial-of-service conditions. There is a security vulnerability in the resolver of nginx versions prior to 1.8.1 and versions 1.9.x prior to 1.9.10. The vulnerability stems from the fact that the program does not limit CNAME resolution. These only affect nginx if\nthe \"resolver\" directive is used in a configuration file. \n\nFor the oldstable distribution (wheezy), these problems have been fixed\nin version 1.2.1-2.2+wheezy4. \n\nFor the stable distribution (jessie), these problems have been fixed in\nversion 1.6.2-5+deb8u1. \n\nFor the testing distribution (stretch), these problems have been fixed\nin version 1.9.10-1. \n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.9.10-1. \n\nWe recommend that you upgrade your nginx packages. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Moderate: rh-nginx18-nginx security update\nAdvisory ID: RHSA-2016:1425-01\nProduct: Red Hat Software Collections\nAdvisory URL: https://access.redhat.com/errata/RHSA-2016:1425\nIssue date: 2016-07-14\nCVE Names: CVE-2016-0742 CVE-2016-0746 CVE-2016-0747 \n CVE-2016-4450 \n=====================================================================\n\n1. Summary:\n\nAn update for rh-nginx18-nginx is now available for Red Hat Software\nCollections. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64\n\n3. Description:\n\nNginx is a web and proxy server with a focus on high concurrency,\nperformance, and low memory usage. \n\nThe following packages have been upgraded to a newer upstream version:\nrh-nginx18-nginx (1.8.1). \n\nSecurity Fix(es):\n\n* A NULL pointer dereference flaw was found in the nginx code responsible\nfor saving client request body to a temporary file. A remote attacker could\nsend a specially crafted request that would cause nginx worker process to\ncrash. (CVE-2016-4450)\n\n* It was discovered that nginx could perform an out of bound read and\ndereference an invalid pointer when resolving CNAME DNS records. An\nattacker able to manipulate DNS responses received by nginx could use this\nflaw to cause a worker process to crash if nginx enabled the resolver in\nits configuration. (CVE-2016-0742)\n\n* A use-after-free flaw was found in the way nginx resolved certain CNAME\nDNS records. \n(CVE-2016-0746)\n\n* It was discovered that nginx did not limit recursion when resolving CNAME\nDNS records. \n(CVE-2016-0747)\n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe rh-nginx18-nginx service must be restarted for this update to take\neffect. \n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1302587 - CVE-2016-0742 nginx: invalid pointer dereference in resolver\n1302588 - CVE-2016-0746 nginx: use-after-free during CNAME response processing in resolver\n1302589 - CVE-2016-0747 nginx: Insufficient limits of CNAME resolution in resolver\n1341462 - CVE-2016-4450 nginx: NULL pointer dereference while writing client request body\n\n6. Package List:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):\n\nSource:\nrh-nginx18-nginx-1.8.1-1.el6.src.rpm\n\nx86_64:\nrh-nginx18-nginx-1.8.1-1.el6.x86_64.rpm\nrh-nginx18-nginx-debuginfo-1.8.1-1.el6.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6):\n\nSource:\nrh-nginx18-nginx-1.8.1-1.el6.src.rpm\n\nx86_64:\nrh-nginx18-nginx-1.8.1-1.el6.x86_64.rpm\nrh-nginx18-nginx-debuginfo-1.8.1-1.el6.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):\n\nSource:\nrh-nginx18-nginx-1.8.1-1.el6.src.rpm\n\nx86_64:\nrh-nginx18-nginx-1.8.1-1.el6.x86_64.rpm\nrh-nginx18-nginx-debuginfo-1.8.1-1.el6.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nrh-nginx18-nginx-1.8.1-1.el6.src.rpm\n\nx86_64:\nrh-nginx18-nginx-1.8.1-1.el6.x86_64.rpm\nrh-nginx18-nginx-debuginfo-1.8.1-1.el6.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):\n\nSource:\nrh-nginx18-nginx-1.8.1-1.el7.src.rpm\n\nx86_64:\nrh-nginx18-nginx-1.8.1-1.el7.x86_64.rpm\nrh-nginx18-nginx-debuginfo-1.8.1-1.el7.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1):\n\nSource:\nrh-nginx18-nginx-1.8.1-1.el7.src.rpm\n\nx86_64:\nrh-nginx18-nginx-1.8.1-1.el7.x86_64.rpm\nrh-nginx18-nginx-debuginfo-1.8.1-1.el7.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2):\n\nSource:\nrh-nginx18-nginx-1.8.1-1.el7.src.rpm\n\nx86_64:\nrh-nginx18-nginx-1.8.1-1.el7.x86_64.rpm\nrh-nginx18-nginx-debuginfo-1.8.1-1.el7.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nrh-nginx18-nginx-1.8.1-1.el7.src.rpm\n\nx86_64:\nrh-nginx18-nginx-1.8.1-1.el7.x86_64.rpm\nrh-nginx18-nginx-debuginfo-1.8.1-1.el7.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2016-0742\nhttps://access.redhat.com/security/cve/CVE-2016-0746\nhttps://access.redhat.com/security/cve/CVE-2016-0747\nhttps://access.redhat.com/security/cve/CVE-2016-4450\nhttps://access.redhat.com/security/updates/classification/#moderate\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2016 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niD8DBQFXhy2gXlSAg2UNWIIRAjOgAJ9QjuFMrvK50IeJq8Ky7VkefuMBUwCeM+Cp\nZhbDRXs2sdXbnakZ6oJi/K8=\n=7RBd\n-----END PGP SIGNATURE-----\n\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201606-06\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n Title: nginx: Multiple vulnerabilities\n Date: June 17, 2016\n Bugs: #560854, #573046, #584744\n ID: 201606-06\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in nginx, the worst of which\nmay allow a remote attacker to cause a Denial of Service. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 www-servers/nginx \u003c 1.10.1 \u003e= 1.10.1\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in nginx. Please review\nthe CVE identifiers referenced below for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll nginx users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=www-servers/nginx-1.10.1\"\n\nReferences\n==========\n\n[ 1 ] CVE-2013-3587\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3587\n[ 2 ] CVE-2016-0742\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0742\n[ 3 ] CVE-2016-0746\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0746\n[ 4 ] CVE-2016-0747\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0747\n[ 5 ] CVE-2016-4450\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4450\n[ 6 ] CVE-2016-4450\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4450\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/201606-06\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2016 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n. ============================================================================\nUbuntu Security Notice USN-2892-1\nFebruary 09, 2016\n\nnginx vulnerabilities\n============================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 15.10\n- Ubuntu 14.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in nginx. \n(CVE-2016-0747)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 15.10:\n nginx-core 1.9.3-1ubuntu1.1\n nginx-extras 1.9.3-1ubuntu1.1\n nginx-full 1.9.3-1ubuntu1.1\n nginx-light 1.9.3-1ubuntu1.1\n\nUbuntu 14.04 LTS:\n nginx-core 1.4.6-1ubuntu3.4\n nginx-extras 1.4.6-1ubuntu3.4\n nginx-full 1.4.6-1ubuntu3.4\n nginx-light 1.4.6-1ubuntu3.4\n nginx-naxsi 1.4.6-1ubuntu3.4\n\nIn general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2021-09-20-4 Xcode 13\n\nXcode 13 addresses the following issues. \n\nIDE Xcode Server\nAvailable for: macOS Big Sur 11.3 and later\nImpact: Multiple issues in nginx\nDescription: Multiple issues were addressed by updating nginx to\nversion 1.21.0. \nCVE-2016-0742\nCVE-2016-0746\nCVE-2016-0747\nCVE-2017-7529\nCVE-2018-16843\nCVE-2018-16844\nCVE-2018-16845\nCVE-2019-20372\n\nInstallation note:\n\nXcode 13 may be obtained from:\n\nhttps://developer.apple.com/xcode/downloads/\n\nTo check that the Xcode has been updated:\n\n* Select Xcode in the menu bar\n* Select About Xcode\n* The version after applying this update will be \"Xcode 13\"",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-0747"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-001780"
},
{
"db": "BID",
"id": "82230"
},
{
"db": "VULHUB",
"id": "VHN-88257"
},
{
"db": "VULMON",
"id": "CVE-2016-0747"
},
{
"db": "PACKETSTORM",
"id": "135738"
},
{
"db": "PACKETSTORM",
"id": "137908"
},
{
"db": "PACKETSTORM",
"id": "137518"
},
{
"db": "PACKETSTORM",
"id": "135684"
},
{
"db": "PACKETSTORM",
"id": "164240"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-0747",
"trust": 3.4
},
{
"db": "SECTRACK",
"id": "1034869",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2016-001780",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201602-059",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "164240",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2021.3157",
"trust": 0.6
},
{
"db": "BID",
"id": "82230",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-88257",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2016-0747",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "135738",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "137908",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "137518",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "135684",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-88257"
},
{
"db": "VULMON",
"id": "CVE-2016-0747"
},
{
"db": "BID",
"id": "82230"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-001780"
},
{
"db": "PACKETSTORM",
"id": "135738"
},
{
"db": "PACKETSTORM",
"id": "137908"
},
{
"db": "PACKETSTORM",
"id": "137518"
},
{
"db": "PACKETSTORM",
"id": "135684"
},
{
"db": "PACKETSTORM",
"id": "164240"
},
{
"db": "NVD",
"id": "CVE-2016-0747"
},
{
"db": "CNNVD",
"id": "CNNVD-201602-059"
}
]
},
"id": "VAR-201602-0391",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-88257"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:08:16.477000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "DSA-3473",
"trust": 0.8,
"url": "http://www.debian.org/security/2016/dsa-3473"
},
{
"title": "openSUSE-SU-2016:0371",
"trust": 0.8,
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html"
},
{
"title": "Bug 1302589",
"trust": 0.8,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302589"
},
{
"title": "USN-2892-1",
"trust": 0.8,
"url": "http://www.ubuntu.com/usn/usn-2892-1/"
},
{
"title": "CVE-2016-0742, CVE-2016-0746, CVE-2016-0747",
"trust": 0.8,
"url": "http://mailman.nginx.org/pipermail/nginx/2016-january/049700.html"
},
{
"title": "nginx resolver Remediation measures for denial of service vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=60056"
},
{
"title": "Ubuntu Security Notice: nginx vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-2892-1"
},
{
"title": "Red Hat: CVE-2016-0747",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=cve-2016-0747"
},
{
"title": "Debian CVElist Bug Report Logs: nginx: resolver CVEs: CVE-2016-0742 CVE-2016-0746 CVE-2016-0747",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=10ec4e6c24845a17d787b01f883e17a7"
},
{
"title": "Amazon Linux AMI: ALAS-2016-655",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=alas-2016-655"
},
{
"title": "Symantec Security Advisories: SA115 : Multiple nginx DNS resolver vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=symantec_security_advisories\u0026qid=4df1d4c41a5a305df81d1cff15b6d5a3"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2016-0747"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-001780"
},
{
"db": "CNNVD",
"id": "CNNVD-201602-059"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-400",
"trust": 1.1
},
{
"problemtype": "CWE-399",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-88257"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-001780"
},
{
"db": "NVD",
"id": "CVE-2016-0747"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "https://security.gentoo.org/glsa/201606-06"
},
{
"trust": 1.9,
"url": "https://access.redhat.com/errata/rhsa-2016:1425"
},
{
"trust": 1.9,
"url": "http://www.ubuntu.com/usn/usn-2892-1"
},
{
"trust": 1.8,
"url": "https://bto.bluecoat.com/security-advisory/sa115"
},
{
"trust": 1.8,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302589"
},
{
"trust": 1.8,
"url": "https://support.apple.com/kb/ht212818"
},
{
"trust": 1.8,
"url": "http://www.debian.org/security/2016/dsa-3473"
},
{
"trust": 1.8,
"url": "http://seclists.org/fulldisclosure/2021/sep/36"
},
{
"trust": 1.8,
"url": "http://mailman.nginx.org/pipermail/nginx/2016-january/049700.html"
},
{
"trust": 1.8,
"url": "http://www.securitytracker.com/id/1034869"
},
{
"trust": 1.8,
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-0747"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-0747"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-us/ht212818"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.3157"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/164240/apple-security-advisory-2021-09-20-4.html"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0746"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0747"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-0742"
},
{
"trust": 0.3,
"url": "http://nginx.org/"
},
{
"trust": 0.3,
"url": "http://mailman.nginx.org/pipermail/nginx-announce/2016/000169.html?_ga=1.10431541.1444954692.1454065053"
},
{
"trust": 0.3,
"url": "http://mailman.nginx.org/pipermail/nginx-announce/2016/000169.html?_ga=1.85903129.1444954692.1454065053"
},
{
"trust": 0.3,
"url": "http://mailman.nginx.org/pipermail/nginx-announce/2016/000169.html?_ga=1.107423490.1444954692.1454065053"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=isg3t1024237"
},
{
"trust": 0.3,
"url": "https://support.asperasoft.com/hc/en-us/articles/229846687-security-bulletin-multiple-vulnerabilities-with-the-nginx-web-server-used-in-ibm-aspera-shares-1-9-2-earlier"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4450"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/400.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://usn.ubuntu.com/2892-1/"
},
{
"trust": 0.1,
"url": "https://www.securityfocus.com/bid/82230"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-0742"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-0747"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-0746"
},
{
"trust": 0.1,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-4450"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-3587"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-0746"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-4450"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-0747"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-0742"
},
{
"trust": 0.1,
"url": "https://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/nginx/1.4.6-1ubuntu3.4"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/nginx/1.9.3-1ubuntu1.1"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-20372"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-16843"
},
{
"trust": 0.1,
"url": "https://support.apple.com/kb/ht201222"
},
{
"trust": 0.1,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-16845"
},
{
"trust": 0.1,
"url": "https://developer.apple.com/xcode/downloads/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-16844"
},
{
"trust": 0.1,
"url": "https://support.apple.com/ht212818."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7529"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-88257"
},
{
"db": "VULMON",
"id": "CVE-2016-0747"
},
{
"db": "BID",
"id": "82230"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-001780"
},
{
"db": "PACKETSTORM",
"id": "135738"
},
{
"db": "PACKETSTORM",
"id": "137908"
},
{
"db": "PACKETSTORM",
"id": "137518"
},
{
"db": "PACKETSTORM",
"id": "135684"
},
{
"db": "PACKETSTORM",
"id": "164240"
},
{
"db": "NVD",
"id": "CVE-2016-0747"
},
{
"db": "CNNVD",
"id": "CNNVD-201602-059"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-88257"
},
{
"db": "VULMON",
"id": "CVE-2016-0747"
},
{
"db": "BID",
"id": "82230"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-001780"
},
{
"db": "PACKETSTORM",
"id": "135738"
},
{
"db": "PACKETSTORM",
"id": "137908"
},
{
"db": "PACKETSTORM",
"id": "137518"
},
{
"db": "PACKETSTORM",
"id": "135684"
},
{
"db": "PACKETSTORM",
"id": "164240"
},
{
"db": "NVD",
"id": "CVE-2016-0747"
},
{
"db": "CNNVD",
"id": "CNNVD-201602-059"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-02-15T00:00:00",
"db": "VULHUB",
"id": "VHN-88257"
},
{
"date": "2016-02-15T00:00:00",
"db": "VULMON",
"id": "CVE-2016-0747"
},
{
"date": "2016-01-29T00:00:00",
"db": "BID",
"id": "82230"
},
{
"date": "2016-03-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-001780"
},
{
"date": "2016-02-12T19:22:00",
"db": "PACKETSTORM",
"id": "135738"
},
{
"date": "2016-07-14T20:08:00",
"db": "PACKETSTORM",
"id": "137908"
},
{
"date": "2016-06-17T23:50:23",
"db": "PACKETSTORM",
"id": "137518"
},
{
"date": "2016-02-10T03:55:35",
"db": "PACKETSTORM",
"id": "135684"
},
{
"date": "2021-09-22T16:28:58",
"db": "PACKETSTORM",
"id": "164240"
},
{
"date": "2016-02-15T19:59:02.123000",
"db": "NVD",
"id": "CVE-2016-0747"
},
{
"date": "2016-01-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201602-059"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-11-10T00:00:00",
"db": "VULHUB",
"id": "VHN-88257"
},
{
"date": "2021-09-22T00:00:00",
"db": "VULMON",
"id": "CVE-2016-0747"
},
{
"date": "2016-10-26T00:01:00",
"db": "BID",
"id": "82230"
},
{
"date": "2016-03-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-001780"
},
{
"date": "2021-12-16T18:43:52.677000",
"db": "NVD",
"id": "CVE-2016-0747"
},
{
"date": "2023-05-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201602-059"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "137908"
},
{
"db": "PACKETSTORM",
"id": "137518"
},
{
"db": "PACKETSTORM",
"id": "135684"
},
{
"db": "CNNVD",
"id": "CNNVD-201602-059"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "nginx Service disruption in other resolvers (DoS) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-001780"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "resource management error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201602-059"
}
],
"trust": 0.6
}
}
gsd-2016-0747
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2016-0747",
"description": "The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.",
"id": "GSD-2016-0747",
"references": [
"https://www.suse.com/security/cve/CVE-2016-0747.html",
"https://www.debian.org/security/2016/dsa-3473",
"https://access.redhat.com/errata/RHSA-2016:1425",
"https://ubuntu.com/security/CVE-2016-0747",
"https://advisories.mageia.org/CVE-2016-0747.html",
"https://alas.aws.amazon.com/cve/html/CVE-2016-0747.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2016-0747"
],
"details": "The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.",
"id": "GSD-2016-0747",
"modified": "2023-12-13T01:21:17.570219Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2016-0747",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:0371",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html"
},
{
"name": "https://bto.bluecoat.com/security-advisory/sa115",
"refsource": "CONFIRM",
"url": "https://bto.bluecoat.com/security-advisory/sa115"
},
{
"name": "GLSA-201606-06",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201606-06"
},
{
"name": "1034869",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1034869"
},
{
"name": "[nginx] 20160126 nginx security advisory (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747)",
"refsource": "MLIST",
"url": "http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html"
},
{
"name": "RHSA-2016:1425",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2016:1425"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1302589",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302589"
},
{
"name": "DSA-3473",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3473"
},
{
"name": "USN-2892-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-2892-1"
},
{
"name": "https://support.apple.com/kb/HT212818",
"refsource": "CONFIRM",
"url": "https://support.apple.com/kb/HT212818"
},
{
"name": "20210921 APPLE-SA-2021-09-20-4 Xcode 13",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2021/Sep/36"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.8.1",
"versionStartIncluding": "0.6.18",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.9.10",
"versionStartIncluding": "1.9.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2016-0747"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:0371",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1302589",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302589"
},
{
"name": "USN-2892-1",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-2892-1"
},
{
"name": "[nginx] 20160126 nginx security advisory (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747)",
"refsource": "MLIST",
"tags": [
"Vendor Advisory"
],
"url": "http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html"
},
{
"name": "DSA-3473",
"refsource": "DEBIAN",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3473"
},
{
"name": "https://bto.bluecoat.com/security-advisory/sa115",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://bto.bluecoat.com/security-advisory/sa115"
},
{
"name": "1034869",
"refsource": "SECTRACK",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1034869"
},
{
"name": "GLSA-201606-06",
"refsource": "GENTOO",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201606-06"
},
{
"name": "RHSA-2016:1425",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2016:1425"
},
{
"name": "https://support.apple.com/kb/HT212818",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/kb/HT212818"
},
{
"name": "20210921 APPLE-SA-2021-09-20-4 Xcode 13",
"refsource": "FULLDISC",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2021/Sep/36"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM"
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
},
"lastModifiedDate": "2021-12-16T18:43Z",
"publishedDate": "2016-02-15T19:59Z"
}
}
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.