CVE-2016-4450

    Dashboard / Vulnerabilities / CVE-2016-4450

    CVE-2016-4450

    Published: 7 Jun 2016Last Modified: 8 Jul 2026

    Summary:

    Details: os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.

    References: http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html, http://www.debian.org/security/2016/dsa-3592, http://www.securityfocus.com/bid/90967, http://www.securitytracker.com/id/1036019, http://www.ubuntu.com/usn/USN-2991-1, https://access.redhat.com/errata/RHSA-2016:1425, https://security.gentoo.org/glsa/201606-06

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ea235785cd3caec4cf50c61a514fbed3c21f7c6e
    Fixed -e32426747fa56ab92dd6b5432ee57c912413e46a

    Affected versions

    1.11.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2016-4450 | CVE-DB