USN-3812-1

Dashboard / Vulnerabilities / USN-3812-1

USN-3812-1

Summary: nginx vulnerabilities

Details: It was discovered that nginx incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to cause excessive memory consumption, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-16843) Gal Goldshtein discovered that nginx incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to cause excessive CPU usage, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-16844) It was discovered that nginx incorrectly handled the ngx_http_mp4_module module. A remote attacker could possibly use this issue with a specially crafted mp4 file to cause nginx to crash, stop responding, or access arbitrary memory. (CVE-2018-16845)

References: https://ubuntu.com/security/notices/USN-3812-1, https://ubuntu.com/security/CVE-2018-16843, https://ubuntu.com/security/CVE-2018-16844, https://ubuntu.com/security/CVE-2018-16845