CVE-2018-16845

NameCVE-2018-16845
Descriptionnginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1572-1, DSA-4335-1
Debian Bugs913090

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nginx (PTS)jessie1.6.2-5+deb8u5vulnerable
jessie (security)1.6.2-5+deb8u6fixed
stretch1.10.3-1+deb9u1vulnerable
stretch (security)1.10.3-1+deb9u2fixed
buster1.14.1-1fixed
sid1.14.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nginxsource(unstable)1.14.1-1913090
nginxsourcejessie1.6.2-5+deb8u6DLA-1572-1
nginxsourcestretch1.10.3-1+deb9u2DSA-4335-1

Notes

http://mailman.nginx.org/pipermail/nginx-announce/2018/000221.html
https://nginx.org/download/patch.2018.mp4.txt
http://hg.nginx.org/nginx/rev/fdc19a3289c1
Fixed in 1.15.6, 1.14.1.

Search for package or bug name: Reporting problems