[SECURITY] [DLA 404-1] nginx security update

2016-01-2709:38:31

lists.debian.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

8.6

Confidence

High

EPSS

0.871

Percentile

98.6%

JSON

Package : nginx
Version : 0.7.67-3+squeeze4+deb6u1
CVE ID : CVE-2016-0742
Debian Bug : 812806

It was discovered that there was a invalid pointer deference in nginx, a
small, powerful, scalable web/proxy server. An invalid pointer
dereference might occur during DNS server response processing, allowing
an attacker who is able to forge UDP packets from the DNS server to cause
worker process crash

For Debian 6 Squeeze, this issue has been fixed in nginx version
0.7.67-3+squeeze4+deb6u1.

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian7mipsnginx-full-dbg< 1.2.1-2.2+wheezy4nginx-full-dbg_1.2.1-2.2+wheezy4_mips.deb
Debian8ppc64elnginx-light-dbg< 1.6.2-5+deb8u1nginx-light-dbg_1.6.2-5+deb8u1_ppc64el.deb
Debian8kfreebsd-amd64nginx-extras-dbg< 1.6.2-5+deb8u1nginx-extras-dbg_1.6.2-5+deb8u1_kfreebsd-amd64.deb
Debian8mipsnginx-light-dbg< 1.6.2-5+deb8u1nginx-light-dbg_1.6.2-5+deb8u1_mips.deb
Debian7kfreebsd-i386nginx-naxsi-dbg< 1.2.1-2.2+wheezy4nginx-naxsi-dbg_1.2.1-2.2+wheezy4_kfreebsd-i386.deb
Debian7mipsnginx-extras< 1.2.1-2.2+wheezy4nginx-extras_1.2.1-2.2+wheezy4_mips.deb
Debian7armhfnginx-full< 1.2.1-2.2+wheezy4nginx-full_1.2.1-2.2+wheezy4_armhf.deb
Debian7mipselnginx-naxsi-dbg< 1.2.1-2.2+wheezy4nginx-naxsi-dbg_1.2.1-2.2+wheezy4_mipsel.deb
Debian7sparcnginx-naxsi< 1.2.1-2.2+wheezy4nginx-naxsi_1.2.1-2.2+wheezy4_sparc.deb
Debian7powerpcnginx-extras-dbg< 1.2.1-2.2+wheezy4nginx-extras-dbg_1.2.1-2.2+wheezy4_powerpc.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	mips	nginx-full-dbg	< 1.2.1-2.2+wheezy4	nginx-full-dbg_1.2.1-2.2+wheezy4_mips.deb
Debian	8	ppc64el	nginx-light-dbg	< 1.6.2-5+deb8u1	nginx-light-dbg_1.6.2-5+deb8u1_ppc64el.deb
Debian	8	kfreebsd-amd64	nginx-extras-dbg	< 1.6.2-5+deb8u1	nginx-extras-dbg_1.6.2-5+deb8u1_kfreebsd-amd64.deb
Debian	8	mips	nginx-light-dbg	< 1.6.2-5+deb8u1	nginx-light-dbg_1.6.2-5+deb8u1_mips.deb
Debian	7	kfreebsd-i386	nginx-naxsi-dbg	< 1.2.1-2.2+wheezy4	nginx-naxsi-dbg_1.2.1-2.2+wheezy4_kfreebsd-i386.deb
Debian	7	mips	nginx-extras	< 1.2.1-2.2+wheezy4	nginx-extras_1.2.1-2.2+wheezy4_mips.deb
Debian	7	armhf	nginx-full	< 1.2.1-2.2+wheezy4	nginx-full_1.2.1-2.2+wheezy4_armhf.deb
Debian	7	mipsel	nginx-naxsi-dbg	< 1.2.1-2.2+wheezy4	nginx-naxsi-dbg_1.2.1-2.2+wheezy4_mipsel.deb
Debian	7	sparc	nginx-naxsi	< 1.2.1-2.2+wheezy4	nginx-naxsi_1.2.1-2.2+wheezy4_sparc.deb
Debian	7	powerpc	nginx-extras-dbg	< 1.2.1-2.2+wheezy4	nginx-extras-dbg_1.2.1-2.2+wheezy4_powerpc.deb