[SECURITY] [DLA 404-1] nginx security update

2016-01-2709:38:31

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.871 High

EPSS

Percentile

98.6%

JSON

Package : nginx
Version : 0.7.67-3+squeeze4+deb6u1
CVE ID : CVE-2016-0742
Debian Bug : 812806

It was discovered that there was a invalid pointer deference in nginx, a
small, powerful, scalable web/proxy server. An invalid pointer
dereference might occur during DNS server response processing, allowing
an attacker who is able to forge UDP packets from the DNS server to cause
worker process crash

For Debian 6 Squeeze, this issue has been fixed in nginx version
0.7.67-3+squeeze4+deb6u1.

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian8kfreebsd-i386nginx-extras-dbg< 1.6.2-5+deb8u1nginx-extras-dbg_1.6.2-5+deb8u1_kfreebsd-i386.deb
Debian7kfreebsd-i386nginx-naxsi-dbg< 1.2.1-2.2+wheezy4nginx-naxsi-dbg_1.2.1-2.2+wheezy4_kfreebsd-i386.deb
Debian7kfreebsd-i386nginx-full-dbg< 1.2.1-2.2+wheezy4nginx-full-dbg_1.2.1-2.2+wheezy4_kfreebsd-i386.deb
Debian7amd64nginx-extras-dbg< 1.2.1-2.2+wheezy4nginx-extras-dbg_1.2.1-2.2+wheezy4_amd64.deb
Debian7mipsnginx-light< 1.2.1-2.2+wheezy4nginx-light_1.2.1-2.2+wheezy4_mips.deb
Debian8kfreebsd-amd64nginx-extras-dbg< 1.6.2-5+deb8u1nginx-extras-dbg_1.6.2-5+deb8u1_kfreebsd-amd64.deb
Debian7armelnginx-full-dbg< 1.2.1-2.2+wheezy4nginx-full-dbg_1.2.1-2.2+wheezy4_armel.deb
Debian7kfreebsd-amd64nginx-full< 1.2.1-2.2+wheezy4nginx-full_1.2.1-2.2+wheezy4_kfreebsd-amd64.deb
Debian8armelnginx-full< 1.6.2-5+deb8u1nginx-full_1.6.2-5+deb8u1_armel.deb
Debian7s390nginx-naxsi< 1.2.1-2.2+wheezy4nginx-naxsi_1.2.1-2.2+wheezy4_s390.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	kfreebsd-i386	nginx-extras-dbg	< 1.6.2-5+deb8u1	nginx-extras-dbg_1.6.2-5+deb8u1_kfreebsd-i386.deb
Debian	7	kfreebsd-i386	nginx-naxsi-dbg	< 1.2.1-2.2+wheezy4	nginx-naxsi-dbg_1.2.1-2.2+wheezy4_kfreebsd-i386.deb
Debian	7	kfreebsd-i386	nginx-full-dbg	< 1.2.1-2.2+wheezy4	nginx-full-dbg_1.2.1-2.2+wheezy4_kfreebsd-i386.deb
Debian	7	amd64	nginx-extras-dbg	< 1.2.1-2.2+wheezy4	nginx-extras-dbg_1.2.1-2.2+wheezy4_amd64.deb
Debian	7	mips	nginx-light	< 1.2.1-2.2+wheezy4	nginx-light_1.2.1-2.2+wheezy4_mips.deb
Debian	8	kfreebsd-amd64	nginx-extras-dbg	< 1.6.2-5+deb8u1	nginx-extras-dbg_1.6.2-5+deb8u1_kfreebsd-amd64.deb
Debian	7	armel	nginx-full-dbg	< 1.2.1-2.2+wheezy4	nginx-full-dbg_1.2.1-2.2+wheezy4_armel.deb
Debian	7	kfreebsd-amd64	nginx-full	< 1.2.1-2.2+wheezy4	nginx-full_1.2.1-2.2+wheezy4_kfreebsd-amd64.deb
Debian	8	armel	nginx-full	< 1.6.2-5+deb8u1	nginx-full_1.6.2-5+deb8u1_armel.deb
Debian	7	s390	nginx-naxsi	< 1.2.1-2.2+wheezy4	nginx-naxsi_1.2.1-2.2+wheezy4_s390.deb