USN-5722-1: nginx vulnerabilities

It was discovered that nginx incorrectly handled certain memory operations in the ngxhttpmp4module module. A local attacker could possibly use this issue with a specially crafted mp4 file to cause nginx to crash, stop responding, or access arbitrary memory. CVE-2022-41741, CVE-2022-41742...

CVE-2022-3812

A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is the function AP4ContainerAtom::AP4ContainerAtom of the component mp4encrypt. The manipulation leads to memory leak. The attack may be launched remotely. The exploit has been disclosed to the...

UBUNTU-CVE-2022-3784

A vulnerability classified as critical was found in Axiomatic Bento4 5e7bb34. Affected by this vulnerability is the function AP4Mp4AudioDsiParser::ReadBits of the file Ap4Mp4AudioInfo.cpp of the component mp4hls. The manipulation leads to heap-based buffer overflow. The attack can be launched...

OESA-2022-2023 nginx security update

NGINX is a free, open-source, high-performance HTTP server and reverse proxy,as well as an IMAP/POP3 proxy server. Security Fixes: NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1...

Updated nginx packages fix security vulnerability

Two security issues were identified in the ngxhttpmp4module, which might allow an attacker to cause a worker process crash or worker process memory disclosure by using a specially crafted mp4 file, or might have potential other impact. CVE-2022-41741, CVE-2022-41742...

Mageia: Security Advisory (MGASA-2022-0398)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Bento4 缓冲区错误漏洞

Bento4 is an open source C++ library for reading and writing MP4 files. A security vulnerability exists in Bento4 that stems from the presence of a heap-based buffer overflow problem...

nginx 1.1.x < 1.23.2 / 1.0.x < 1.22.1 Memory Disclosure

The installed version of nginx is 1.0.x prior to 1.22.1 or 1.1.x prior to 1.23.2. It is, therefore, affected by a memory disclosure in the ngxhttpmp4module that allows an attacker to cause a worker process crash or worker process memory disclosure. The issues only affect nginx if it is built with...

Bento4 缓冲区错误漏洞

Bento4 is an open source C++ library for reading and writing MP4 files. A security vulnerability exists in Axiomatic Bento4 that stems from the presence of a heap-based buffer overflow issue...

NGINX ngx_http_mp4_module vulnerability CVE-2022-41742

...

The vulnerability of the ngx_http_mp4_module in the NGINX open-source server allows a attacker to cause a service failure or possibly exert other effects.

The vulnerability of the ngxhttpmp4module in the NGINX open-source HTTP server is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to cause service failures or potentially have other adverse effects...

The vulnerability of the ngx_http_mp4_module in NGINX Open Source HTTP servers allows attackers to expose sensitive information or cause service failures. NGINX Open Source Subscription, NGINX Plus, and NGINX Ingress Controller platforms for application monitoring and management provide solutions to address this issue.

The vulnerability of the ngxhttpmp4module in NGINX Open Source HTTP servers, NGINX Open Source Subscription, NGINX Plus, and NGINX Ingress Controller platforms is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow attackers to disclose...

Bento4 AP4_BitReader::ReadCache function denial of service vulnerability

Bento4 is an open source C library for reading and writing MP4 files. Bento4 v1.6.0-639 contains a denial of service vulnerability that stems from a boundary error in the AP4BitReader::ReadCache function in mp42ts when handling untrusted input. An attacker could exploit the vulnerability to launc...

Bento4 AP4_BitReader::SkipBits function denial of service vulnerability

Bento4 is an open source C library for reading and writing MP4 files. Bento4 v1.6.0-639 contains a denial of service vulnerability that stems from a boundary error in the AP4BitReader::SkipBitsunsigned int function in mp42ts when handling untrusted input. An attacker could exploit the vulnerabili...

Bento4 AP4_HdlrAtom::AP4_HdlrAtom function denial of service vulnerability

Bento4 is an open source C library for reading and writing MP4 files. version v1.6.0-639 of Bento4 suffers from a denial of service vulnerability that stems from a boundary error in the component AP4HdlrAtom::AP4HdlrAtom when handling untrusted input. An attacker could exploit the vulnerability t...

DEBIAN-CVE-2022-41742

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngxhttpmp4module that might allow a local attacker to cause a worker process crash, or might...

DEBIAN-CVE-2022-41741

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngxhttpmp4module that might allow a local attacker to corrupt NGINX worker memory, resulting in...

ALPINE-CVE-2022-41742

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngxhttpmp4module that might allow a local attacker to cause a worker process crash, or might...

AZL-11320 CVE-2022-41741 affecting package nginx for versions less than 1.22.1-1

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngxhttpmp4module that might allow a local attacker to corrupt NGINX worker memory, resulting in...

ALPINE-CVE-2022-41741

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngxhttpmp4module that might allow a local attacker to corrupt NGINX worker memory, resulting in...