CVE-2016-4450

2016-05-3100:00:00

ubuntu.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.022 Low

EPSS

Percentile

89.4%

JSON

os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows
remote attackers to cause a denial of service (NULL pointer dereference and
worker process crash) via a crafted request, involving writing a client
request body to a temporary file.

Bugs

<https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/1587577>

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchnginx< 1.4.6-1ubuntu3.5UNKNOWN
ubuntu15.10noarchnginx< 1.9.3-1ubuntu1.2UNKNOWN
ubuntu16.04noarchnginx< 1.10.0-0ubuntu0.16.04.2UNKNOWN
ubuntu16.10noarchnginx< 1.10.1-0ubuntu1UNKNOWN
ubuntu17.04noarchnginx< 1.10.1-0ubuntu1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	nginx	< 1.4.6-1ubuntu3.5	UNKNOWN
ubuntu	15.10	noarch	nginx	< 1.9.3-1ubuntu1.2	UNKNOWN
ubuntu	16.04	noarch	nginx	< 1.10.0-0ubuntu0.16.04.2	UNKNOWN
ubuntu	16.10	noarch	nginx	< 1.10.1-0ubuntu1	UNKNOWN
ubuntu	17.04	noarch	nginx	< 1.10.1-0ubuntu1	UNKNOWN