[CVE-2016-4450] NULL pointer dereference while writing client request body
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| nginx (Debian) |
Fix Released
|
Unknown
|
|||
| nginx (Ubuntu) |
Fix Released
|
Undecided
|
Thomas Ward | ||
| Trusty |
Fix Released
|
Undecided
|
Unassigned | ||
| Vivid |
Won't Fix
|
Undecided
|
Unassigned | ||
| Wily |
Fix Released
|
Undecided
|
Unassigned | ||
| Xenial |
Fix Released
|
Undecided
|
Unassigned | ||
| Yakkety |
Fix Released
|
Undecided
|
Thomas Ward | ||
Bug Description
It was announced by NGINX on May 31, 2016 that there is a security update for NGINX. Patches are available as below.
This is CVE-2016-4450.
------
(http://
A problem was identified in nginx code responsible for saving
client request body to a temporary file. A specially crafted request
might result in worker process crash due to a NULL pointer dereference
while writing client request body to a temporary file (CVE-2016-4450).
The problem affects nginx 1.3.9 - 1.11.0.
The problem is fixed in nginx 1.11.1, 1.10.1.
Patch for nginx 1.9.13 - 1.11.0 can be found here:
http://
Patch for older nginx versions (1.3.9 - 1.9.12):
http://
------
Trusty, Vivid, Wily, Xenial, and Yakkety are affected, based on the NGINX upstream reported 'affected versions'.
CVE References
| description: | updated |
| Changed in nginx (Ubuntu Xenial): | |
| status: | New → Confirmed |
| Changed in nginx (Ubuntu Wily): | |
| status: | New → Confirmed |
| Changed in nginx (Ubuntu Vivid): | |
| status: | New → Confirmed |
| Changed in nginx (Ubuntu Trusty): | |
| status: | New → Confirmed |
| Changed in nginx (Ubuntu Yakkety): | |
| assignee: | nobody → Thomas Ward (teward) |
| summary: |
- Security Advisory - May 31 2016 + Security Advisory - May 31 2016 - CVE-2016-4450 |
| description: | updated |
| Changed in nginx (Ubuntu Yakkety): | |
| status: | Confirmed → In Progress |
| summary: |
- Security Advisory - May 31 2016 - CVE-2016-4450 + [CVE-2016-4450] NULL pointer dereference while writing client request + body |
| Changed in nginx (Ubuntu Yakkety): | |
| status: | In Progress → Fix Committed |
| Thomas Ward (teward) wrote | #1 |
| tags: | added: patch |
| Thomas Ward (teward) wrote | #2 |
| Thomas Ward (teward) wrote | #3 |
| Changed in nginx (Ubuntu Vivid): | |
| status: | Confirmed → Won't Fix |
| Thomas Ward (teward) wrote | #4 |
| Changed in nginx (Debian): | |
| status: | Unknown → Fix Released |
| Launchpad Janitor (janitor) wrote | #5 |
| Changed in nginx (Ubuntu Yakkety): | |
| status: | Fix Committed → Fix Released |
| Marc Deslauriers (mdeslaur) wrote | #6 |
| Launchpad Janitor (janitor) wrote | #7 |
| Changed in nginx (Ubuntu Xenial): | |
| status: | Confirmed → Fix Released |
| Launchpad Janitor (janitor) wrote | #8 |
| Changed in nginx (Ubuntu Trusty): | |
| status: | Confirmed → Fix Released |
| Launchpad Janitor (janitor) wrote | #9 |
| Changed in nginx (Ubuntu Wily): | |
| status: | Confirmed → Fix Released |
Xenial debdiff. Build tests completed in https:/