A problem was identified in nginx code responsible for saving
client request body to a temporary file. A specially crafted request
might result in worker process crash due to a NULL pointer dereference
while writing client request body to a temporary file (CVE-2016-4450).
The problem affects nginx 1.3.9 - 1.11.0.
The problem is fixed in nginx 1.11.1, 1.10.1.
Patch for nginx 1.9.13 - 1.11.0 can be found here:
It was announced by NGINX on May 31, 2016 that there is a security update for NGINX.
------
(http:// mailman. nginx.org/ pipermail/ nginx-announce/ 2016/000179. html)
A problem was identified in nginx code responsible for saving
client request body to a temporary file. A specially crafted request
might result in worker process crash due to a NULL pointer dereference
while writing client request body to a temporary file (CVE-2016-4450).
The problem affects nginx 1.3.9 - 1.11.0.
The problem is fixed in nginx 1.11.1, 1.10.1.
Patch for nginx 1.9.13 - 1.11.0 can be found here:
http:// nginx.org/ download/ patch.2016. write.txt
Patch for older nginx versions (1.3.9 - 1.9.12):
http:// nginx.org/ download/ patch.2016. write2. txt
------
Trusty, Vivid, Wily, Xenial, and Yakkety are affected.