Published: 15/02/2016 Updated: 15/12/2021

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The resolver in nginx prior to 1.8.1 and 1.9.x prior to 1.9.10 allows remote malicious users to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.

Vulnerable Product	Search on Vulmon	Subscribe to Product
f5 nginx
canonical ubuntu linux 14.04
canonical ubuntu linux 15.10
debian debian linux 7.0
debian debian linux 8.0
debian debian linux 9.0
opensuse leap 42.1
apple xcode
redhat software collections 1.0

Several security issues were fixed in nginx ...

Debian Bug report logs - #812806 nginx: resolver CVEs: CVE-2016-0742 CVE-2016-0746 CVE-2016-0747 Package: src:nginx; Maintainer for src:nginx is Debian Nginx Maintainers <pkg-nginx-maintainers@alioth-listsdebiannet>; Reported by: Christos Trochalakis <yatiohi@ideopolisgr> Date: Tue, 26 Jan 2016 18:03:01 UTC Severi ...

It was discovered that nginx could perform an out of bound read and dereference an invalid pointer when resolving CNAME DNS records An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash if nginx enabled the resolver in its configuration (CVE-2016-0742) A use-after-free flaw was found ...

It was discovered that nginx could perform an out of bound read and dereference an invalid pointer when resolving CNAME DNS records An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash if nginx enabled the resolver in its configuration ...

CWE-476 http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html http://www.ubuntu.com/usn/USN-2892-1 https://bugzilla.redhat.com/show_bug.cgi?id=1302587 http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html http://www.debian.org/security/2016/dsa-3473 https://bto.bluecoat.com/security-advisory/sa115 http://www.securitytracker.com/id/1034869 https://security.gentoo.org/glsa/201606-06 https://access.redhat.com/errata/RHSA-2016:1425 https://support.apple.com/kb/HT212818 http://seclists.org/fulldisclosure/2021/Sep/36 https://usn.ubuntu.com/2892-1/https://nvd.nist.gov

CVE-2016-0742

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect