CVE-2016-0742
Fixed in a distro release EPSS 82%
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.
Products: f5 nginx, canonical ubuntu_linux, debian_linux, opensuse leap, apple xcode, redhat software_collections
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | nginx | 1.9.10-1 |
| Debian 13 | nginx | 1.9.10-1 |
| Debian 14 | nginx | 1.9.10-1 |
| Debian 6.0 | nginx | 0.7.67-3+squeeze4+deb6u1 |
| Debian 7 | nginx | 1.2.1-2.2+wheezy4 |
| Debian 8 | nginx | 1.6.2-5+deb8u1 |
| Red Hat rhel software collections 2 | rh-nginx18-nginx | 1:1.8.1-1.el7 |
| Red Hat rhel software collections 2 | rh-nginx18-nginx | 1:1.8.1-1.el6 |
| Red Hat rhel software collections 2 | rh-nginx18-nginx-debuginfo | 1:1.8.1-1.el6 |
| Red Hat rhel software collections 2 | rh-nginx18-nginx-debuginfo | 1:1.8.1-1.el7 |
| SUSE Lifecycle Management Server 1.3 | GeoIP | 1.4.7-2.10.1 |
| SUSE Lifecycle Management Server 1.3 | nginx-1.0 | 1.0.15-0.29.2 |
| SUSE Studio Onsite 1.3 | GeoIP | 1.4.7-2.10.1 |
| SUSE Studio Onsite 1.3 | nginx-1.0 | 1.0.15-0.29.2 |
| SUSE WebYast 1.3 | GeoIP | 1.4.7-2.10.1 |
| SUSE WebYast 1.3 | nginx-1.0 | 1.0.15-0.29.2 |
| Ubuntu 14.04 LTS | nginx | 1.4.6-1ubuntu3.4 |
| Ubuntu 16.04 LTS | nginx | 1.9.10-0ubuntu1 |
| openSUSE Tumbleweed | nginx | 1.11.4-2.5 |