Homepage
About Snyk

Out-of-bounds Write Affecting nginx package, versions <1.14.2-2+deb10u5

0.0
high

Snyk CVSS

    Attack Complexity Low
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    EPSS 0.04% (6th percentile)
Expand this section
NVD
7.8 high
Expand this section
SUSE
7.5 high
Expand this section
Red Hat
7.8 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN10-NGINX-3112367
  • published 11 Nov 2022
  • disclosed 19 Oct 2022
Report a new vulnerability Found a mistake?

Introduced: 19 Oct 2022

CVE-2022-41741 Open this link in a new tab
CWE-787 Open this link in a new tab

How to fix?

Upgrade Debian:10 nginx to version 1.14.2-2+deb10u5 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nginx package and not the nginx package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.

References