CVE-2018-16845

CWE-400 — Uncontrolled Resource ConsumptionCWE-835CWE-19113 documents9 sources
Severity
6.1MEDIUM
EPSS
6.3%
top 9.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Apple XcodeF5 Nginx[unknown] Nginx+3 more
Timeline
PublishedNov 7
Latest updateMay 13

Description

nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:HExploitability: 1.8 | Impact: 4.2

Affected Packages5 packages

▶Debiannginx< 1.14.1-1+3
▶NVDf5/nginx1.0.7 — 1.0.15+1
▶CVEListV5[unknown]/nginx1.14.1, 1.15.6+1
▶NVDapple/xcode< 13.0
▶NVDopensuse/leap15.1

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 14.04, 16.04, 18.04, 18.10

Patches

Patch: mailman.nginx.org ↗Patch: usn.ubuntu.com ↗Patch: mailman.nginx.org ↗

🔴Vulnerability Details

4
GHSA
GHSA-vq5f-vpgw-9vcp: nginx before versions 1↗2022-05-13
▶
OSV
CVE-2018-16845: nginx before versions 1↗2018-11-07
▶
CVEList
CVE-2018-16845: nginx before versions 1↗2018-11-07
▶
OSV
qemu vulnerabilities↗2018-05-16
▶

📋Vendor Advisories

4
Apple
CVE-2018-16845: Xcode 13↗2021-09-20
▶
Ubuntu
nginx vulnerabilities↗2018-11-07
▶
Red Hat
nginx: Denial of service and memory disclosure via mp4 module↗2018-11-06
▶
Debian
CVE-2018-16845: nginx - nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_mod...↗2018
▶

💬Community

4
Bugzilla
CVE-2018-16845 nginx: Denial of service and memory disclosure via mp4 module [epel-all]↗2018-11-07
▶
Bugzilla
CVE-2018-16845 nginx: Denial of service and memory disclosure via mp4 module [fedora-all]↗2018-11-07
▶
Bugzilla
CVE-2018-16845 nginx: Denial of service and memory disclosure via mp4 module↗2018-10-31
▶
Bugzilla
CVE-2017-16845 Qemu: ps2: information leakage via post_load routine↗2017-11-16
▶