p PatchFirst

CVE-2016-0747

CVE-2016-0747

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.

CVSS 5.3 · Medium · EPSS 8.7% · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • nginx Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.9.10-1

    Update to 1.9.10-1

  • nginx Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.9.10-1

    Update to 1.9.10-1

  • nginx Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.9.10-1

    Update to 1.9.10-1

  • nginx Ubuntu:14.04:LTS

    Versions
    • 1.4.1-3ubuntu1
    • 1.4.3-2ubuntu1
    • 1.4.4-1ubuntu1
    • 1.4.4-2ubuntu1
    • 1.4.4-4ubuntu1
    • 1.4.5-1ubuntu1
    • 1.4.6-1ubuntu2
    • 1.4.6-1ubuntu3
    • 1.4.6-1ubuntu3.1
    • 1.4.6-1ubuntu3.2
    • 1.4.6-1ubuntu3.3
    Affected ranges
    • ECOSYSTEM: < 1.4.6-1ubuntu3.4

    Update to 1.4.6-1ubuntu3.4

  • nginx Ubuntu:16.04:LTS

    Versions
    • 1.9.3-1ubuntu1
    • 1.9.6-2ubuntu1
    • 1.9.6-2ubuntu2
    • 1.9.9-0ubuntu1
    • 1.9.9-1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1.9.10-0ubuntu1

    Update to 1.9.10-0ubuntu1

Original sources

Check your server →