Multiple vulnerabilities in nginx
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2022-41741 CVE-2022-41742 |
| CWE-ID | CWE-125 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
nginx Server applications / Web servers |
| Vendor | NGINX |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Out-of-bounds read
EUVDB-ID: #VU68494
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2022-41741
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information or perform a denial of service attack.
The vulnerability exists due to a boundary condition within the ngx_http_mp4_module module when handling MP4 files. A remote attacker can pass a specially crafted file to the server, trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsnginx: 1.23.0 - 1.23.1, 1.22.0, 1.21.0 - 1.21.6, 1.20.0 - 1.20.2, 1.19.0 - 1.19.10, 1.18.0, 1.17.0 - 1.17.10, 1.16.0 - 1.16.1, 1.15.0 - 1.15.12, 1.14.0 - 1.14.2, 1.12.0 - 1.12.2, 1.11.0 - 1.11.13, 1.13.0 - 1.13.12, 1.10.0 - 1.10.3, 1.1.3 - 1.1.19, 1.0.7 - 1.0.15
CPE2.3 External links
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
2) Out-of-bounds read
EUVDB-ID: #VU68495
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2022-41742
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information or perform a denial of service attack.
The vulnerability exists due to a boundary condition within the ngx_http_mp4_module module when handling MP4 files. A remote attacker can pass a specially crafted file to the server, trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsnginx: 1.23.0 - 1.23.1, 1.22.0, 1.21.0 - 1.21.6, 1.20.0 - 1.20.2, 1.19.0 - 1.19.10, 1.18.0, 1.17.0 - 1.17.10, 1.16.0 - 1.16.1, 1.15.0 - 1.15.12, 1.14.0 - 1.14.2, 1.12.0 - 1.12.2, 1.11.0 - 1.11.13, 1.13.0 - 1.13.12, 1.10.0 - 1.10.3, 1.1.3 - 1.1.19, 1.0.7 - 1.0.15
CPE2.3 External links
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
