NGINX vulnerabilities

The nginx package before 1.6.2-5+deb8u3 on Debian jessie and earlier versions on Ubuntu and Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.

In nginx before 1.10.1 and 1.11.x before 1.11.1, a vulnerability allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.

The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service via an invalid pointer dereference, leading to a worker process crash.

Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request.

A vulnerability in the ngx_http_rewrite_module of NGINX Plus and NGINX Open Source occurs when a rewrite directive uses a regex pattern with overlapping PCRE captures and a replacement string referencing multiple captures. An unauthenticated attacker can send crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process, leading to a restart.

A vulnerability exists in NGINX Plus and NGINX Open Source within the ngx_http_rewrite_module. It occurs when the rewrite directive is followed by rewrite, if, or set directives and an unnamed PCRE capture (e.g., $1, $2) with a replacement string containing a question mark (?). An unauthenticated attacker can send crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process, leading to a restart.

A vulnerability in the NGINX ngx_http_dav_module allows an attacker to trigger a buffer overflow in the NGINX worker process. The issue occurs when the configuration uses MOVE or COPY methods with alias directives and prefix locations.

A use-after-free vulnerability in the resolver in nginx versions 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.

A vulnerability exists in NGINX Plus and NGINX Open Source within the ngx_http_slice_module module. When the slice directive with unnamed regex captures is configured or during a background cache update, unauthenticated attackers can send requests causing uninitialized memory access in the NGINX worker process, leading to limited memory disclosure or a restart.

A vulnerability exists in NGINX Plus and NGINX Open Source within the ngx_http_ssi_module module. This issue occurs when Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. An unauthenticated attacker with man-in-the-middle (MITM) capability to control upstream server responses may trigger a use-after-free in the NGINX worker process.

A vulnerability in NGINX Plus and NGINX Open Source occurs when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can send crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process, leading to a restart or potential code execution.

Heap-based buffer overflow in NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module. Specific configuration conditions and large headers can cause NGINX worker process crash, and in some cases allow code execution.

In NGINX Plus and NGINX Open Source with the HTTP/3 QUIC module enabled, an attacker can spoof their source IP address, bypassing authorization or rate limiting.

A vulnerability in the ngx_http_mp4_module module of NGINX allows an attacker to trigger a buffer over-read or over-write in NGINX worker memory using a specially crafted MP4 file, potentially causing process termination or code execution.

A vulnerability in the ngx_mail_auth_http_module of NGINX allows undisclosed requests to terminate worker processes. This occurs when CRAM-MD5 or APOP authentication is enabled and the authentication server permits retry via the Auth-Wait response header.