This update for nginx fixes the following vulnerability :

  - CVE-2016-4450: Remote attackers could have caused a     denial of service (NULL pointer dereference and worker     process crash) via a crafted request, involving writing     a client request body to a temporary file.

update to upstream release 1.10.1 to fix CVE-2016-4450

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the nginx package has been released.

It was discovered that a NULL pointer dereference in the Nginx code responsible for saving client request bodies to a temporary file might result in denial of service: Malformed requests could crash worker processes.

fix CVE-2016-4450

----

update to upstream release 1.8.1 to fix CVE-2016-4450

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of nginx hosted on the remote web server is less than 1.10.1,  or 1.11.x less than 1.11.1. It is, therefore, affected by a denial of  service vulnerability

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA88135 advisory.

  - NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file     with a modification date in 1969 that causes an integer overflow (or a false modification date far in the     future), when encountered by the autoindex module. (CVE-2017-20005)

  - The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of     service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.
    (CVE-2016-0742)

  - Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows     remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other     impact via a crafted DNS response related to CNAME response processing. (CVE-2016-0746)

  - The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which     allows remote attackers to cause a denial of service (worker process resource consumption) via vectors     related to arbitrary name resolution. (CVE-2016-0747)

  - The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on     Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on     Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web     server user account to gain root privileges via a symlink attack on the error log. (CVE-2016-1247)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
96943	openSUSE Security Update : nginx (openSUSE-2017-192)	Nessus	SuSE Local Security Checks	2017/2/2	2026/1/2	high
92155	Fedora 24 : 1:nginx (2016-c329fc4c32)	Nessus	Fedora Local Security Checks	2016/7/14	2026/2/2	high
121651	Photon OS 1.0: Nginx PHSA-2016-0012	Nessus	PhotonOS Local Security Checks	2019/2/7	2024/7/23	high
91431	Debian DSA-3592-1 : nginx - security update	Nessus	Debian Local Security Checks	2016/6/2	2021/1/11	high
92194	Fedora 23 : 1:nginx (2016-ea323bd6cf)	Nessus	Fedora Local Security Checks	2016/7/14	2026/2/2	high
118150	nginx < 1.10.1 / 1.11.x < 1.11.1 Denial-of-Service Vulnerability	Nessus	Web Servers	2018/10/16	2026/7/17	high
310760	Juniper Junos OS Multiple Vulnerabilities (JSA88135)	Nessus	Junos Local Security Checks	2026/4/28	2026/4/30	medium

检测

插件搜索

high

high

high

high

high

high

medium