Skip to content
OpenAdvisories
High USN-3812-1 3 CVEs

nginx vulnerabilities

Published Nov 7, 2018 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that nginx incorrectly handled the HTTP/2 implementation.
A remote attacker could possibly use this issue to cause excessive memory
consumption, leading to a denial of service. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-16843)

Gal Goldshtein discovered that nginx incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
excessive CPU usage, leading to a denial of service. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10.
(CVE-2018-16844)

It was discovered that nginx incorrectly handled the ngx_http_mp4_module
module. A remote attacker could possibly use this issue with a specially
crafted mp4 file to cause nginx to crash, stop responding, or access
arbitrary memory. (CVE-2018-16845)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS nginx 1.4.6-1ubuntu3.9
Ubuntu · 16.04 LTS 16.04:LTS nginx 1.10.3-0ubuntu0.16.04.3
Ubuntu · 18.04 LTS 18.04:LTS nginx 1.14.0-0ubuntu1.2

Vulnerabilities 3

References

  • report
    https://ubuntu.com/security/CVE-2018-16843
  • report
    https://ubuntu.com/security/CVE-2018-16844
  • report
    https://ubuntu.com/security/CVE-2018-16845