Summary
It was discovered that nginx incorrectly handled certain memory operations in
the ngx_http_mp4_module module. A local attacker could possibly use this issue
with a specially crafted mp4 file to cause nginx to crash, stop responding, or
access arbitrary memory. (CVE-2022-41741, CVE-2022-41742)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | nginx | 1.14.0-0ubuntu1.11 |
| Ubuntu · 20.04 LTS 20.04:LTS | nginx | 1.18.0-0ubuntu1.4 |
| Ubuntu · 22.04 LTS 22.04:LTS | nginx | 1.18.0-6ubuntu14.3 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | nginx | 1.4.6-1ubuntu3.9+esm4 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | nginx | 1.10.3-0ubuntu0.16.04.5+esm5 |
Vulnerabilities 2
-
High 7.1
NGINX ngx_http_mp4_module vulnerability CVE-2022-41742
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to c…
-
High 7.0CVE-2022-41741 Public exploit
NGINX ngx_http_mp4_module vulnerability CVE-2022-41741
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to c…