Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash (CVE-2024-7347). Thanks to Nils Bars.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-8ba5080dfa 2024-08-26 01:30:49.757000 -------------------------------------------------------------------------------- Name : nginx-mod-fancyindex Product : Fedora 39 Version : 0.5.2 Release : 5.fc39 URL : https://github.com/aperezdc/ngx-fancyindex Summary : Nginx FancyIndex module Description : The Fancy Index module makes possible the generation of file listings, like the built-in autoindex module does, but adding a touch of style. This is possible because the module allows a certain degree of customization of the generated content: * Custom headers. Either local or stored remotely. * Custom footers. Either local or stored remotely. * Add you own CSS style rules. * Allow choosing to sort elements by name (default), modification time, or size; both ascending (default), or descending. -------------------------------------------------------------------------------- Update Information: Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash (CVE-2024-7347). Thanks to Nils Bars. -------------------------------------------------------------------------------- ChangeLog: * Fri Aug 16 2024 Felix Kaechele - 0.5.2-5 - Rebuild for nginx 1.26.2 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2305156 - CVE-2024-7347 nginx: Nginx: Specially crafted file may cause Denial of Service [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2305156 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade--advisory FEDORA-2024-8ba5080dfa' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Two security issues were identified in the ngx_http_mp4_module, which might allow an attacker to cause a worker process crash or worker process memory disclosure by using a specially crafted mp4 file, or might have potential other impact. (CVE-2022-41741, CVE-2022-41742) . MGASA-2022-0398 - Updated nginx packages fix security vulnerability Publication date: 28 Oct 2022 URL: https://advisories.mageia.org/MGASA-2022-0398.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-41741, CVE-2022-41742 Two security issues were identified in the ngx_http_mp4_module, which might allow an attacker to cause a worker process crash or worker process memory disclosure by using a specially crafted mp4 file, or might have potential other impact. (CVE-2022-41741, CVE-2022-41742) References: - https://bugs.mageia.org/show_bug.cgi?id=30993 - https://mailman.nginx.org/pipermail/nginx-announce/2022/RBRRON6PYBJJM2XIAPQBFBVLR4Q6IHRA.html - https://www.cve.org/CVERecord?id=CVE-2022-41741 - https://www.cve.org/CVERecord?id=CVE-2022-41742 SRPMS: - 8/core/nginx-1.18.0-5.3.mga8 . The recent update of nginx in Mageia tackles significant vulnerabilities which could lead to system failures or the leakage of sensitive information. Ensure your systems are protected!. Mageia Security Update, nginx MP4 Module, Memory Security Threats. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.