Security update for nginx-1.0 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:0190-1 Final 1 1 2017-01-17T17:04:53Z current 2017-01-17T17:04:53Z 2017-01-17T17:04:53Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nginx-1.0 This update for nginx-1.0 fixes the following issues: This security issues fixed: - CVE-2016-4450: NULL pointer dereference while writing client request body (bsc#982505). - CVE-2016-1000105: Setting HTTP_PROXY environment variable via Proxy header (httpoxy) (bnc#988491). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleslms13-nginx-12945,slestso13-nginx-12945,slewyst13-nginx-12945 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20170190-1/ Link for SUSE-SU-2017:0190-1 https://lists.suse.com/pipermail/sle-security-updates/2017-January/002566.html E-Mail link for SUSE-SU-2017:0190-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/982505 SUSE Bug 982505 https://bugzilla.suse.com/988491 SUSE Bug 988491 https://www.suse.com/security/cve/CVE-2016-1000105/ SUSE CVE CVE-2016-1000105 page https://www.suse.com/security/cve/CVE-2016-4450/ SUSE CVE CVE-2016-4450 page SUSE Lifecycle Management Server 1.3 SUSE Studio Onsite 1.3 SUSE WebYast 1.3 nginx-1.0-1.0.15-0.34.1 nginx-1.0-1.0.15-0.34.1 as a component of SUSE Lifecycle Management Server 1.3 nginx-1.0-1.0.15-0.34.1 as a component of SUSE Studio Onsite 1.3 nginx-1.0-1.0.15-0.34.1 as a component of SUSE WebYast 1.3 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. CVE-2016-1000105 SUSE Lifecycle Management Server 1.3:nginx-1.0-1.0.15-0.34.1 SUSE Studio Onsite 1.3:nginx-1.0-1.0.15-0.34.1 SUSE WebYast 1.3:nginx-1.0-1.0.15-0.34.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170190-1/ https://www.suse.com/security/cve/CVE-2016-1000105.html CVE-2016-1000105 https://bugzilla.suse.com/988484 SUSE Bug 988484 https://bugzilla.suse.com/988486 SUSE Bug 988486 https://bugzilla.suse.com/988487 SUSE Bug 988487 https://bugzilla.suse.com/988488 SUSE Bug 988488 https://bugzilla.suse.com/988489 SUSE Bug 988489 https://bugzilla.suse.com/988491 SUSE Bug 988491 https://bugzilla.suse.com/988492 SUSE Bug 988492 https://bugzilla.suse.com/989174 SUSE Bug 989174 os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file. CVE-2016-4450 SUSE Lifecycle Management Server 1.3:nginx-1.0-1.0.15-0.34.1 SUSE Studio Onsite 1.3:nginx-1.0-1.0.15-0.34.1 SUSE WebYast 1.3:nginx-1.0-1.0.15-0.34.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170190-1/ https://www.suse.com/security/cve/CVE-2016-4450.html CVE-2016-4450 https://bugzilla.suse.com/982484 SUSE Bug 982484 https://bugzilla.suse.com/982505 SUSE Bug 982505 https://bugzilla.suse.com/982507 SUSE Bug 982507