CVE-2016-0746

Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.

Updated nginx package fixes security vulnerabilities:

Several vulnerabilities were discovered in the resolver in nginx, leading to denial of service or, potentially, to arbitrary code execution. These only affect nginx if the "resolver" directive is used in a configuration file (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747).

These are all security issues fixed in the nginx-1.11.4-2.5 package on the GA media of openSUSE Tumbleweed.

This update for nginx-1.0 fixes the following issues:

Security fixes:

• CVE-2016-0742: Invalid pointer dereference during DNS server response processing
• CVE-2016-0747: Resource exhaustion through unlimited CNAME resolution
• CVE-2016-0746: Use-after-free condition during CNAME response processing

It was discovered that nginx incorrectly handled certain DNS server responses when the resolver is enabled. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service. (CVE-2016-0742)

It was discovered that nginx incorrectly handled CNAME response processing when the resolver is enabled. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-0746)

It was discovered that nginx incorrectly handled CNAME resolution when the resolver is enabled. A remote attacker could possibly use this issue to cause nginx to consume resources, resulting in a denial of service. (CVE-2016-0747)