CVE-2018-16845 vulnerability in NGINX and Other Products
Published on November 7, 2018
nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module.
Vendor Advisory
Vendor Advisory
Vendor Advisory
Vendor Advisory
Vendor Advisory
Vendor Advisory
Vendor Advisory
NVD
Weakness Type
What is a Resource Exhaustion Vulnerability?
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVE-2018-16845 has been classified to as a Resource Exhaustion vulnerability or weakness.
Products Associated with CVE-2018-16845
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2018-16845 are published in these products:
Affected Versions
[UNKNOWN] nginx:- Version 1.15.6 is affected.
- Version 1.14.1 is affected.
Exploit Probability
EPSS
6.33%
Percentile
90.78%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.