Skip to content
Appaloosa Scout

Vulnerability · NVD

CVE-2018-16845

MEDIUM 6.1

nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module.

Attack vector : Local No privileges required
Show raw CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
EPSS 9.80% above median percentile 95.1%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

  • Xcode macOS com.apple.dt.Xcode
    Affected <13.0 Fixed in 13.0 Latest tracked 26.6 patched

NVD references 5 distinct products for this CVE — only those tracked by Scout (mobile and desktop catalog apps) are listed above. Libraries, servers and out-of-scope products do not appear here. Full list on NVD ↗

Vulnerable CPE configurations (1)
Vendor Product Versions
apple xcode
All platforms (wildcard)
 <13.0
View on NVD ↗ Advisory · mailman.nginx.org Advisory · usn.ubuntu.com