CVE-2016-0742: Null Pointer Dereference
IDE Xcode Server. Multiple issues were addressed by updating nginx to version 1.21.0.
Other sources
The following flaw was found in the nginx resolver:
Invalid pointer dereference might occur during DNS server response processing, allowing an attacker who is able to forge UDP packets from the DNS server to cause worker process crash.
This issue affects nginx only if the "resolver" directive is used in a configuration file.
The problems are fixed in nginx upstream versions 1.9.10 and 1.8.1.
External References:
http://mailman.nginx.org/pipermail/nginx-announce/2016/000169.html
— Red Hat
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.
— MITRE
Credit
Affected Software
Remediation
Patch Available
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2016-0742?
The severity of CVE-2016-0742 is high with a severity value of 7.5.
How does CVE-2016-0742 affect Xcode?
CVE-2016-0742 affects Xcode versions up to and exclusive of 13.
How can I fix CVE-2016-0742 on Xcode?
To fix CVE-2016-0742 on Xcode, update to version 13.
How does CVE-2016-0742 affect nginx?
CVE-2016-0742 affects nginx versions up to and exclusive of 1.9.10.
How can I fix CVE-2016-0742 on nginx?
To fix CVE-2016-0742 on nginx, update to version 1.9.10 or above.