==========================================================================
Ubuntu Security Notice USN-2991-1
June 02, 2016

nginx vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 16.04 LTS
– Ubuntu 15.10
– Ubuntu 14.04 LTS

Summary:

nginx could be made to crash if it received specially crafted network
traffic.

Software Description:
– nginx: small, powerful, scalable web/proxy server

Details:

It was discovered that nginx incorrectly handled saving client request
bodies to temporary files. A remote attacker could possibly use this issue
to cause nginx to crash, resulting in a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
nginx-core 1.10.0-0ubuntu0.16.04.2
nginx-extras 1.10.0-0ubuntu0.16.04.2
nginx-full 1.10.0-0ubuntu0.16.04.2
nginx-light 1.10.0-0ubuntu0.16.04.2

Ubuntu 15.10:
nginx-core 1.9.3-1ubuntu1.2
nginx-extras 1.9.3-1ubuntu1.2
nginx-full 1.9.3-1ubuntu1.2
nginx-light 1.9.3-1ubuntu1.2

Ubuntu 14.04 LTS:
nginx-core 1.4.6-1ubuntu3.5
nginx-extras 1.4.6-1ubuntu3.5
nginx-full 1.4.6-1ubuntu3.5
nginx-light 1.4.6-1ubuntu3.5

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2991-1
CVE-2016-4450

Package Information:
https://launchpad.net/ubuntu/+source/nginx/1.10.0-0ubuntu0.16.04.2
https://launchpad.net/ubuntu/+source/nginx/1.9.3-1ubuntu1.2
https://launchpad.net/ubuntu/+source/nginx/1.4.6-1ubuntu3.5

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2

iQIcBAEBCgAGBQJXUHYgAAoJEGVp2FWnRL6TY7wQAKZNqG5kjyWOGSGBQ6Fa0K3F
/0hkhWdkwjN4aU4WNKeirWLrbAELF1iDQfMoJMUvyaF9z0G9YTGmqTegrvZ3rU6h
sflOLQZTNzTJmKA6IQhZCSx2xcA2fVXDZuRFaKKlTbwWZio43xaj42QPDJEaykjA
iHBGSro+QbRQX5ljSSSZFfwlSYZF+OhEQFHYtcoyEZbhee2YHaQYZX/ihFFXkrel
IdgFhtxVYYOEGGsa/tiqCjQqS+1HbOanbHoYLqNNpmKZ80D9VtP9xvQSodZg2IWA
n4E0uLfKrmcOz7Hgu9k9L4ANhRndbFwVEduI1Tj4SUpteN5gQdN+IaBB3cYwuBRD
JoBJYJdVLcCI9REBh2iAWIcVisEYytcicgIzV4jjzuvrMhucLQYBKiTM8tVPrBQ7
Ol/pMbx628EKrpDrfIuM3RqEjAJwdlkMO7giG5ysMMJX57VivXuwlPplRRqbW4Dm
txVwy396PGWi/B1iY1497E8uZsx1fx32ovhx9uQJDrQg/5t5v7gKLT3mhlo4605c
SvEdjTTHx487p+L0q5+NmQC9f7B1ETMJDeFFua9rSndRlNcZbITwwyjTJyvxT/v+
USY4l06ytfMX4YGpOHiVMnBcOOsHPDhj10qTrn+2mwZixqvb1nhhJmLJnQuTWhU/
MI9MZYwU5/3SkNgfmoeH
=GbCc
—–END PGP SIGNATURE—–
—