CVE-2018-16845: apple xcode Uncontrolled Resource Consumption
Vulnerability summary
CVE-2018-16845 is a high (CVSS 8.2) Uncontrolled Resource Consumption vulnerability in apple xcode. EPSS estimates a 9.84% chance of exploitation in the next 30 days, higher than 95.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 11 · Related 6Timeline
- 07-11-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module.
CVSS metrics
9 scores · 6 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
- NVDNIST8.2HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated8.2HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:HDiffers
EPSS trend
Probability
9.84%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
+0.04 pp
From 9.80% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Affected systems
Debian2 products
- nginx< 1.14.1-1 | < 1.6.2-5+deb8u6
- debian_linuxEOL8.0 | 9.0
Redhat2 products
- rh-nginx18-nginx< 1:1.8.1-1.el6.1 | < 1:1.8.1-1.el7.1
- rh-nginx18-nginx-debuginfo< 1:1.8.1-1.el6.1 | < 1:1.8.1-1.el7.1
[unknown]1 product
- nginx1.15.6 | 1.14.1
Alpine1 product
- nginx≥ 1.0.7, < 1.14.1-r0 | ≥ 1.0.7, < 1.12.2-r2 | ≥ 1.0.7, < 1.12.1-r4
Apple1 product
- xcode< 13.0
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
F51 product
- nginx≥ 1.0.7, ≤ 1.0.15 | ≥ 1.1.3, ≤ 1.15.5
Opensuse1 product
- leapEOL15.1
Ubuntu1 product
- nginx< 1.4.6-1ubuntu3.9 | < 1.10.3-0ubuntu0.16.04.3 | < 1.14.0-0ubuntu1.2
9 vendors · 11 products
References
24 links
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16845X Refsource CONFIRMIssue TrackingThird Party Advisory
- lists.debian.org/debian-lts-announce/2018/11/msg00010.htmlMailing ListX Refsource MLISTThird Party Advisory
- access.redhat.com/errata/RHSA-2018:3652Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
Show all 24 references
- mailman.nginx.org/pipermail/nginx-announce/2018/000221.htmlX Refsource MISCMailing ListPatchVendor AdvisoryARTICLEREPORT
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
