CVE-2022-41741

Name	CVE-2022-41741
Description	NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3203-1, DSA-5281-1, ELA-739-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nginx (PTS)	jessie, jessie (lts)	1.6.2-5+deb8u10	fixed
	stretch (security)	1.10.3-1+deb9u7	vulnerable
	stretch (lts), stretch	1.10.3-1+deb9u8	fixed
	buster (security), buster, buster (lts)	1.14.2-2+deb10u5	fixed
	bullseye (security), bullseye	1.18.0-6.1+deb11u3	fixed
	bookworm	1.22.1-9	fixed
	sid, trixie	1.26.0-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
nginx	source	jessie	1.6.2-5+deb8u10	ELA-739-1
nginx	source	stretch	1.10.3-1+deb9u8	ELA-739-1
nginx	source	buster	1.14.2-2+deb10u5	DLA-3203-1
nginx	source	bullseye	1.18.0-6.1+deb11u3	DSA-5281-1
nginx	source	(unstable)	1.22.1-1

https://github.com/nginx/nginx/commit/6b022a5556af22b6e18532e547a6ae46b0d8c6ea (release-1.22.1)
Only affects the nginx-extras binary package