Linux News Today: Three nginx Vulnerabilities Closed in Ubuntu OSes
Canonical published details in a security notice regarding a few nginx vulnerabilities that have been identified in Ubuntu 15.10, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS operating systems.
The nginx maintainers for Ubuntu have updated the version in the repositories and now it’s available for upgrade.
According to the security notice, it was discovered that nginx incorrectly handled CNAME response processing when the resolver is enabled. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly execute arbitrary code.
This is just one of security problems that have been fixed. For a more detailed description of the vulnerabilities, you can see Canonical’s security notification. Users should upgrade their Linux distribution in order to correct this issue.
The flaw can be fixed if you upgrade your system(s) to the latest nginx-related packages and their dependencies, specific to each distribution. To apply the patch, users can simply run the Update Manager application.
If you don’t want to use the Software Updater, you can open a terminal and enter the following commands (you will need to be root):
sudo apt-get update
sudo apt-get dist-upgrade
In general, a standard system update will make all the necessary changes, but please keep in mind that this is only true for nginx. If you also have a kernel update in the pipeline, you will have to reboot.