nginx: security bump to version 1.8.1
authorGustavo Zacarias <gustavo@zacarias.com.ar>
Wed, 27 Jan 2016 12:03:30 +0000 (09:03 -0300)
committerThomas Petazzoni <thomas.petazzoni@free-electrons.com>
Wed, 27 Jan 2016 20:37:11 +0000 (21:37 +0100)
commit77dd34bc795cad4163476426db0e3fda51d1c67d
treec2ed168f2b167d7d9a78d6028cc27588e0a11a11
parente537d52b8516a751b2bec0ce0b0139f9c3d6f16f
nginx: security bump to version 1.8.1

Fixes:

CVE-2016-0742 - invalid pointer dereference might occur during DNS
server response processing if the "resolver" directive was used,
allowing anattacker who is able to forge UDP packets from the DNS server
to cause segmentation fault in a worker process.

CVE-2016-0746 - use-after-free condition might occur during CNAME
response processing if the "resolver" directive was used, allowing an
attacker who is able to trigger name resolution to cause segmentation
fault in a worker process, or might have potential other impact.

CVE-2016-0747 - CNAME resolution was insufficiently limited if the
"resolver" directive was used, allowing an attacker who is able to
trigger arbitrary name resolution to cause excessive resource
consumption in worker processes.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
package/nginx/nginx.hash
package/nginx/nginx.mk