CLSA-2026-1780912663
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1780912663.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1780912663
- Upstream
- Published
- 2026-06-08T09:58:07Z
- Modified
- 2026-10-26T09:43:35Z
- Summary
- Fix of 6 CVEs
- Details
-
- SECURITY UPDATE: detect premature plain text response from SSL upstream (TLS plaintext injection)
- debian/patches/CVE-2026-1642.patch: detect premature plain text response from SSL upstream (TLS plaintext injection)
- CVE-2026-1642
- SECURITY UPDATE: fix NULL pointer dereference clearing s->passwd in mail auth http requests
- debian/patches/CVE-2026-27651.patch: fix NULL pointer dereference clearing s->passwd in mail auth http requests
- CVE-2026-27651
- SECURITY UPDATE: destination length validation for WebDAV COPY and MOVE (heap buffer overflow)
- debian/patches/CVE-2026-27654.patch: destination length validation for WebDAV COPY and MOVE (heap buffer overflow)
- CVE-2026-27654
- SECURITY UPDATE: fix integer overflow on 32-bit platforms in ngx_http_mp4_module
- debian/patches/CVE-2026-27784.patch: fix integer overflow on 32-bit platforms in ngx_http_mp4_module
- CVE-2026-27784
- SECURITY UPDATE: avoid zero size buffers in ngx_http_mp4_module output (out-of-bounds access)
- debian/patches/CVE-2026-32647.patch: avoid zero size buffers in ngx_http_mp4_module output (out-of-bounds access)
- CVE-2026-32647
- SECURITY UPDATE: reject unsafe characters in URIs and headers set via the Lua API (HTTP response splitting)
- debian/modules/nginx-lua/src/ngx_http_lua_util.c, debian/modules/nginx-lua/src/ngx_http_lua_util.h, debian/modules/nginx-lua/src/ngx_http_lua_uri.c, debian/modules/nginx-lua/src/ngx_http_lua_headers_in.c, debian/modules/nginx-lua/src/ngx_http_lua_headers_out.c, debian/modules/nginx-lua/src/ngx_http_lua_control.c: validate arguments of the Lua APIs that mutate a URI or a request/response header so control characters raise an error instead of being silently truncated.
- CVE-2020-36309
- SECURITY UPDATE: detect premature plain text response from SSL upstream (TLS plaintext injection)
- References
-
- https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1780912663.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-36309
- https://nvd.nist.gov/vuln/detail/CVE-2026-1642
- https://nvd.nist.gov/vuln/detail/CVE-2026-27651
- https://nvd.nist.gov/vuln/detail/CVE-2026-27654
- https://nvd.nist.gov/vuln/detail/CVE-2026-27784
- https://nvd.nist.gov/vuln/detail/CVE-2026-32647