Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 598
Alerts This Week
Warning Icon 1 598

Debian Jessie DSA-3701-1 Critical: Nginx Privilege Escalation Fix

debian
Calendar Grey October 25, 2016
Scroller Debian
The latest security notice DSA-3701-1 for Nginx highlights a privilege escalation vulnerability found in Debian server packages. Users are advised to apply updates urgently.
Dawid Golunski reported the nginx web server packages in Debian suffered from a privilege escalation vulnerability (www-data to root) due to the way log files are handled
Topics%20covered

Topics Covered

security advisory security update critical debian privilege escalation nginx local users

Summary

Dawid Golunski reported the nginx web server packages in Debian
suffered from a privilege escalation vulnerability (www-data to root)
due to the way log files are handled. This security update changes
ownership of the /var/log/nginx directory root. In addition,
/var/log/nginx has to be made accessible to local users, and local
users may be able to read the log files themselves local until the
next logrotate invocation.

For the stable distribution (jessie), this problem has been fixed in
version 1.6.2-5+deb8u3.

We recommend that you upgrade your nginx packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/



Severity
critical
Lowest
Low
Medium
High
Critical

Package: nginx
CVE ID: CVE-2016-1247

Topics%20covered

Topics Covered

security advisory security update critical debian privilege escalation nginx local users

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.