nginx: privilege escalation
| Package(s): | nginx |
CVE #(s): | CVE-2016-1247
|
| Created: | October 26, 2016 |
Updated: | January 16, 2017 |
| Description: |
From the Debian advisory:
Dawid Golunski reported the nginx web server packages in Debian
suffered from a privilege escalation vulnerability (www-data to root)
due to the way log files are handled. This security update changes
ownership of the /var/log/nginx directory root. In addition,
/var/log/nginx has to be made accessible to local users, and local
users may be able to read the log files themselves local until the
next logrotate invocation. |
| Alerts: |
|
