• [SECURITY] [DSA 3701-1] nginx security update

    From Florian Weimer@1:229/2 to All on Tue Oct 25 21:10:01 2016
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-3701-1 [email protected] https://www.debian.org/security/ Florian Weimer
    October 25, 2016 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : nginx
    CVE ID : CVE-2016-1247

    Dawid Golunski reported the nginx web server packages in Debian
    suffered from a privilege escalation vulnerability (www-data to root)
    due to the way log files are handled. This security update changes
    ownership of the /var/log/nginx directory root. In addition,
    /var/log/nginx has to be made accessible to local users, and local
    users may be able to read the log files themselves local until the
    next logrotate invocation.

    For the stable distribution (jessie), this problem has been fixed in
    version 1.6.2-5+deb8u3.

    We recommend that you upgrade your nginx packages.

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: [email protected]
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.10 (GNU/Linux)

    iQEcBAEBAgAGBQJYD7XCAAoJEL97/wQC1SS+tMQH/RJGNzeWadJzzj0ijzFQYLNc oDeGi8v4Ehf6Btrh61I8r07IeO6RQmMvAhtnHlq2xOmySaKWqUq2eYhQE3J3wdLA CegvCoByYwH1FnQq8xxdCKt2dybLnDXDor2Hi4zfGGcVq3Y5pnjWaEyoECEJCXSv pkqzNtoFFpfPlZGNrNGphpjz9bO/xtjQ4QkYHGwG6bzkn1v+D85F63kUVPDtAvov wpNOxpm4u328qVPKA+mECCLL+7kXsWE84HEiw5K5lcJyF2J2y1GPciwbwJWhX2L4 KHm59CN1vLTaLOHD7eCoNEkdOgChFxZURybT9McFYONz7ijDCXkMrUpeP6FAkHg=
    =Xfcc
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)