UpHeron
All vulnerabilities

Servers and applications

CVE-2016-1247

The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.

Severity
High 7.8
Published
29 Nov 2016
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
nginxServers and applications · cpe:a:f5:nginx
  • Every version up to 1.10.1
  • Every version up to 1.10.0
  • Every version up to 1.6.2
  • Every version up to 1.4.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-1247
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-1247