80 行
2.9 KiB
JSON
80 行
2.9 KiB
JSON
{
|
|
"canonical_id": "nginx--CVE-2016-1247",
|
|
"system_id": "nginx",
|
|
"display_name": "Nginx",
|
|
"category": "servers",
|
|
"advisory_mode": "server",
|
|
"title": "CVE-2016-1247",
|
|
"summary": "The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.",
|
|
"published_at": "2016-11-29T17:59:00.167",
|
|
"updated_at": "2025-04-12T10:46:40.837",
|
|
"severity": "high",
|
|
"cvss_score": 7.8,
|
|
"exploit_status": "unknown",
|
|
"source_confidence": "official",
|
|
"official_source_url": "http://packetstormsecurity.com/files/139750/Nginx-Debian-Based-Distros-Root-Privilege-Escalation.html",
|
|
"secondary_source_urls": [
|
|
"http://seclists.org/fulldisclosure/2016/Nov/78",
|
|
"http://seclists.org/fulldisclosure/2017/Jan/33",
|
|
"http://www.debian.org/security/2016/dsa-3701",
|
|
"http://www.securityfocus.com/archive/1/539796/100/0/threaded",
|
|
"http://www.securityfocus.com/bid/93903",
|
|
"http://www.securitytracker.com/id/1037104",
|
|
"http://www.ubuntu.com/usn/USN-3114-1",
|
|
"https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html",
|
|
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBIZEKHBOCKO7FUMCO4X53ENMWU5OYFX/",
|
|
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ESTIADC7BDB6VTH4JAP6C6OCW2CQ4NHP/",
|
|
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3WOO7E5R2HT5XVOIOFPEFALILVOWZUF/",
|
|
"https://security.gentoo.org/glsa/201701-22",
|
|
"https://www.exploit-db.com/exploits/40768/",
|
|
"https://www.youtube.com/watch?v=aTswN1k1fQs"
|
|
],
|
|
"aliases": [
|
|
"CVE-2016-1247"
|
|
],
|
|
"cve_ids": [
|
|
"CVE-2016-1247"
|
|
],
|
|
"ghsa_ids": [],
|
|
"osv_ids": [],
|
|
"affected_versions": [],
|
|
"fixed_versions": [],
|
|
"package_name": null,
|
|
"render_markdown": false,
|
|
"case_path": null,
|
|
"secure_code_topics": [
|
|
"proxy-trust-boundary",
|
|
"request-smuggling-boundary",
|
|
"csp-trusted-types",
|
|
"dependency-upgrade-policy"
|
|
],
|
|
"status": "triage",
|
|
"triage_reasons": [
|
|
"missing affected/fixed version details"
|
|
],
|
|
"verification_status": "triage-manual",
|
|
"verification_mode": "synthetic",
|
|
"last_verified_at": null,
|
|
"last_run_id": null,
|
|
"evidence_bundle": null,
|
|
"historical_status": null,
|
|
"latest_status": null,
|
|
"browser_evidence": {
|
|
"required": false,
|
|
"present": false,
|
|
"refs": []
|
|
},
|
|
"repro_profile_id": "proxy-boundary-generic",
|
|
"artifact_mode": "official-image",
|
|
"blocked_reason": null,
|
|
"metadata": {
|
|
"source_names": [
|
|
"NVD NGINX"
|
|
],
|
|
"source_kinds": [
|
|
"nvd-search"
|
|
],
|
|
"candidate_count": 1
|
|
}
|
|
}
|