The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-geoipUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nginxUpgrade nginx-filesystemUpgrade nginx-all-modules | Sep 28, 2023 | Nov 29, 2016 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 29, 2016 |
| Debian | — | Upgrade nginx | Oct 25, 2016 | Oct 25, 2016 |
| Gentoo Linux | — | Upgrade www-servers/nginx. | Oct 30, 2017 | Nov 29, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 25, 2016 |
| Ubuntu | — | Upgrade nginx-extrasUpgrade nginx-fullUpgrade nginx-commonUpgrade nginx-coreUpgrade nginx-light | Oct 25, 2016 | Oct 25, 2016 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub