Security update for rubygem-passenger SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1316-1 Final 1 1 2017-05-16T13:42:21Z current 2017-05-16T13:42:21Z 2017-05-16T13:42:21Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rubygem-passenger This update for rubygem-passenger fixes this security issue: - CVE-2016-10345: A known /tmp filename was used during passenger-install-nginx-module execution, which could have allowed local attackers to gain the privileges of the passenger user (bsc#1034594). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleslms13-rubygem-passenger-13107,slestso13-rubygem-passenger-13107,slewyst13-rubygem-passenger-13107 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171316-1/ Link for SUSE-SU-2017:1316-1 https://lists.suse.com/pipermail/sle-security-updates/2017-May/002890.html E-Mail link for SUSE-SU-2017:1316-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1034594 SUSE Bug 1034594 https://www.suse.com/security/cve/CVE-2016-10345/ SUSE CVE CVE-2016-10345 page SUSE Lifecycle Management Server 1.3 SUSE Studio Onsite 1.3 SUSE WebYast 1.3 rubygem-passenger-3.0.14-0.17.1 rubygem-passenger-apache2-3.0.14-0.17.1 rubygem-passenger-nginx-3.0.14-0.17.1 rubygem-passenger-3.0.14-0.17.1 as a component of SUSE Lifecycle Management Server 1.3 rubygem-passenger-apache2-3.0.14-0.17.1 as a component of SUSE Lifecycle Management Server 1.3 rubygem-passenger-nginx-3.0.14-0.17.1 as a component of SUSE Lifecycle Management Server 1.3 rubygem-passenger-3.0.14-0.17.1 as a component of SUSE Studio Onsite 1.3 rubygem-passenger-nginx-3.0.14-0.17.1 as a component of SUSE Studio Onsite 1.3 rubygem-passenger-3.0.14-0.17.1 as a component of SUSE WebYast 1.3 rubygem-passenger-nginx-3.0.14-0.17.1 as a component of SUSE WebYast 1.3 In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user. CVE-2016-10345 SUSE Lifecycle Management Server 1.3:rubygem-passenger-3.0.14-0.17.1 SUSE Lifecycle Management Server 1.3:rubygem-passenger-apache2-3.0.14-0.17.1 SUSE Lifecycle Management Server 1.3:rubygem-passenger-nginx-3.0.14-0.17.1 SUSE Studio Onsite 1.3:rubygem-passenger-3.0.14-0.17.1 SUSE Studio Onsite 1.3:rubygem-passenger-nginx-3.0.14-0.17.1 SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.17.1 SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.17.1 moderate 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171316-1/ https://www.suse.com/security/cve/CVE-2016-10345.html CVE-2016-10345 https://bugzilla.suse.com/1034594 SUSE Bug 1034594