{"id":"CVE-2016-1247","published":"2016-11-29T17:00:00Z","modified":"2024-08-05T22:48:13Z","title":"The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.04863,"percentile":0.92009,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.exploit-db.com/exploits/40768/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://www.securityfocus.com/archive/1/539796/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.debian.org/security/2016/dsa-3701","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://www.youtube.com/watch?v=aTswN1k1fQs","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/93903","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html","tags":["x_refsource_MISC"]},{"url":"http://www.ubuntu.com/usn/USN-3114-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://seclists.org/fulldisclosure/2017/Jan/33","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"https://security.gentoo.org/glsa/201701-22","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://www.securitytracker.com/id/1037104","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://seclists.org/fulldisclosure/2016/Nov/78","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://packetstormsecurity.com/files/139750/Nginx-Debian-Based-Distros-Root-Privilege-Escalation.html","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3WOO7E5R2HT5XVOIOFPEFALILVOWZUF/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ESTIADC7BDB6VTH4JAP6C6OCW2CQ4NHP/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBIZEKHBOCKO7FUMCO4X53ENMWU5OYFX/","tags":["vendor-advisory","x_refsource_FEDORA"]}],"techniques":[],"reports":[{"id":"SRC-b804e28bf5894dd4955f","title":"Whitepaper Name Goes","publisher":"trustwave.com","url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/Trustwave_SpiderLabs_2023_Hospitality_Sector_Threat_Landscape.pdf","date":null,"mentions":[{"quote":"Apache Tomcat HTTP Request Smuggling (CVE-2021-23017)\r\n▪ Mod_dav module of httpd DoS (CVE-2006-20001)\r\n▪ Mod_proxy module of httpd (CVE-2022-37436)\r\n▪ SQLite DoS vulnerability (CVE-2019-20372)\r\n▪ Jenkins RCE (CVE-2017-20005)\r\n▪ Nginx web server DoS (CVE-2017-7529)\r\n▪ Spring Framework RCE (CVE-2016-1247)","start":45544,"end":45848}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2016-2346","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-2346","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":40768,"url":"https://www.exploit-db.com/exploits/40768","title":"Nginx (Debian Based Distros + Gentoo) - 'logrotate' Local Privilege Escalation","type":"local","platform":"linux","date":"2016-11-16","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2016-11-16"},"first":{"date":"2016-11-16","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/40768"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/40768/","http://packetstormsecurity.com/files/139750/Nginx-Debian-Based-Distros-Root-Privilege-Escalation.html"],"flow":[],"timeline":[{"date":"2016-11-16","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-40768)","url":"https://www.exploit-db.com/exploits/40768","provenance":"source"},{"date":"2016-11-29","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2016-1247","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":27.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.4,"detail":"percentile 0.9201"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 NVD exploit link"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}