CVE-2016-10345
Fixed in a distro release EPSS <1%
In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user.
Products: phusion passenger
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | passenger | 5.1.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | passenger | 6.0.10-1 |
| Debian 13 | passenger | 6.0.10-1 |
| Debian 14 | passenger | 6.0.10-1 |
| SUSE Lifecycle Management Server 1.3 | rubygem-passenger | 3.0.14-0.17.1 |
| SUSE Studio Onsite 1.3 | rubygem-passenger | 3.0.14-0.17.1 |
| SUSE WebYast 1.3 | rubygem-passenger | 3.0.14-0.17.1 |
| Ubuntu 22.04 LTS | passenger | no fix |