[ubuntu/trusty-updates] nginx 1.4.6-1ubuntu3.6 (Accepted)

[Ubuntu Archive Robot]

nginx (1.4.6-1ubuntu3.6) trusty-security; urgency=medium

  [ Christos Trochalakis ]
  * debian/nginx-common.postinst:
    + Secure log file handling (owner & permissions) against privilege
      escalation attacks. /var/log/nginx is now owned by root:adm.
      Thanks Dawid Golunski (http://legalhackers.com) for the report.
      Changing /var/log/nginx permissions effectively reopens #701112,
      since log files can be world-readable. This is a trade-off until
      a better log opening solution is implemented upstream (trac:376).

Date: 2016-10-18 10:19:13.833414+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk>
https://launchpad.net/ubuntu/+source/nginx/1.4.6-1ubuntu3.6
-------------- next part --------------
Sorry, changesfile not available.