[ubuntu/yakkety-security] nginx 1.10.1-0ubuntu1.1 (Accepted)

[Marc Deslauriers]

nginx (1.10.1-0ubuntu1.1) yakkety-security; urgency=medium

  [ Christos Trochalakis ]
  * debian/nginx-common.postinst:
    + Secure log file handling (owner & permissions) against privilege
      escalation attacks. /var/log/nginx is now owned by root:adm.
      Thanks Dawid Golunski (http://legalhackers.com) for the report.
      Changing /var/log/nginx permissions effectively reopens #701112,
      since log files can be world-readable. This is a trade-off until
      a better log opening solution is implemented upstream (trac:376).
  * debian/control:
    Don't allow building against liblua5.1-0-dev on architectures
    that libluajit is available.

Date: 2016-10-18 09:51:16.791157+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/nginx/1.10.1-0ubuntu1.1
-------------- next part --------------
Sorry, changesfile not available.