Candidate: CVE-2016-10345
PublicDate: 2017-04-18 20:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10345
 https://github.com/phusion/passenger/commit/e5b4b0824d6b648525b4bf63d9fa37e5beeae441
 https://github.com/phusion/passenger/blob/stable-5.1/CHANGELOG
Description:
 In Phusion Passenger before 5.1.0, a known /tmp filename was used during
 passenger-install-nginx-module execution, which could allow local attackers
 to gain the privileges of the passenger user.
Ubuntu-Description:
Notes:
 rodrigo-zaiden> the affected binary, passenger-install-nginx-module, is
  not installed from Ubuntu package (as in Debian), so this
  issue does not affect any Ubuntu releases.
Bugs:
Priority: medium
Discovered-by: Jeremy Evans
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H [7.8 HIGH]

Patches_passenger:
upstream_passenger: released (5.1.0)
precise_passenger: ignored (reached end-of-life)
precise/esm_passenger: DNE (precise was needed)
trusty_passenger: DNE
trusty/esm_passenger: DNE
vivid/stable-phone-overlay_passenger: DNE
vivid/ubuntu-core_passenger: DNE
xenial_passenger: not-affected
yakkety_passenger: ignored (reached end-of-life)
zesty_passenger: ignored (reached end-of-life)
artful_passenger: ignored (reached end-of-life)
bionic_passenger: not-affected
cosmic_passenger: ignored (reached end-of-life)
disco_passenger: ignored (reached end-of-life)
eoan_passenger: ignored (reached end-of-life)
focal_passenger: not-affected
groovy_passenger: ignored (reached end-of-life)
hirsute_passenger: ignored (reached end-of-life)
impish_passenger: not-affected
devel_passenger: not-affected