CVE-2016-10345
Phusion Passenger uses a known /tmp filename
In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user.
- Record
CVE-2016-10345- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user.
- Record
CVE-2016-10345- Updated
- 2026-11-02
EUVDEUVD-2018-0392 No score
In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user.
- Record
EUVD-2018-0392- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cqxw-3p7v-p9gr
Phusion Passenger uses a known /tmp filename
In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user
- Record
GHSA-cqxw-3p7v-p9gr- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user.
- Record
CVE-2016-10345- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-10345
In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user.
- Record
DEBIAN-CVE-2016-10345- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-cqxw-3p7v-p9gr
Phusion Passenger uses a known /tmp filename
In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user
- Record
GHSA-cqxw-3p7v-p9gr- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-10345
In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user.
- Record
UBUNTU-CVE-2016-10345- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2017:1316-1 No score
Security update for rubygem-passenger
This update for rubygem-passenger fixes this security issue:
- CVE-2016-10345: A known /tmp filename was used during passenger-install-nginx-module execution, which could have allowed local attackers to gain the privileges of the passenger user (bsc#1034594).
- Record
SUSE-SU-2017:1316-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
passengerRubyGems |
before 5.1.0 | 5.1.0 |
passengerDebian:12 |
before 6.0.10-1 | 6.0.10-1 |
passengerDebian:13 |
before 6.0.10-1 | 6.0.10-1 |
passengerDebian:14 |
before 6.0.10-1 | 6.0.10-1 |
passengerRubyGems |
before 5.1.0, plus listed versions 1.0.11.0.21.0.31.0.41.0.5 Show 45 moreShow less2.0.12.0.22.0.32.0.42.0.52.0.62.1.22.1.32.2.02.2.12.2.102.2.112.2.122.2.132.2.142.2.152.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.93.0.03.0.0.pre13.0.0.pre23.0.0.pre33.0.0.pre43.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.173.0.183.0.193.0.23.0.213.0.33.0.43.0.53.0.6 |
5.1.0 |
rubygem-passengerSUSE:Lifecycle Management Server 1.3 |
before 3.0.14-0.17.1 | 3.0.14-0.17.1 |
rubygem-passengerSUSE:Studio Onsite 1.3 |
before 3.0.14-0.17.1 | 3.0.14-0.17.1 |
rubygem-passengerSUSE:WebYast 1.3 |
before 3.0.14-0.17.1 | 3.0.14-0.17.1 |
passengerUbuntu:22.04:LTS |
All versions, plus listed versions 5.0.30-1.26.0.10-36.0.10-3build16.0.10-3build2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-10345 is a high vulnerability (CVSS 7.8) in Phusion Passenger, published April 18, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in passenger 5.1.0.
References
github.com/phusion/passenger/commit/e5b4b0824d6b648525b4bf63d9fa37e5beeae441
nvd.nist.gov/vuln/detail/CVE-2016-10345
blog.phusion.nl/2017/01/10/passenger-5-1-1
Left out here: 94 versions. The JSON record has them.