CVE-2016-1247
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6...
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.
- Record
CVE-2016-1247- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.
- Record
CVE-2016-1247- Updated
- 2026-11-02
EUVDEUVD-2016-2346 No score
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.
- Record
EUVD-2016-2346- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4333-xxh4-gh9f
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6...
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.
- Record
GHSA-4333-xxh4-gh9f- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
OSV
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.
- Record
CVE-2016-1247- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-1247
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.
- Record
DEBIAN-CVE-2016-1247- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-1247
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.
- Record
UBUNTU-CVE-2016-1247- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11341-1 No score
ruby2.7-rubygem-passenger-6.0.8-3.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-passenger-6.0.8-3.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11341-1- Updated
- 2026-11-02
OSVUSN-3114-1 No score
nginx vulnerability
Dawid Golunski discovered that the nginx package incorrectly handled log file permissions. A remote attacker could possibly use this issue to obtain root privileges.
- Record
USN-3114-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nginxDebian:12 |
before 1.10.2-1 | 1.10.2-1 |
nginxDebian:13 |
before 1.10.2-1 | 1.10.2-1 |
nginxDebian:14 |
before 1.10.2-1 | 1.10.2-1 |
nginxDebian:8 |
before 1.6.2-5+deb8u3, plus listed versions 1.6.2-51.6.2-5+a.exp11.6.2-5+deb8u11.6.2-5+deb8u1~bpo70+11.6.2-5+deb8u21.6.2-5+deb8u2~bpo70+1 |
1.6.2-5+deb8u3 |
nginxUbuntu:14.04:LTS |
before 1.4.6-1ubuntu3.6, plus listed versions 1.4.1-3ubuntu11.4.3-2ubuntu11.4.4-1ubuntu11.4.4-2ubuntu11.4.4-4ubuntu1 Show 8 moreShow less1.4.5-1ubuntu11.4.6-1ubuntu21.4.6-1ubuntu31.4.6-1ubuntu3.11.4.6-1ubuntu3.21.4.6-1ubuntu3.31.4.6-1ubuntu3.41.4.6-1ubuntu3.5 |
1.4.6-1ubuntu3.6 |
nginxUbuntu:16.04:LTS |
before 1.10.0-0ubuntu0.16.04.3, plus listed versions 1.9.3-1ubuntu11.9.6-2ubuntu11.9.6-2ubuntu21.9.9-0ubuntu11.9.9-1ubuntu1 Show 10 moreShow less1.9.10-0ubuntu11.9.10-1ubuntu11.9.11-0ubuntu11.9.11-0ubuntu21.9.12-0ubuntu11.9.13-0ubuntu11.9.14-0ubuntu11.9.15-0ubuntu11.10.0-0ubuntu0.16.04.11.10.0-0ubuntu0.16.04.2 |
1.10.0-0ubuntu0.16.04.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Nginx (Debian Based Distros + Gentoo) - 'logrotate' Local Privilege Escalation | 2016-11-16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-1247 is a high vulnerability (CVSS 7.8) in F5 Nginx, published October 25, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.86%, the 92nd percentile. Fixed in nginx 1.10.2-1.
References
exploit-db.com/exploits/40768
securityfocus.com/archive/1/539796/100/0/threaded
debian.org/security/2016/dsa-3701
youtube.com/watch?v=aTswN1k1fQs
legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html
Show 27 moreShow less
ubuntu.com/usn/USN-3114-1
seclists.org/fulldisclosure/2017/Jan/33
security.gentoo.org/glsa/201701-22
securitytracker.com/id/1037104
packetstormsecurity.com/files/139750/Nginx-Debian-Based-Distros-Root-Privilege-Escalation.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3WOO7E5R2HT5XVOIOFPEFALILVOWZUF
nvd.nist.gov/vuln/detail/CVE-2016-1247
github.com/advisories/GHSA-4333-xxh4-gh9f
security-tracker.debian.org/tracker/CVE-2016-1247
ubuntu.com/security/CVE-2016-1247
cve.org/CVERecord?id=CVE-2016-1247
suse.com/security/cve/CVE-2013-2119