{"affected":[{"ecosystem_specific":{"binaries":[{"rubygem-passenger":"3.0.14-0.14.1","rubygem-passenger-apache2":"3.0.14-0.14.1","rubygem-passenger-nginx":"3.0.14-0.14.1"}]},"package":{"ecosystem":"SUSE:Lifecycle Management Server 1.3","name":"rubygem-passenger","purl":"purl:rpm/suse/rubygem-passenger&distro=SUSE%20Lifecycle%20Management%20Server%201.3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"3.0.14-0.14.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"rubygem-passenger":"3.0.14-0.14.1","rubygem-passenger-nginx":"3.0.14-0.14.1"}]},"package":{"ecosystem":"SUSE:Studio Onsite 1.3","name":"rubygem-passenger","purl":"purl:rpm/suse/rubygem-passenger&distro=SUSE%20Studio%20Onsite%201.3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"3.0.14-0.14.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"rubygem-passenger":"3.0.14-0.14.1","rubygem-passenger-nginx":"3.0.14-0.14.1"}]},"package":{"ecosystem":"SUSE:WebYast 1.3","name":"rubygem-passenger","purl":"purl:rpm/suse/rubygem-passenger&distro=SUSE%20WebYast%201.3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"3.0.14-0.14.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"\n\nThis update fixes the following security issues:\n\n- CVE-2015-7519: Passenger is not filtering\n  environment like apache is doing (bnc#956281)\n\n- CVE-2013-4136: Fixed security issue   Passenger would reuse existing server instance directories\n  (temporary directories) which could cause Passenger to remove or\n  overwrite files belonging to other instances. Solution:\n  If the server instance directory already exists, it will now be\n  removed first in order get correct directory permissions. If the\n  directory still exists after removal, Phusion Passenger aborts to\n  avoid writing to a directory with unexpected permissions.(bnc#919726) \n\n- CVE-2013-2119: Fixed security issue related with incorrect temporary file usage (bnc#828005)  ","id":"SUSE-SU-2016:0042-1","modified":"2016-01-07T09:33:34Z","published":"2016-01-07T09:33:34Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160042-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/828005"},{"type":"REPORT","url":"https://bugzilla.suse.com/919726"},{"type":"REPORT","url":"https://bugzilla.suse.com/956281"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2013-2119"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2013-4136"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-7519"}],"related":["CVE-2013-2119","CVE-2013-4136","CVE-2015-7519"],"summary":"Security update for rubygem-passenger"}