This update for lighttpd fixes the following issues:
Security issues fixed:
- CVE-2016-1000212: Don't allow requests to set the HTTP_PROXY variable. As *CGI apps
might pick it up and use it for outgoing requests. (bsc#990847)
- CVE-2015-3200: Log injection via malformed base64 string in Authentication header.
(bsc#932286)
Bug fixes:
- Add su directive to logrotate file as the directory is owned by lighttpd. (bsc#981347)
- Fix out of bounds read in mod_scgi.