← Back

CVE-2016-1255

nvd nist
Published: Dec 5, 2017Modified: May 13, 2026

JSON object

Loading...
7.8
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

The pg_ctlcluster script in postgresql-common package in Debian wheezy before 134wheezy5, in Debian jessie before 165+deb8u2, in Debian unstable before 178, in Ubuntu 12.04 LTS before 129ubuntu1.2, in Ubuntu 14.04 LTS before 154ubuntu1.1, in Ubuntu 16.04 LTS before 173ubuntu0.1, in Ubuntu 17.04 before 179ubuntu0.1, and in Ubuntu 17.10 before 184ubuntu1.1 allows local users to gain root privileges via a symlink attack on a logfile in /var/log/postgresql.

Affected (184)

Debian
1 product
Postgresql Common
Configuration A
1 platform
Running on/withPlatform Versions
Debian
Debian Linux
Version 7.0
Configuration B
150 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Debian
Postgresql Common
Version 100
Postgresql Common
Version 101
Postgresql Common
Version 102
Postgresql Common
Version 103
Postgresql Common
Version 104
Postgresql Common
Version 105
Postgresql Common
Version 106
Postgresql Common
Version 107
Postgresql Common
Version 108
Postgresql Common
Version 109
Postgresql Common
Version 10
Postgresql Common
Version 110
Postgresql Common
Version 111
Postgresql Common
Version 112
Postgresql Common
Version 113
Postgresql Common
Version 114
Postgresql Common
Version 115
Postgresql Common
Version 116
Postgresql Common
Version 117
Postgresql Common
Version 118
Postgresql Common
Version 119
Postgresql Common
Version 11
Postgresql Common
Version 120
Postgresql Common
Version 121
Postgresql Common
Version 123
Postgresql Common
Version 12
Postgresql Common
Version 130
Postgresql Common
Version 131
Postgresql Common
Version 132
Postgresql Common
Version 133
Postgresql Common
Version 134
Postgresql Common
Version 135
Postgresql Common
Version 136
Postgresql Common
Version 137
Postgresql Common
Version 138
Postgresql Common
Version 139
Postgresql Common
Version 13
Postgresql Common
Version 140
Postgresql Common
Version 141
Postgresql Common
Version 142
Postgresql Common
Version 143
Postgresql Common
Version 144
Postgresql Common
Version 145
Postgresql Common
Version 146
Postgresql Common
Version 147
Postgresql Common
Version 14
Postgresql Common
Version 155
Postgresql Common
Version 156
Postgresql Common
Version 157
Postgresql Common
Version 158
Postgresql Common
Version 159
Postgresql Common
Version 15
Postgresql Common
Version 160
Postgresql Common
Version 161
Postgresql Common
Version 162
Postgresql Common
Version 163
Postgresql Common
Version 164
Postgresql Common
Version 16
Postgresql Common
Version 17
Postgresql Common
Version 18
Postgresql Common
Version 19
Postgresql Common
Version 1
Postgresql Common
Version 20
Postgresql Common
Version 21
Postgresql Common
Version 22
Postgresql Common
Version 23
Postgresql Common
Version 24
Postgresql Common
Version 25
Postgresql Common
Version 26
Postgresql Common
Version 27
Postgresql Common
Version 28
Postgresql Common
Version 29
Postgresql Common
Version 2
Postgresql Common
Version 30
Postgresql Common
Version 31
Postgresql Common
Version 32
Postgresql Common
Version 33
Postgresql Common
Version 34
Postgresql Common
Version 35
Postgresql Common
Version 36
Postgresql Common
Version 37
Postgresql Common
Version 38
Postgresql Common
Version 39
Postgresql Common
Version 3
Postgresql Common
Version 40
Postgresql Common
Version 41
Postgresql Common
Version 42
Postgresql Common
Version 43
Postgresql Common
Version 44
Postgresql Common
Version 45
Postgresql Common
Version 46
Postgresql Common
Version 47
Postgresql Common
Version 48
Postgresql Common
Version 49
Postgresql Common
Version 4
Postgresql Common
Version 50
Postgresql Common
Version 51
Postgresql Common
Version 52
Postgresql Common
Version 53
Postgresql Common
Version 54
Postgresql Common
Version 55
Postgresql Common
Version 56
Postgresql Common
Version 57
Postgresql Common
Version 58
Postgresql Common
Version 59
Postgresql Common
Version 5
Postgresql Common
Version 60
Postgresql Common
Version 61
Postgresql Common
Version 62
Postgresql Common
Version 63
Postgresql Common
Version 64
Postgresql Common
Version 65
Postgresql Common
Version 66
Postgresql Common
Version 67
Postgresql Common
Version 68
Postgresql Common
Version 69
Postgresql Common
Version 6
Postgresql Common
Version 70
Postgresql Common
Version 71
Postgresql Common
Version 72
Postgresql Common
Version 73
Postgresql Common
Version 74
Postgresql Common
Version 75
Postgresql Common
Version 76
Postgresql Common
Version 77
Postgresql Common
Version 78
Postgresql Common
Version 79
Postgresql Common
Version 7
Postgresql Common
Version 80
Postgresql Common
Version 81
Postgresql Common
Version 82
Postgresql Common
Version 83
Postgresql Common
Version 84
Postgresql Common
Version 85
Postgresql Common
Version 86
Postgresql Common
Version 87
Postgresql Common
Version 88
Postgresql Common
Version 89
Postgresql Common
Version 8
Postgresql Common
Version 90
Postgresql Common
Version 91
Postgresql Common
Version 92
Postgresql Common
Version 93
Postgresql Common
Version 94
Postgresql Common
Version 95
Postgresql Common
Version 96
Postgresql Common
Version 97
Postgresql Common
Version 98
Postgresql Common
Version 99
Postgresql Common
Version 9
Running on/withPlatform Versions
Debian
Debian Linux
Version 8.0
Configuration C
9 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Debian
Postgresql Common
Version 122
Postgresql Common
Version 122ubuntu1
Postgresql Common
Version 124
Postgresql Common
Version 125
Postgresql Common
Version 126
Postgresql Common
Version 127
Postgresql Common
Version 128
Postgresql Common
Version 129
Postgresql Common
Version 129ubuntu1
Running on/withPlatform Versions
Canonical
Ubuntu Linux
Version 12.04
Configuration D
9 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Debian
Postgresql Common
Version 148
Postgresql Common
Version 149
Postgresql Common
Version 150
Postgresql Common
Version 151
Postgresql Common
Version 152
Postgresql Common
Version 153
Postgresql Common
Version 153bzr1
Postgresql Common
Version 154
Postgresql Common
Version 154ubuntu1
Running on/withPlatform Versions
Canonical
Ubuntu Linux
Version 14.04
Configuration E
6 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Debian
Postgresql Common
Version 169git1
Postgresql Common
Version 170
Postgresql Common
Version 171
Postgresql Common
Version 172
Postgresql Common
Version 172ubuntu1
Postgresql Common
Version 173
Running on/withPlatform Versions
Canonical
Ubuntu Linux
Version 16.04
Configuration F
4 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Debian
Postgresql Common
Version 176+git1
Postgresql Common
Version 177git1
Postgresql Common
Version 177ubuntu1
Postgresql Common
Version 178
Running on/withPlatform Versions
Canonical
Ubuntu Linux
Version 17.04
Configuration G
6 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Debian
Postgresql Common
Version 179
Postgresql Common
Version 181
Postgresql Common
Version 181ubuntu1
Postgresql Common
Version 183
Postgresql Common
Version 184
Postgresql Common
Version 184ubuntu1
Running on/withPlatform Versions
Canonical
Ubuntu Linux
Version 17.10

Related CWEs

CWE-59
Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (8)

Source: security@debian.org
Issue TrackingThird Party Advisory
Source: security@debian.org
Issue TrackingThird Party Advisory
Source: security@debian.org
Issue TrackingPatchVendor Advisory
Source: security@debian.org
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory

Timeline

No history available yet.