CVEvulnerability

CVE-2016-1255

7.8 HIGH Published 2017-12-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-12-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.8 HIGH — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-59

Description

The pg_ctlcluster script in postgresql-common package in Debian wheezy before 134wheezy5, in Debian jessie before 165+deb8u2, in Debian unstable before 178, in Ubuntu 12.04 LTS before 129ubuntu1.2, in Ubuntu 14.04 LTS before 154ubuntu1.1, in Ubuntu 16.04 LTS before 173ubuntu0.1, in Ubuntu 17.04 before 179ubuntu0.1, and in Ubuntu 17.10 before 184ubuntu1.1 allows local users to gain root privileges via a symlink attack on a logfile in /var/log/postgresql.

Affected configurations

• debian postgresql-common 1 • debian postgresql-common 2 • debian postgresql-common 3 • debian postgresql-common 4 • debian postgresql-common 5 • debian postgresql-common 6 • debian postgresql-common 7 • debian postgresql-common 8 • debian postgresql-common 9 • debian postgresql-common 10 • debian postgresql-common 11 • debian postgresql-common 12 • debian postgresql-common 13 • debian postgresql-common 14 • debian postgresql-common 15 • debian postgresql-common 16 • debian postgresql-common 17 • debian postgresql-common 18 • debian postgresql-common 19 • debian postgresql-common 20 • debian postgresql-common 21 • debian postgresql-common 22 • debian postgresql-common 23 • debian postgresql-common 24 • debian postgresql-common 25 • debian postgresql-common 26 • debian postgresql-common 27 • debian postgresql-common 28 • debian postgresql-common 29 • debian postgresql-common 30 • debian postgresql-common 31 • debian postgresql-common 32 • debian postgresql-common 33 • debian postgresql-common 34 • debian postgresql-common 35 • debian postgresql-common 36 • debian postgresql-common 37 • debian postgresql-common 38 • debian postgresql-common 39 • debian postgresql-common 40 • debian postgresql-common 41 • debian postgresql-common 42 • debian postgresql-common 43 • debian postgresql-common 44 • debian postgresql-common 45 • debian postgresql-common 46 • debian postgresql-common 47 • debian postgresql-common 48 • debian postgresql-common 49 • debian postgresql-common 50 • debian postgresql-common 51 • debian postgresql-common 52 • debian postgresql-common 53 • debian postgresql-common 54 • debian postgresql-common 55 • debian postgresql-common 56 • debian postgresql-common 57 • debian postgresql-common 58 • debian postgresql-common 59 • debian postgresql-common 60 … and 124 more

Related

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References