CVE-2016-1255
Summary
| CVE | CVE-2016-1255 |
|---|---|
| State | PUBLISHED |
| Assigner | debian |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-12-05 16:29:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | The pg_ctlcluster script in postgresql-common package in Debian wheezy before 134wheezy5, in Debian jessie before 165+deb8u2, in Debian unstable before 178, in Ubuntu 12.04 LTS before 129ubuntu1.2, in Ubuntu 14.04 LTS before 154ubuntu1.1, in Ubuntu 16.04 LTS before 173ubuntu0.1, in Ubuntu 17.04 before 179ubuntu0.1, and in Ubuntu 17.10 before 184ubuntu1.1 allows local users to gain root privileges via a symlink attack on a logfile in /var/log/postgresql. |
Risk And Classification
Primary CVSS: v3.0 7.8 HIGH from [email protected]
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-59 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 7.8 | HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
CVSS v3.0 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
LowAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:L/AC:L/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 7.0 | All | All | All |
| Application | Debian | Postgresql-common | 1 | All | All | All |
| Application | Debian | Postgresql-common | 10 | All | All | All |
| Application | Debian | Postgresql-common | 100 | All | All | All |
| Application | Debian | Postgresql-common | 101 | All | All | All |
| Application | Debian | Postgresql-common | 102 | All | All | All |
| Application | Debian | Postgresql-common | 103 | All | All | All |
| Application | Debian | Postgresql-common | 104 | All | All | All |
| Application | Debian | Postgresql-common | 105 | All | All | All |
| Application | Debian | Postgresql-common | 106 | All | All | All |
| Application | Debian | Postgresql-common | 107 | All | All | All |
| Application | Debian | Postgresql-common | 108 | All | All | All |
| Application | Debian | Postgresql-common | 109 | All | All | All |
| Application | Debian | Postgresql-common | 11 | All | All | All |
| Application | Debian | Postgresql-common | 110 | All | All | All |
| Application | Debian | Postgresql-common | 111 | All | All | All |
| Application | Debian | Postgresql-common | 112 | All | All | All |
| Application | Debian | Postgresql-common | 113 | All | All | All |
| Application | Debian | Postgresql-common | 114 | All | All | All |
| Application | Debian | Postgresql-common | 115 | All | All | All |
| Application | Debian | Postgresql-common | 116 | All | All | All |
| Application | Debian | Postgresql-common | 117 | All | All | All |
| Application | Debian | Postgresql-common | 118 | All | All | All |
| Application | Debian | Postgresql-common | 119 | All | All | All |
| Application | Debian | Postgresql-common | 12 | All | All | All |
| Application | Debian | Postgresql-common | 120 | All | All | All |
| Application | Debian | Postgresql-common | 121 | All | All | All |
| Application | Debian | Postgresql-common | 122 | All | All | All |
| Application | Debian | Postgresql-common | 123 | All | All | All |
| Application | Debian | Postgresql-common | 124 | All | All | All |
| Application | Debian | Postgresql-common | 125 | All | All | All |
| Application | Debian | Postgresql-common | 126 | All | All | All |
| Application | Debian | Postgresql-common | 127 | All | All | All |
| Application | Debian | Postgresql-common | 128 | All | All | All |
| Application | Debian | Postgresql-common | 129 | All | All | All |
| Application | Debian | Postgresql-common | 13 | All | All | All |
| Application | Debian | Postgresql-common | 130 | All | All | All |
| Application | Debian | Postgresql-common | 131 | All | All | All |
| Application | Debian | Postgresql-common | 132 | All | All | All |
| Application | Debian | Postgresql-common | 133 | All | All | All |
| Application | Debian | Postgresql-common | 14 | All | All | All |
| Application | Debian | Postgresql-common | 15 | All | All | All |
| Application | Debian | Postgresql-common | 16 | All | All | All |
| Application | Debian | Postgresql-common | 17 | All | All | All |
| Application | Debian | Postgresql-common | 18 | All | All | All |
| Application | Debian | Postgresql-common | 19 | All | All | All |
| Application | Debian | Postgresql-common | 2 | All | All | All |
| Application | Debian | Postgresql-common | 20 | All | All | All |
| Application | Debian | Postgresql-common | 21 | All | All | All |
| Application | Debian | Postgresql-common | 22 | All | All | All |
| Application | Debian | Postgresql-common | 23 | All | All | All |
| Application | Debian | Postgresql-common | 24 | All | All | All |
| Application | Debian | Postgresql-common | 25 | All | All | All |
| Application | Debian | Postgresql-common | 26 | All | All | All |
| Application | Debian | Postgresql-common | 27 | All | All | All |
| Application | Debian | Postgresql-common | 28 | All | All | All |
| Application | Debian | Postgresql-common | 29 | All | All | All |
| Application | Debian | Postgresql-common | 3 | All | All | All |
| Application | Debian | Postgresql-common | 30 | All | All | All |
| Application | Debian | Postgresql-common | 31 | All | All | All |
| Application | Debian | Postgresql-common | 32 | All | All | All |
| Application | Debian | Postgresql-common | 33 | All | All | All |
| Application | Debian | Postgresql-common | 34 | All | All | All |
| Application | Debian | Postgresql-common | 35 | All | All | All |
| Application | Debian | Postgresql-common | 36 | All | All | All |
| Application | Debian | Postgresql-common | 37 | All | All | All |
| Application | Debian | Postgresql-common | 38 | All | All | All |
| Application | Debian | Postgresql-common | 39 | All | All | All |
| Application | Debian | Postgresql-common | 4 | All | All | All |
| Application | Debian | Postgresql-common | 40 | All | All | All |
| Application | Debian | Postgresql-common | 41 | All | All | All |
| Application | Debian | Postgresql-common | 42 | All | All | All |
| Application | Debian | Postgresql-common | 43 | All | All | All |
| Application | Debian | Postgresql-common | 44 | All | All | All |
| Application | Debian | Postgresql-common | 45 | All | All | All |
| Application | Debian | Postgresql-common | 46 | All | All | All |
| Application | Debian | Postgresql-common | 47 | All | All | All |
| Application | Debian | Postgresql-common | 48 | All | All | All |
| Application | Debian | Postgresql-common | 49 | All | All | All |
| Application | Debian | Postgresql-common | 5 | All | All | All |
| Application | Debian | Postgresql-common | 50 | All | All | All |
| Application | Debian | Postgresql-common | 51 | All | All | All |
| Application | Debian | Postgresql-common | 52 | All | All | All |
| Application | Debian | Postgresql-common | 53 | All | All | All |
| Application | Debian | Postgresql-common | 54 | All | All | All |
| Application | Debian | Postgresql-common | 55 | All | All | All |
| Application | Debian | Postgresql-common | 56 | All | All | All |
| Application | Debian | Postgresql-common | 57 | All | All | All |
| Application | Debian | Postgresql-common | 58 | All | All | All |
| Application | Debian | Postgresql-common | 59 | All | All | All |
| Application | Debian | Postgresql-common | 6 | All | All | All |
| Application | Debian | Postgresql-common | 60 | All | All | All |
| Application | Debian | Postgresql-common | 61 | All | All | All |
| Application | Debian | Postgresql-common | 62 | All | All | All |
| Application | Debian | Postgresql-common | 63 | All | All | All |
| Application | Debian | Postgresql-common | 64 | All | All | All |
| Application | Debian | Postgresql-common | 65 | All | All | All |
| Application | Debian | Postgresql-common | 66 | All | All | All |
| Application | Debian | Postgresql-common | 67 | All | All | All |
| Application | Debian | Postgresql-common | 68 | All | All | All |
| Application | Debian | Postgresql-common | 69 | All | All | All |
| Application | Debian | Postgresql-common | 7 | All | All | All |
| Application | Debian | Postgresql-common | 70 | All | All | All |
| Application | Debian | Postgresql-common | 71 | All | All | All |
| Application | Debian | Postgresql-common | 72 | All | All | All |
| Application | Debian | Postgresql-common | 73 | All | All | All |
| Application | Debian | Postgresql-common | 74 | All | All | All |
| Application | Debian | Postgresql-common | 75 | All | All | All |
| Application | Debian | Postgresql-common | 76 | All | All | All |
| Application | Debian | Postgresql-common | 77 | All | All | All |
| Application | Debian | Postgresql-common | 78 | All | All | All |
| Application | Debian | Postgresql-common | 79 | All | All | All |
| Application | Debian | Postgresql-common | 8 | All | All | All |
| Application | Debian | Postgresql-common | 80 | All | All | All |
| Application | Debian | Postgresql-common | 81 | All | All | All |
| Application | Debian | Postgresql-common | 82 | All | All | All |
| Application | Debian | Postgresql-common | 83 | All | All | All |
| Application | Debian | Postgresql-common | 84 | All | All | All |
| Application | Debian | Postgresql-common | 85 | All | All | All |
| Application | Debian | Postgresql-common | 86 | All | All | All |
| Application | Debian | Postgresql-common | 87 | All | All | All |
| Application | Debian | Postgresql-common | 88 | All | All | All |
| Application | Debian | Postgresql-common | 89 | All | All | All |
| Application | Debian | Postgresql-common | 9 | All | All | All |
| Application | Debian | Postgresql-common | 90 | All | All | All |
| Application | Debian | Postgresql-common | 91 | All | All | All |
| Application | Debian | Postgresql-common | 92 | All | All | All |
| Application | Debian | Postgresql-common | 93 | All | All | All |
| Application | Debian | Postgresql-common | 94 | All | All | All |
| Application | Debian | Postgresql-common | 95 | All | All | All |
| Application | Debian | Postgresql-common | 96 | All | All | All |
| Application | Debian | Postgresql-common | 97 | All | All | All |
| Application | Debian | Postgresql-common | 98 | All | All | All |
| Application | Debian | Postgresql-common | 99 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] [DLA-774-1] postgresql-common security update | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | Issue Tracking, Vendor Advisory |
| pg_ctlcluster: Protect against symlink in /var/log/postgresql/ allowing the... (c8989206) · Commits · PostgreSQL / postgresql-common · GitLab | af854a3a-2127-422b-91ae-364da2661108 | anonscm.debian.org | Issue Tracking, Patch, Vendor Advisory |
| USN-3476-2: postgresql-common vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | Issue Tracking, Third Party Advisory |
| USN-3476-1: postgresql-common vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | Issue Tracking, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.