Vulnerability-Lookup

ubuntu-cve-2017-8806

Vulnerability from osv_ubuntu

Published

2017-11-09 00:00

Modified

2025-09-08 16:44

Summary

Details

The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.

Severity

5.5 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2017-8806	REPORT
	https://ubuntu.com/security/notices/USN-3476-1	ADVISORY
	https://ubuntu.com/security/notices/USN-3476-2	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2017-8806	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "postgresql",
            "binary_version": "9.3+154ubuntu1.1"
          },
          {
            "binary_name": "postgresql-client",
            "binary_version": "9.3+154ubuntu1.1"
          },
          {
            "binary_name": "postgresql-client-common",
            "binary_version": "154ubuntu1.1"
          },
          {
            "binary_name": "postgresql-common",
            "binary_version": "154ubuntu1.1"
          },
          {
            "binary_name": "postgresql-contrib",
            "binary_version": "9.3+154ubuntu1.1"
          },
          {
            "binary_name": "postgresql-server-dev-all",
            "binary_version": "154ubuntu1.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "postgresql-common",
        "purl": "pkg:deb/ubuntu/postgresql-common@154ubuntu1.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "154ubuntu1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "148",
        "150",
        "151",
        "152",
        "153",
        "153bzr1",
        "154",
        "154ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "postgresql",
            "binary_version": "9.5+173ubuntu0.1"
          },
          {
            "binary_name": "postgresql-client",
            "binary_version": "9.5+173ubuntu0.1"
          },
          {
            "binary_name": "postgresql-client-common",
            "binary_version": "173ubuntu0.1"
          },
          {
            "binary_name": "postgresql-common",
            "binary_version": "173ubuntu0.1"
          },
          {
            "binary_name": "postgresql-contrib",
            "binary_version": "9.5+173ubuntu0.1"
          },
          {
            "binary_name": "postgresql-server-dev-all",
            "binary_version": "173ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "postgresql-common",
        "purl": "pkg:deb/ubuntu/postgresql-common@173ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "173ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "169git1",
        "170",
        "171",
        "172",
        "172ubuntu1",
        "173"
      ]
    }
  ],
  "aliases": [],
  "details": "The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.",
  "id": "UBUNTU-CVE-2017-8806",
  "modified": "2025-09-08T16:44:15Z",
  "published": "2017-11-09T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-8806"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3476-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3476-2"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-8806"
    }
  ],
  "related": [
    "USN-3476-1",
    "USN-3476-2"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-8806"
  ]
}

CVE-2017-8806 (GCVE-0-2017-8806)

Vulnerability from cvelistv5 – Published: 2017-11-13 09:00 – Updated: 2024-08-05 16:48

Summary

Severity

No CVSS data available.

CWE

handled symbolic links insecurely

Assigner

debian

References

4 references

URL	Tags
http://metadata.ftp-master.debian.org/changelogs/…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/101810	vdb-entryx_refsource_BID
https://usn.ubuntu.com/usn/usn-3476-1/	x_refsource_CONFIRM
https://www.debian.org/security/2017/dsa-4029	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL-related scripts that are specific to Debian and Ubuntu	Affected: PostgreSQL-related scripts that are specific to Debian and Ubuntu

Date Public

2017-11-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:48:21.905Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://metadata.ftp-master.debian.org/changelogs/main/p/postgresql-common/postgresql-common_181+deb9u1_changelog"
          },
          {
            "name": "101810",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/101810"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/usn/usn-3476-1/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-4029"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PostgreSQL-related scripts that are specific to Debian and Ubuntu",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "PostgreSQL-related scripts that are specific to Debian and Ubuntu"
            }
          ]
        }
      ],
      "datePublic": "2017-11-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "handled symbolic links insecurely",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-16T10:57:01.000Z",
        "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
        "shortName": "debian"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://metadata.ftp-master.debian.org/changelogs/main/p/postgresql-common/postgresql-common_181+deb9u1_changelog"
        },
        {
          "name": "101810",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/101810"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://usn.ubuntu.com/usn/usn-3476-1/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.debian.org/security/2017/dsa-4029"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@debian.org",
          "ID": "CVE-2017-8806",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PostgreSQL-related scripts that are specific to Debian and Ubuntu",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "PostgreSQL-related scripts that are specific to Debian and Ubuntu"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "handled symbolic links insecurely"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://metadata.ftp-master.debian.org/changelogs/main/p/postgresql-common/postgresql-common_181+deb9u1_changelog",
              "refsource": "CONFIRM",
              "url": "http://metadata.ftp-master.debian.org/changelogs/main/p/postgresql-common/postgresql-common_181+deb9u1_changelog"
            },
            {
              "name": "101810",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/101810"
            },
            {
              "name": "https://usn.ubuntu.com/usn/usn-3476-1/",
              "refsource": "CONFIRM",
              "url": "https://usn.ubuntu.com/usn/usn-3476-1/"
            },
            {
              "name": "https://www.debian.org/security/2017/dsa-4029",
              "refsource": "CONFIRM",
              "url": "https://www.debian.org/security/2017/dsa-4029"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
    "assignerShortName": "debian",
    "cveId": "CVE-2017-8806",
    "datePublished": "2017-11-13T09:00:00.000Z",
    "dateReserved": "2017-05-07T00:00:00.000Z",
    "dateUpdated": "2024-08-05T16:48:21.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-3476-1

Vulnerability from osv_ubuntu

Published

2017-11-09 19:28

Modified

2026-02-10 04:41

Summary

postgresql-common vulnerabilities

Details

Dawid Golunski discovered that the postgresql-common pg_ctlcluster script incorrectly handled symlinks. A local attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-1255)

It was discovered that the postgresql-common helper scripts incorrectly handled symlinks. A local attacker could possibly use this issue to escalate privileges. (CVE-2017-8806)

References

URL

Type

	https://ubuntu.com/security/notices/USN-3476-1	ADVISORY
	https://ubuntu.com/security/CVE-2016-1255	REPORT
	https://ubuntu.com/security/CVE-2017-8806	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2016-1255",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-8806",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "postgresql",
            "binary_version": "9.3+154ubuntu1.1"
          },
          {
            "binary_name": "postgresql-client",
            "binary_version": "9.3+154ubuntu1.1"
          },
          {
            "binary_name": "postgresql-client-common",
            "binary_version": "154ubuntu1.1"
          },
          {
            "binary_name": "postgresql-common",
            "binary_version": "154ubuntu1.1"
          },
          {
            "binary_name": "postgresql-contrib",
            "binary_version": "9.3+154ubuntu1.1"
          },
          {
            "binary_name": "postgresql-server-dev-all",
            "binary_version": "154ubuntu1.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "postgresql-common",
        "purl": "pkg:deb/ubuntu/postgresql-common@154ubuntu1.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "154ubuntu1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "148",
        "150",
        "151",
        "152",
        "153",
        "153bzr1",
        "154",
        "154ubuntu1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2016-1255",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-8806",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "postgresql",
            "binary_version": "9.5+173ubuntu0.1"
          },
          {
            "binary_name": "postgresql-client",
            "binary_version": "9.5+173ubuntu0.1"
          },
          {
            "binary_name": "postgresql-client-common",
            "binary_version": "173ubuntu0.1"
          },
          {
            "binary_name": "postgresql-common",
            "binary_version": "173ubuntu0.1"
          },
          {
            "binary_name": "postgresql-contrib",
            "binary_version": "9.5+173ubuntu0.1"
          },
          {
            "binary_name": "postgresql-server-dev-all",
            "binary_version": "173ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "postgresql-common",
        "purl": "pkg:deb/ubuntu/postgresql-common@173ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "173ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "169git1",
        "170",
        "171",
        "172",
        "172ubuntu1",
        "173"
      ]
    }
  ],
  "aliases": [],
  "details": "Dawid Golunski discovered that the postgresql-common pg_ctlcluster script\nincorrectly handled symlinks. A local attacker could possibly use this\nissue to escalate privileges. This issue only affected Ubuntu 14.04 LTS and\nUbuntu 16.04 LTS. (CVE-2016-1255)\n\nIt was discovered that the postgresql-common helper scripts incorrectly\nhandled symlinks. A local attacker could possibly use this issue to\nescalate privileges. (CVE-2017-8806)\n",
  "id": "USN-3476-1",
  "modified": "2026-02-10T04:41:14Z",
  "published": "2017-11-09T19:28:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3476-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1255"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-8806"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "postgresql-common vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2016-1255",
    "UBUNTU-CVE-2017-8806"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2017-8806

Vulnerability from osv_ubuntu

CVE-2017-8806 (GCVE-0-2017-8806)

usn-3476-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature