Vulnerability in Canonical Ubuntu Linux
CVE-2016-1255
The pg_ctlcluster script in postgresql-common package in Debian wheezy before 134wheezy5, in Debian jessie before 165+deb8u2, in Debian unstable before 178, in Ubuntu 12.04 LTS before 129ubuntu1.2, in Ubuntu 14.04 LTS before 154ubuntu1.1, in Ubuntu 16.04 LTS before 173ubuntu0.1, in Ubuntu 17.04 before 179ubuntu0.1, and in Ubuntu 17.10 before 184ubuntu1.1 allows local users to gain root privileges via a symlink attack on a logfile in /var/log/postgresql.
EPSS: 0.004 (34.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Canonical Ubuntu_linux — versions 12.04, 14.04, 16.04
- Debian Debian_linux — versions 7.0, 8.0
- Debian Postgresql-common — versions 1, 2, 3
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@debian.org (Vendor Advisory, mailing-list, x_refsource_MLIST, Issue Tracking)
- security@debian.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory, Issue Tracking)
- security@debian.org (x_refsource_CONFIRM, Patch, Issue Tracking, Vendor Advisory)
- security@debian.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2016-1255?
- CVE-2016-1255 is a high-severity vulnerability in Canonical Ubuntu Linux, classified under Improper Link Resolution Before File Access. CVSS score: 7.8/10. Published 2017-12-05.
- How severe is CVE-2016-1255?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2016-1255 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.