What is CVE-2016-1255?

CVE-2016-1255 is a high-severity vulnerability in Canonical Ubuntu Linux, classified under Improper Link Resolution Before File Access. CVSS score: 7.8/10. Published 2017-12-05.

How severe is CVE-2016-1255?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2016-1255 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Canonical Ubuntu Linux

CVE-2016-1255

The pg_ctlcluster script in postgresql-common package in Debian wheezy before 134wheezy5, in Debian jessie before 165+deb8u2, in Debian unstable before 178, in Ubuntu 12.04 LTS before 129ubuntu1.2, in Ubuntu 14.04 LTS before 154ubuntu1.1, in Ubuntu 16.04 LTS before 173ubuntu0.1, in Ubuntu 17.04 before 179ubuntu0.1, and in Ubuntu 17.10 before 184ubuntu1.1 allows local users to gain root privileges via a symlink attack on a logfile in /var/log/postgresql.

Published 2017-12-05 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.004 (34.0th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 34th percentile — 34.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

Canonical Ubuntu Linux — versions 12.04, 14.04, 16.04
Debian Linux — versions 7.0, 8.0
Debian Postgresql-Common — versions 71, 118, 123

Weakness classification (CWE)

CWE-59 — Improper Link Resolution Before File Access

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

lists.debian.org/debian-lts-announce/2017/01/msg00002.html (Vendor Advisory, mailing-list, Issue Tracking)
www.ubuntu.com/usn/USN-3476-1 (vendor-advisory, Third Party Advisory, Issue Tracking)
anonscm.debian.org/cgit/pkg-postgresql/postgresql-common.git/commit/ (Patch, Issue Tracking, Vendor Advisory)
www.ubuntu.com/usn/USN-3476-2 (vendor-advisory, Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2016-1255?: CVE-2016-1255 is a high-severity vulnerability in Canonical Ubuntu Linux, classified under Improper Link Resolution Before File Access. CVSS score: 7.8/10. Published 2017-12-05.
How severe is CVE-2016-1255?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2016-1255 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.