CVE-2017-8806
The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the...
CVE-2017-8806 is a medium vulnerability (CVSS 5.5) in Postgresql, published November 9, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in postgresql-common 188.
The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.
- Record
CVE-2017-8806- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 3.6 Low
AV:L/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.
- Record
CVE-2017-8806- Updated
- 2026-11-02
EUVDEUVD-2017-17749 No score
The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.
- Record
EUVD-2017-17749- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xg92-g8h7-v7r4
The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the...
The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.
- Record
GHSA-xg92-g8h7-v7r4- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSV
The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.
- Record
CVE-2017-8806- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-8806
The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.
- Record
DEBIAN-CVE-2017-8806- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-8806
The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.
- Record
UBUNTU-CVE-2017-8806- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUSN-3476-1 No score
postgresql-common vulnerabilities
Dawid Golunski discovered that the postgresql-common pg_ctlcluster script incorrectly handled symlinks. A local attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-1255)
It was discovered that the postgresql-common helper scripts incorrectly handled symlinks. A local attacker could possibly use this issue to escalate privileges. (CVE-2017-8806)
- Record
USN-3476-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
postgresql-commonDebian:12 |
before 188 | 188 |
postgresql-commonDebian:13 |
before 188 | 188 |
postgresql-commonDebian:14 |
before 188 | 188 |
postgresql-commonDebian:7 |
before 134wheezy6, plus listed versions 134wheezy3134wheezy4134wheezy4~bpo60+1134wheezy5 |
134wheezy6 |
postgresql-commonDebian:8 |
before 165+deb8u3, plus listed versions 165165+deb8u1165+deb8u1~bpo7+1165+deb8u2165+deb8u2~bpo7+1 |
165+deb8u3 |
postgresql-commonDebian:9 |
before 181+deb9u1, plus listed versions 181181+deb9u1~bpo8+1 |
181+deb9u1 |
postgresql-commonUbuntu:14.04:LTS |
before 154ubuntu1.1, plus listed versions 148150151152153153bzr1154154ubuntu1 |
154ubuntu1.1 |
postgresql-commonUbuntu:16.04:LTS |
before 173ubuntu0.1, plus listed versions 169git1170171172172ubuntu1173 |
173ubuntu0.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |