{"id":"CVE-2017-8806","aliases":["DEBIAN-CVE-2017-8806","DLA-1169-1","DSA-4029-1","EUVD-2017-17749","GHSA-xg92-g8h7-v7r4","UBUNTU-CVE-2017-8806","USN-3476-1"],"status":"published","title":"The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the...","description":"The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00419,"percentile":0.36506,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2017-11-09T00:00:00Z","modified":"2026-09-01T20:03:51Z","fixes":[{"ecosystem":"Debian:12","package":"postgresql-common","fixed_in":["188"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"postgresql-common","fixed_in":["188"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"postgresql-common","fixed_in":["188"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"postgresql-common","fixed_in":["134wheezy6"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"postgresql-common","fixed_in":["165+deb8u3"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"postgresql-common","fixed_in":["181+deb9u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"postgresql-common","fixed_in":["154ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"postgresql-common","fixed_in":["173ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"188"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"188"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"188"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"134wheezy6"}]}],"versions":["134wheezy3","134wheezy4","134wheezy4~bpo60+1","134wheezy5"]},{"source":"osv","ecosystem":"Debian:8","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"165+deb8u3"}]}],"versions":["165","165+deb8u1","165+deb8u1~bpo7+1","165+deb8u2","165+deb8u2~bpo7+1"]},{"source":"osv","ecosystem":"Debian:9","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"181+deb9u1"}]}],"versions":["181","181+deb9u1~bpo8+1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"154ubuntu1.1"}]}],"versions":["148","150","151","152","153","153bzr1","154","154ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"173ubuntu0.1"}]}],"versions":["169git1","170","171","172","172ubuntu1","173"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"154ubuntu1.1"}]}],"versions":["148","150","151","152","153","153bzr1","154","154ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"postgresql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"173ubuntu0.1"}]}],"versions":["169git1","170","171","172","172ubuntu1","173"],"bundled":2}],"products":[{"vendor":"postgresql","product":"postgresql"}],"references":[{"url":"http://metadata.ftp-master.debian.org/changelogs/main/p/postgresql-common/postgresql-common_181+deb9u1_changelog","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Issue Tracking","Third Party Advisory","advisory","report","web"]},{"url":"http://www.securityfocus.com/bid/101810","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://usn.ubuntu.com/usn/usn-3476-1/","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2017/dsa-4029","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8806"},{"url":"https://usn.ubuntu.com/usn/usn-3476-1"},{"url":"https://github.com/advisories/GHSA-xg92-g8h7-v7r4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-8806","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-8806","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3476-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3476-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1255","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-8806","description":"The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.","status":"published","published":"2017-11-13T09:00:00Z","modified":"2024-08-05T16:48:21.905Z","updated_at":"2026-11-02T14:33:15.201133Z"}],"euvd":[{"id":"EUVD-2017-17749","description":"The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.","status":"published","published":"2017-11-13T09:00:00Z","modified":"2024-08-05T16:48:21Z","updated_at":"2026-11-03T02:23:29.67797Z"}],"ghsa":[{"id":"GHSA-xg92-g8h7-v7r4","title":"The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the...","description":"The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.","status":"published","published":"2022-05-17T00:17:10Z","modified":"2024-04-11T05:04:45Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:57:05.919117Z"}],"nvd":[{"id":"CVE-2017-8806","description":"The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.","status":"published","published":"2017-11-13T09:29:00.403Z","modified":"2026-06-17T01:26:59.713Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:04:08.635428Z"}],"osv":[{"id":"CVE-2017-8806","description":"The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.","status":"published","published":"2017-11-13T09:29:00Z","modified":"2026-04-10T04:02:16.444862Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-8806","description":"The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.","status":"published","published":"2017-11-13T09:29:00.403Z","modified":"2026-09-01T20:03:51.10751721Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-8806","description":"The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.","status":"published","published":"2017-11-09T00:00:00Z","modified":"2026-02-04T03:34:35.816308Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DLA-1169-1","title":"postgresql-common - security update","status":"published","published":"2017-11-11T00:00:00Z","modified":"2026-03-09T01:01:43.627916Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4029-1","title":"postgresql-common - security update","status":"published","published":"2017-11-09T00:00:00Z","modified":"2026-03-09T01:23:04.661314Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"USN-3476-1","title":"postgresql-common vulnerabilities","description":"Dawid Golunski discovered that the postgresql-common pg_ctlcluster script\nincorrectly handled symlinks. A local attacker could possibly use this\nissue to escalate privileges. This issue only affected Ubuntu 14.04 LTS and\nUbuntu 16.04 LTS. (CVE-2016-1255)\n\nIt was discovered that the postgresql-common helper scripts incorrectly\nhandled symlinks. A local attacker could possibly use this issue to\nescalate privileges. (CVE-2017-8806)\n","status":"published","published":"2017-11-09T19:28:04Z","modified":"2026-02-10T04:41:14Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}