{"id":"CVE-2017-8921","aliases":["DEBIAN-CVE-2017-8921","EUVD-2017-17861","GHSA-cm86-qqq5-r5v2","UBUNTU-CVE-2017-8921"],"status":"published","title":"In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has...","description":"In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the contents of a FlightGear flightplan (XML). A resource such as a malicious third-party aircraft could exploit this to damage files belonging to the user. Both this issue and CVE-2016-9956 are directory traversal vulnerabilities in Autopilot/route_mgr.cxx - this one exists because of an incomplete fix for CVE-2016-9956.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.0142,"percentile":0.72989,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2017-05-12T19:00:00Z","modified":"2026-10-15T18:00:05Z","fixes":[{"ecosystem":"Debian:12","package":"flightgear","fixed_in":["1:2016.4.4+dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flightgear","fixed_in":["1:2016.4.4+dfsg-3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"flightgear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2016.4.4+dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"flightgear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2016.4.4+dfsg-3"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"flightgear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.0-1build1","3.4.0-2","3.4.0-3","3.4.0-3ubuntu1","3.4.0-3ubuntu1.1"]}],"products":[{"vendor":"flightgear","product":"flightgear"}],"references":[{"url":"https://sourceforge.net/p/flightgear/flightgear/ci/faf872e7f71ca14c567ac7080561fc785d8d2fd0/","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8921"},{"url":"https://sourceforge.net/p/flightgear/flightgear/ci/faf872e7f71ca14c567ac7080561fc785d8d2fd0"},{"url":"https://github.com/advisories/GHSA-cm86-qqq5-r5v2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-8921","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-8921","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8921","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-8921","description":"In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the contents of a FlightGear flightplan (XML). A resource such as a malicious third-party aircraft could exploit this to damage files belonging to the user. Both this issue and CVE-2016-9956 are directory traversal vulnerabilities in Autopilot/route_mgr.cxx - this one exists because of an incomplete fix for CVE-2016-9956.","status":"published","published":"2017-05-12T19:00:00Z","modified":"2024-09-16T23:56:50.86Z","updated_at":"2026-11-02T14:33:14.89365Z"}],"euvd":[{"id":"EUVD-2017-17861","description":"In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the contents of a FlightGear flightplan (XML). A resource such as a malicious third-party aircraft could exploit this to damage files belonging to the user. Both this issue and CVE-2016-9956 are directory traversal vulnerabilities in Autopilot/route_mgr.cxx - this one exists because of an incomplete fix for CVE-2016-9956.","status":"published","published":"2017-05-12T19:00:00Z","modified":"2024-09-16T23:56:50Z","updated_at":"2026-11-03T00:29:03.409164Z"}],"ghsa":[{"id":"GHSA-cm86-qqq5-r5v2","title":"In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has...","description":"In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the contents of a FlightGear flightplan (XML). A resource such as a malicious third-party aircraft could exploit this to damage files belonging to the user. Both this issue and CVE-2016-9956 are directory traversal vulnerabilities in Autopilot/route_mgr.cxx - this one exists because of an incomplete fix for CVE-2016-9956.","status":"published","published":"2022-05-17T02:43:41Z","modified":"2025-04-20T03:37:39Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:01:45.195531Z"}],"nvd":[{"id":"CVE-2017-8921","description":"In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the contents of a FlightGear flightplan (XML). A resource such as a malicious third-party aircraft could exploit this to damage files belonging to the user. Both this issue and CVE-2016-9956 are directory traversal vulnerabilities in Autopilot/route_mgr.cxx - this one exists because of an incomplete fix for CVE-2016-9956.","status":"published","published":"2017-05-12T19:29:00.3Z","modified":"2026-06-17T01:27:12.34Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:03:47.848196Z"}],"osv":[{"id":"CVE-2017-8921","description":"In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the contents of a FlightGear flightplan (XML). A resource such as a malicious third-party aircraft could exploit this to damage files belonging to the user. Both this issue and CVE-2016-9956 are directory traversal vulnerabilities in Autopilot/route_mgr.cxx - this one exists because of an incomplete fix for CVE-2016-9956.","status":"published","published":"2017-05-12T19:29:00.3Z","modified":"2026-03-14T09:25:12.577286Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-8921","description":"In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the contents of a FlightGear flightplan (XML). A resource such as a malicious third-party aircraft could exploit this to damage files belonging to the user. Both this issue and CVE-2016-9956 are directory traversal vulnerabilities in Autopilot/route_mgr.cxx - this one exists because of an incomplete fix for CVE-2016-9956.","status":"published","published":"2017-05-12T19:29:00.3Z","modified":"2026-10-15T18:00:05.372932093Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-8921","description":"In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the contents of a FlightGear flightplan (XML). A resource such as a malicious third-party aircraft could exploit this to damage files belonging to the user. Both this issue and CVE-2016-9956 are directory traversal vulnerabilities in Autopilot/route_mgr.cxx - this one exists because of an incomplete fix for CVE-2016-9956.","status":"published","published":"2017-05-12T19:29:00Z","modified":"2025-10-24T04:46:19Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:16.154988Z"}]}}