Launchpad.net

CVE 2017-8806

The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.

Related bugs and status

CVE-2017-8806 (Candidate) is related to these bugs:

Bug #1727209: symlink attack vulnerability in init/helper scripts

		In	Importance	Status
1727209	symlink attack vulnerability in init/helper scripts	postgresql-common (Ubuntu)	Undecided	Fix Released
1727209	symlink attack vulnerability in init/helper scripts	postgresql-common (Ubuntu Zesty)	Undecided	Fix Released
1727209	symlink attack vulnerability in init/helper scripts	postgresql-common (Ubuntu Bionic)	Undecided	Fix Released
1727209	symlink attack vulnerability in init/helper scripts	postgresql-common (Ubuntu Xenial)	Undecided	Fix Released
1727209	symlink attack vulnerability in init/helper scripts	postgresql-common (Ubuntu Trusty)	Undecided	Fix Released
1727209	symlink attack vulnerability in init/helper scripts	postgresql-common (Ubuntu Artful)	Undecided	Fix Released
1727209	symlink attack vulnerability in init/helper scripts	postgresql-common (Ubuntu Precise)	Undecided	Fix Released

See the

CVE page on Mitre.org for more details.

Launchpad.net

CVE 2017-8806

Related bugs and status

Related bugs

References