CVE-2016-1255

The pg_ctlcluster script in postgresql-common package in Debian wheezy before 134wheezy5, in Debian jessie before 165+deb8u2, in Debian unstable before 178, in Ubuntu 12.04 LTS before 129ubuntu1.2, in Ubuntu 14.04 LTS before 154ubuntu1.1, in Ubuntu 16.04 LTS before 173ubuntu0.1, in Ubuntu 17.04 before 179ubuntu0.1, and in Ubuntu 17.10 before 184ubuntu1.1 allows local users to gain root privileges via a symlink attack on a logfile in /var/log/postgresql.

• CWE-59

• http://www.ubuntu.com/usn/USN-3476-1Issue Tracking, Third Party Advisory
• http://www.ubuntu.com/usn/USN-3476-2Issue Tracking, Third Party Advisory
• https://anonscm.debian.org/cgit/pkg-postgresql/postgresql-common.git/commit/?id=c8989206ec360f199400c74f129f7b4cb878c1eeIssue Tracking, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2017/01/msg00002.htmlIssue Tracking, Vendor Advisory
• http://www.ubuntu.com/usn/USN-3476-1Issue Tracking, Third Party Advisory
• http://www.ubuntu.com/usn/USN-3476-2Issue Tracking, Third Party Advisory
• https://anonscm.debian.org/cgit/pkg-postgresql/postgresql-common.git/commit/?id=c8989206ec360f199400c74f129f7b4cb878c1eeIssue Tracking, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2017/01/msg00002.htmlIssue Tracking, Vendor Advisory

Published

Dec 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-1249The DBD::mysql module before 4.039 for Perl, when using serv…
• CVE-2016-1250Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-1251There is a vulnerability of type use-after-free affecting DB…
• CVE-2016-1252The apt package in Debian jessie before 1.0.9.8.4, in Debian…5.9
• CVE-2016-1253The most package in Debian wheezy before 5.0.0a-2.2, in Debi…
• CVE-2016-1254Tor before 0.2.8.12 might allow remote attackers to cause a …
• CVE-2016-1256Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-…
• CVE-2016-1257The Routing Engine in Juniper Junos OS 13.2R5 through 13.2R8…
• CVE-2016-1258Embedthis Appweb, as used in J-Web in Juniper Junos OS befor…
• CVE-2016-1260Juniper Junos OS before 13.2X51-D36, 14.1X53 before 14.1X53-…
• CVE-2016-1261J-Web does not validate certain input that may lead to cross…7.1
• CVE-2016-1262Juniper Junos OS before 12.1X46-D45, 12.1X47 before 12.1X47-…