Description
The pg_ctlcluster script in postgresql-common package in Debian wheezy before 134wheezy5, in Debian jessie before 165+deb8u2, in Debian unstable before 178, in Ubuntu 12.04 LTS before 129ubuntu1.2, in Ubuntu 14.04 LTS before 154ubuntu1.1, in Ubuntu 16.04 LTS before 173ubuntu0.1, in Ubuntu 17.04 before 179ubuntu0.1, and in Ubuntu 17.10 before 184ubuntu1.1 allows local users to gain root privileges via a symlink attack on a logfile in /var/log/postgresql.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | postgresql-common | 178 | — |
| Debian 13 | postgresql-common | 178 | — |
| Debian 12 | postgresql-common | 178 | — |
| Debian 7 | postgresql-common | 134wheezy5 | DLA-774-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | postgresql-common | 173ubuntu0.1 | USN-3476-1 |
| Ubuntu 14.04 LTS | postgresql-common | 154ubuntu1.1 | USN-3476-1 |
Advisories 3
- DLA-774-1 postgresql-common - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3476-1 postgresql-common vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- WID-SEC-2024-0143 PostgreSQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 31, 2025