==========================================================================
Ubuntu Security Notice USN-3476-1
November 09, 2017

postgresql-common vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 17.10
– Ubuntu 17.04
– Ubuntu 16.04 LTS
– Ubuntu 14.04 LTS

Summary:

postgresql-common could be made to overwrite files as the administrator.

Software Description:
– postgresql-common: PostgreSQL database-cluster manager

Details:

Dawid Golunski discovered that the postgresql-common pg_ctlcluster script
incorrectly handled symlinks. A local attacker could possibly use this
issue to escalate privileges. This issue only affected Ubuntu 14.04 LTS and
Ubuntu 16.04 LTS. (CVE-2016-1255)

It was discovered that the postgresql-common helper scripts incorrectly
handled symlinks. A local attacker could possibly use this issue to
escalate privileges. (CVE-2017-8806)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
postgresql-common 184ubuntu1.1

Ubuntu 17.04:
postgresql-common 179ubuntu0.1

Ubuntu 16.04 LTS:
postgresql-common 173ubuntu0.1

Ubuntu 14.04 LTS:
postgresql-common 154ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
https://www.ubuntu.com/usn/usn-3476-1
CVE-2016-1255, CVE-2017-8806

Package Information:
https://launchpad.net/ubuntu/+source/postgresql-common/184ubuntu1.1
https://launchpad.net/ubuntu/+source/postgresql-common/179ubuntu0.1
https://launchpad.net/ubuntu/+source/postgresql-common/173ubuntu0.1
https://launchpad.net/ubuntu/+source/postgresql-common/154ubuntu1.1

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2

iQIcBAEBCgAGBQJaBMOrAAoJEGVp2FWnRL6TBcMP/iLAyLZmgsMDc4KyqmMSQ7Ok
KZeRt96KEvHyB+bFO83sEenOjPMdWSCBKp8rEKpXaXR3/gd/xe8huVip+c9eiIoq
JDeKWRJT/P59kQTEpMWDBxFfEhDvwpNRX6e0b4kvVZMRQed+iEa6eNDeTW+ixDul
BBEntTz0ovjD9m0Ty9DaVrUM5X/fXnRcvV1qgHPpUXKPZBehHgJownRQcxQJQEyx
8R5sPhN31q3VnULTnjREP7lDNz8jXb3+HbTsAXiph4ayn8Vi4Rn4pdqdJ7C5LQXb
mW3jBzcSYvwvpfpl3CnyNu+NKTE9wiXLj+H6H6z86EQyXe/QcDPnRaWKJCY5PgRa
mtUS9HR+O0525T3PGC6ZaKr9233AvSa7GCMIQAEYABgMHMiKpIt48isF8X3UFzpu
3xum9VPU9hOst5qiGUC1UtJLk0H1Tc2gz8bX/wOeY8UP2pguFp3wnjkut0FGQf/9
OIvQga1aEQu+7HVck64zAQ2L7wXZNHbuBwgM+0T2+7GyRg2h9gzpmlx5/b+eWlwp
OwzURxRVs4D3XqGkKMJFEYmmdd3Bil1bDCJukE3MasHgyKMvJthYAsc0qxmbvLIg
5PSgze3+frjD3gaIB3wBf6dtd6fF4VjXaLrjcZRxiGzzeFBAk5uRCHIdytQfb10A
XgpXy64ZNiWm1fHdXfL6
=CfEe
—–END PGP SIGNATURE—–
—