Candidate: CVE-2017-8921
PublicDate: 2017-05-12 19:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8921
 https://sourceforge.net/p/flightgear/flightgear/ci/faf872e7f71ca14c567ac7080561fc785d8d2fd0/
Description:
 In FlightGear before 2017.2.1, the FGCommand interface allows overwriting
 any file the user has write access to, but not with arbitrary data: only
 with the contents of a FlightGear flightplan (XML). A resource such as a
 malicious third-party aircraft could exploit this to damage files belonging
 to the user. Both this issue and CVE-2016-9956 are directory traversal
 vulnerabilities in Autopilot/route_mgr.cxx - this one exists because of an
 incomplete fix for CVE-2016-9956.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=862689
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N [7.5 HIGH]

Patches_flightgear:
 upstream: https://sourceforge.net/p/flightgear/flightgear/ci/faf872e7f71ca14c567ac7080561fc785d8d2fd0/
 upstream: https://sourceforge.net/p/flightgear/flightgear/ci/19ab09406e4249f2c6f8ac51938258d1c51eace0/
 upstream: https://sourceforge.net/p/flightgear/flightgear/ci/c8250b10bb9a116889f831d2299678b0ef70fec2/
upstream_flightgear: released (2017.2.1)
precise/esm_flightgear: DNE
trusty_flightgear: ignored (reached end-of-life)
trusty/esm_flightgear: DNE (trusty was needed)
vivid/stable-phone-overlay_flightgear: DNE
vivid/ubuntu-core_flightgear: DNE
xenial_flightgear: ignored (end of standard support, was needed)
yakkety_flightgear: ignored (reached end-of-life)
zesty_flightgear: ignored (reached end-of-life)
artful_flightgear: not-affected (1:2017.2.1+dfsg-4)
bionic_flightgear: not-affected (1:2017.2.1+dfsg-4)
cosmic_flightgear: not-affected (1:2017.2.1+dfsg-4)
disco_flightgear: not-affected (1:2017.2.1+dfsg-4)
eoan_flightgear: not-affected (1:2017.2.1+dfsg-4)
focal_flightgear: not-affected (1:2017.2.1+dfsg-4)
groovy_flightgear: not-affected (1:2017.2.1+dfsg-4)
hirsute_flightgear: not-affected (1:2017.2.1+dfsg-4)
impish_flightgear: not-affected (1:2017.2.1+dfsg-4)
jammy_flightgear: not-affected (1:2017.2.1+dfsg-4)
devel_flightgear: not-affected (1:2017.2.1+dfsg-4)