CVE catalog

CVE-2017-8921

flightgear: CVE-2017-8921

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.42% · Oct 25, 2026

In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the contents of a FlightGear flightplan (XML). A resource such as a malicious third-party aircraft could exploit this to damage files belonging to the user. Both this issue and CVE-2016-9956 are directory traversal vulnerabilities in Autopilot/route_mgr.cxx - this one exists because of an incomplete fix for CVE-2016-9956.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianflightgearsid1:2024.1.5+dfsg-1fixed
Debianflightgeartrixie1:2020.3.19+dfsg-1fixed
Debianflightgearbookworm1:2020.3.16+dfsg-1+deb12u1fixed
Ubuntuflightgear16.043.4.0-1build1vulnerable
Ubuntuflightgear16.043.4.0-2vulnerable
Ubuntuflightgear16.043.4.0-3vulnerable
Ubuntuflightgear16.043.4.0-3ubuntu1vulnerable
Ubuntuflightgear16.043.4.0-3ubuntu1.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianflightgearsourcesid1:2016.4.4+dfsg-3not yet assignedNot reported[862689]
Debianflightgearsourcetrixie1:2016.4.4+dfsg-3not yet assignedNot reported[862689]
Debianflightgearsourcebookworm1:2016.4.4+dfsg-3not yet assignedNot reported[862689]

[Debian bug #862689]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [flightgear]Fixed
    Details (2)

    • 1:2020.3.16+dfsg-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1:2016.4.4+dfsg-3

      dsa · flightgear · debian · bookworm

    • 1:2020.3.16+dfsg-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1:2016.4.4+dfsg-3

      dsa · flightgear · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]