https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:13:37 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:42736 <p><strong>Affected:</strong> AlmaLinux:9: acl, AlmaLinux:9: libacl, AlmaLinux:9: libacl-devel</p> <p>Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.</p> <p>Security Fix(es):</p> <p>* acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369) * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: acl, AlmaLinux:9: libacl, AlmaLinux:9: libacl-devel</p> <p>Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.</p> <p>Security Fix(es):</p> <p>* acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369) * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:42736 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/euvd-2026-336899 EUVD-2026-336899 https://cve.radiocsirt.org/vuln/euvd-2026-336899 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54370 <p>acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.</p> <p>acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54370 https://cve.radiocsirt.org/vuln/ghsa-r45p-762r-6pqj <p>acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.</p> <p>acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.</p> https://cve.radiocsirt.org/vuln/ghsa-r45p-762r-6pqj https://cve.radiocsirt.org/vuln/oesa-2026-3079 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: acl, openEuler:22.03-LTS-SP4: acl, openEuler:24.03-LTS-SP1: acl, openEuler:24.03-LTS-SP3: acl, openEuler:24.03-LTS-SP4: acl</p> <p>This package contains commands for manipulating POSIX access control lists, and the libacl.so dynamic library which contains the POSIX 1003.1e draft standard 17 functions for manipulating access control lists. Security Fix(es):</p> <p>acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.(CVE-2026-54369)</p> <p>acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.(CVE-2026-54370)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: acl, openEuler:22.03-LTS-SP4: acl, openEuler:24.03-LTS-SP1: acl, openEuler:24.03-LTS-SP3: acl, openEuler:24.03-LTS-SP4: acl</p> <p>This package contains commands for manipulating POSIX access control lists, and the libacl.so dynamic library which contains the POSIX 1003.1e draft standard 17 functions for manipulating access control lists. Security Fix(es):</p> <p>acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.(CVE-2026-54369)</p> <p>acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.(CVE-2026-54370)</p> https://cve.radiocsirt.org/vuln/oesa-2026-3079 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11312-1 <p>acl-2.4.0-1.1 on GA media</p> <p>acl-2.4.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11312-1 https://cve.radiocsirt.org/vuln/rhsa-2026:34351 <p>acl: Symlink traversal privilege escalation via libacl functions acl: TOCTOU Symlink Traversal via getfacl/setfacl</p> <p>acl: Symlink traversal privilege escalation via libacl functions acl: TOCTOU Symlink Traversal via getfacl/setfacl</p> https://cve.radiocsirt.org/vuln/rhsa-2026:34351 https://cve.radiocsirt.org/vuln/rlsa-2026:42736 <p><strong>Affected:</strong> Rocky Linux:9: acl</p> <p>Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.</p> <p>Security Fix(es):</p> <p>* acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)</p> <p>* acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:9: acl</p> <p>Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.</p> <p>Security Fix(es):</p> <p>* acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)</p> <p>* acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:42736 https://cve.radiocsirt.org/vuln/suse-su-2026:23670-1 <p>Security update for acl, attr</p> <p>Security update for acl, attr</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23670-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54370 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: acl, Ubuntu:16.04:LTS: acl, Ubuntu:18.04:LTS: acl, Ubuntu:20.04:LTS: acl, Ubuntu:22.04:LTS: acl, Ubuntu:24.04:LTS: acl, Ubuntu:25.10: acl, Ubuntu:26.04:LTS: acl</p> <p>acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: acl, Ubuntu:16.04:LTS: acl, Ubuntu:18.04:LTS: acl, Ubuntu:20.04:LTS: acl, Ubuntu:22.04:LTS: acl, Ubuntu:24.04:LTS: acl, Ubuntu:25.10: acl, Ubuntu:26.04:LTS: acl</p> <p>acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54370 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2453 <p>Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um seine Privilegien zu erhöhen und Daten zu manipulieren.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um seine Privilegien zu erhöhen und Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2453