rpm package
almalinux/acl
pkg:rpm/almalinux/acl
Vulnerabilities (2)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-54370 | Med | 6.3 | < 2.4.0-1.el9_8 | 2.4.0-1.el9_8 | Jun 29, 2026 | acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations su | |
| CVE-2026-54369 | Hig | 7.1 | < 2.4.0-1.el9_8 | 2.4.0-1.el9_8 | Jun 29, 2026 | acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a |
- affected < 2.4.0-1.el9_8fixed 2.4.0-1.el9_8
acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations su
- affected < 2.4.0-1.el9_8fixed 2.4.0-1.el9_8
acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a