Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-54371 →
DEBIAN-CVE-2026-54371
attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate pr...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
attr
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
attr
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
attr
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.6.0-1"}]}]
Références
- advisory security-tracker.debian.org