Описание
Security update for libcap
This update for libcap fixes the following issues:
- CVE-2026-4878: local privilege escalation through file capability injection due to TOCTOU race condition in
cap_set_file()(bsc#1261809).
Список пакетов
openSUSE Leap 16.0
libcap-devel-2.73-160000.3.1
libcap-progs-2.73-160000.3.1
libcap2-2.73-160000.3.1
libpsx2-2.73-160000.3.1
Ссылки
- SUSE Security Ratings
- SUSE Bug 1261809
- SUSE CVE CVE-2026-4878 page
Описание
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.
Затронутые продукты
openSUSE Leap 16.0:libcap-devel-2.73-160000.3.1
openSUSE Leap 16.0:libcap-progs-2.73-160000.3.1
openSUSE Leap 16.0:libcap2-2.73-160000.3.1
openSUSE Leap 16.0:libpsx2-2.73-160000.3.1
Ссылки
- CVE-2026-4878
- SUSE Bug 1261809