Skip to content
OpenAdvisories
Medium USN-7287-1 1 CVE

libcap2 vulnerability

Published Feb 24, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Tianjia Zhang discovered the libcap2 PAM module pam_cap incorrectly
handled parsing group names in the configuration file. This could result in
certain users being granted capabilities, contrary to expectations.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS libcap2 1:2.32-1ubuntu0.2
Ubuntu · 22.04 LTS 22.04:LTS libcap2 1:2.44-1ubuntu0.22.04.2
Ubuntu · 24.04 LTS 24.04:LTS libcap2 1:2.66-5ubuntu2.2

Vulnerabilities 1

  • Medium 6.1
    CVE-2025-1390

    pam_cap: Fix potential configuration parsing error

    The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited ca…

    OpenAnolis Anolis OS libcap2 libcap Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2025-1390