Summary
Rajesh Pangare discovered that AIDE incorrectly handled filenames. A
local attacker could possibly use this issue to bypass the detection of
malicious files. (CVE-2025-54389)
Rajesh Pangare discovered that AIDE incorrectly handled extended file
attributes. A local attacker could possibly use this issue to cause a
denial of service. (CVE-2025-54409)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | aide | 0.17.4-1ubuntu0.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | aide | 0.18.6-2ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | aide | 0.16~a2.git20130520-2ubuntu0.1+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | aide | 0.16~a2.git20130520-3ubuntu0.1~esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | aide | 0.16-3ubuntu0.1+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | aide | 0.16.1-1ubuntu0.1+esm1 |
Vulnerabilities 2
-
Medium 6.2
AIDE improper output neutralization vulnerability
AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal o…
-
Medium 6.2
AIDE null pointer dereference when reading incorrectly encoded xattr attributes from database (local DoS)
AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes w…