Summary
USN-8193-1 fixed a vulnerability in libcap. This update provides the
corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
Ali Raza discovered that libcap incorrectly handled file capability
updates. A local attacker could possibly use this issue to inject or strip
capabilities into arbitrary executables and escalate privileges.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | libcap2 | 1:2.24-0ubuntu2+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libcap2 | 1:2.24-12ubuntu0.1~esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libcap2 | 1:2.25-1.2ubuntu0.1~esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libcap2 | 1:2.32-1ubuntu0.2+esm1 |
Vulnerabilities 1
-
Medium 6.7
Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to a…
References
-
report
https://ubuntu.com/security/CVE-2026-4878