Summary
Aaron Rainbolt discovered that zuluCrypt used insecure PolicyKit
settings in zuluPolkit. An attacker could possibly use this issue to
cause local privilege escalation to root. (CVE-2025-53391)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | zulucrypt | 5.4.0-2ubuntu0.1~esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | zulucrypt | 5.7.0-1ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | zulucrypt | 5.7.1-2ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | zulucrypt | 6.2.0-1ubuntu3+esm1 |
Vulnerabilities 1
-
Critical 9.3
The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit al…
References
-
report
https://ubuntu.com/security/CVE-2025-53391