[LFS Trac] #5905: libcap-2.78

#5905: libcap-2.78
-----------------------------+----------------------
 Reporter:  Douglas R. Reno  |      Owner:  lfs-book
     Type:  enhancement      |     Status:  new
 Priority:  high             |  Milestone:  13.1
Component:  Website          |    Version:  git
 Severity:  normal           |   Keywords:
-----------------------------+----------------------
 New minor version

 This includes a security fix as released to oss-security this morning:

 {{{
 Hi,

 I've just released libcap-2.78 which includes a fix for a TOCTOU issue
 in libcap.

 The issue has been allocated the following code: CVE-2026-4878. It is
 the subject of this private bug:
 https://bugzilla.redhat.com/show_bug.cgi?id=2447554 and is also
 written up in a github.com advisory which I will publish on Wednesday
 (this week). The github advisory tool characterizes the issue as
 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H (Severity: Moderate 7 /
 10).

 The fix for pretty much that whole range of libcap releases is this
 commit:

 https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=286ace1259992bd0c5d9016715833f2e148ac596

 As the code is publicly available, there is no embargo in place for
 releasing fixes.

 Cheers

 Andrew

 PS I tried a few times to post to the private openwall list about this
 issue 9 days ago, but my email bounced (likely because I couldn't
 effectively follow the mail formatting requirements). I might have
 realized that the emails were bounced if gmail hadn't silently placed
 the bounced replies in my SPAM folder. Sorry about that.
 }}}

 Rated as High (7/10) though we'll want to check GitHub tomorrow to see
 what the final rating is
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/5905>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page