acl - Debian Package Tracker

general

source: acl (main)
version: 2.4.0-1
maintainer: Guillem Jover (DMD)
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.2.53-10
oldstable: 2.3.1-3
stable: 2.3.2-2
testing: 2.3.2-3
unstable: 2.4.0-1

versioned links

2.2.53-10: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.3.1-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.3.2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.3.2-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

acl (2 bugs: 0, 1, 1, 0)
acl-udeb
libacl1 (1 bugs: 0, 1, 0, 0)
libacl1-dev
libacl1-udeb

action needed

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-54369: acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.
CVE-2026-54370: acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

Created: 2026-06-29 Last update: 2026-07-01 00:00

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2026-54369: acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.
CVE-2026-54370: acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

Created: 2026-06-29 Last update: 2026-07-01 00:00

2 security issues in bookworm high

There are 2 open security issues in bookworm.

2 important issues:

CVE-2026-54369: acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.
CVE-2026-54370: acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

Created: 2026-06-29 Last update: 2026-07-01 00:00

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2026-54369: (needs triaging) acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.
CVE-2026-54370: (needs triaging) acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-06-29 Last update: 2026-07-01 00:00

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2026-02-16 Last update: 2026-06-30 12:00

debian/patches: 2 patches to forward upstream low

Among the 2 debian patches available in version 2.4.0-1 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-06-30 06:00

testing migrations

excuses:
- Migration status for acl (2.3.2-3 to 2.4.0-1): Will attempt migration (Any information below is purely informational)
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/a/acl.html
- ∙ ∙ Autopkgtest for acl/2.4.0-1: amd64: Pass, arm64: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ Required age reduced by 3 days because of autopkgtest
- ∙ ∙ 2 days old (needed 2 days)

news

[rss feed]

[2026-06-29] Accepted acl 2.4.0-1 (source) into unstable (Guillem Jover)
[2026-02-22] acl 2.3.2-3 MIGRATED to testing (Debian testing watch)
[2026-02-15] Accepted acl 2.3.2-3 (source) into unstable (Guillem Jover)
[2024-05-06] acl 2.3.2-2 MIGRATED to testing (Debian testing watch)
[2024-05-02] Accepted acl 2.3.2-2 (source) into unstable (Guillem Jover)
[2024-01-29] acl 2.3.2-1 MIGRATED to testing (Debian testing watch)
[2024-01-29] acl 2.3.2-1 MIGRATED to testing (Debian testing watch)
[2024-01-25] Accepted acl 2.3.2-1 (source) into unstable (Guillem Jover)
[2024-01-18] acl 2.3.1-6 MIGRATED to testing (Debian testing watch)
[2024-01-16] Accepted acl 2.3.1-6 (source) into unstable (Guillem Jover)
[2024-01-07] Accepted acl 2.3.1-5 (source) into experimental (Guillem Jover)
[2023-12-27] acl 2.3.1-4 MIGRATED to testing (Debian testing watch)
[2023-12-24] Accepted acl 2.3.1-4 (source) into unstable (Guillem Jover)
[2023-01-23] acl 2.3.1-3 MIGRATED to testing (Debian testing watch)
[2023-01-17] Accepted acl 2.3.1-3 (source) into unstable (Guillem Jover)
[2022-12-05] acl 2.3.1-2 MIGRATED to testing (Debian testing watch)
[2022-12-03] Accepted acl 2.3.1-2 (source) into unstable (Guillem Jover)
[2021-09-01] acl 2.3.1-1 MIGRATED to testing (Debian testing watch)
[2021-08-29] Accepted acl 2.3.1-1 (source) into unstable (Guillem Jover)
[2021-02-03] acl 2.2.53-10 MIGRATED to testing (Debian testing watch)
[2021-01-31] Accepted acl 2.2.53-10 (source) into unstable (Guillem Jover)
[2020-12-27] acl 2.2.53-9 MIGRATED to testing (Debian testing watch)
[2020-12-24] Accepted acl 2.2.53-9 (source) into unstable (Guillem Jover)
[2020-05-03] acl 2.2.53-8 MIGRATED to testing (Debian testing watch)
[2020-05-01] Accepted acl 2.2.53-8 (source) into unstable (Guillem Jover)
[2020-04-22] Accepted acl 2.2.53-7 (source amd64) into unstable, unstable (Debian FTP Masters) (signed by: Guillem Jover)
[2020-03-03] acl 2.2.53-6 MIGRATED to testing (Debian testing watch)
[2020-03-01] Accepted acl 2.2.53-6 (source) into unstable (Guillem Jover)
[2019-09-27] acl 2.2.53-5 MIGRATED to testing (Debian testing watch)
[2019-09-24] Accepted acl 2.2.53-5 (source) into unstable (Guillem Jover)

bugs [bug history graph]

all: 3
RC: 0
I&N: 2
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
screenshots
l10n (-, 91)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.3.2-2