acl - Debian Package Tracker

general

source: acl (main)
version: 2.4.0-1
maintainer: Guillem Jover (DMD)
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.2.53-10
oldstable: 2.3.1-3
stable: 2.3.2-2
testing: 2.3.2-3
unstable: 2.4.0-1

versioned links

2.2.53-10: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.3.1-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.3.2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.3.2-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

acl (2 bugs: 0, 1, 1, 0)
acl-udeb
libacl1 (1 bugs: 0, 1, 0, 0)
libacl1-dev
libacl1-udeb

action needed

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-54369: acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.
CVE-2026-54370: acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

Created: 2026-06-29 Last update: 2026-07-01 00:00

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2026-54369: acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.
CVE-2026-54370: acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

Created: 2026-06-29 Last update: 2026-07-01 00:00

2 security issues in bookworm high

There are 2 open security issues in bookworm.

2 important issues:

CVE-2026-54369: acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.
CVE-2026-54370: acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

Created: 2026-06-29 Last update: 2026-07-01 00:00

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2026-54369: (needs triaging) acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.
CVE-2026-54370: (needs triaging) acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-06-29 Last update: 2026-07-01 00:00

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2026-02-16 Last update: 2026-06-30 12:00

debian/patches: 2 patches to forward upstream low

Among the 2 debian patches available in version 2.4.0-1 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-06-30 06:00

testing migrations

excuses:
- Migration status for acl (2.3.2-3 to 2.4.0-1): BLOCKED: Maybe temporary, maybe blocked but Britney is missing information (check below)
- Issues preventing migration:
- ∙ ∙ Missing build on riscv64
- ∙ ∙ Autopkgtest deferred on riscv64: missing arch:riscv64 build
- ∙ ∙ Autopkgtest for acl/2.4.0-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for aide/0.19.3-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for bacula/15.0.3-5: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for bcron/0.11-25: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for bfs/4.1.3-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for borgbackup/1.4.4-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for clifm/1.28-1: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻ (reference ♻), armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: No tests, superficial or marked flaky ♻ (reference ♻), loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Test triggered
- ∙ ∙ Autopkgtest for colord/1.4.8-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for dnf5/5.4.2.1-1: amd64: Pass, arm64: Pass, loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for fsarchiver/0.8.9-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for glusterfs/11.2-3: amd64: Pass, arm64: No tests, superficial or marked flaky ♻ (reference ♻), loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Test triggered
- ∙ ∙ Autopkgtest for ikiwiki-hosting/0.20220717-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for incus/7.0.0-5: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for libarchive/3.8.7-1: amd64: Pass, arm64: Pass, armhf: Test triggered, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for libguestfs/1:1.58.1-7: amd64: Pass, arm64: Pass, loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for liblinux-acl-perl/0.05-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for libvirt/12.4.0-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for logrotate/3.22.0-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for netatalk/4.5.0~ds-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for octavia/18.0.0-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for phing/3.1.2-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for php8.4/8.4.22-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for proftpd-dfsg/1.3.9b~dfsg-1: amd64: Pass, arm64: Pass, armhf: Failed (not a regression) ♻ (reference ♻), i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for python-pylibacl/0.7.2-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for rpm/6.0.1-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for rsync/3.4.4+ds1-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for rust-exacl/0.10.0-5: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for rust-laurel/0.7.3-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for samba/2:4.24.3+dfsg-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for sed/4.9-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for shadow/1:4.19.3-2: amd64: Pass, arm64: No tests, superficial or marked flaky ♻ (reference ♻), armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: No tests, superficial or marked flaky ♻ (reference ♻), loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Test triggered
- ∙ ∙ Autopkgtest for slm/3.0-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Test triggered
- ∙ ∙ Autopkgtest for stress-ng/0.21.03-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for systemd/261-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for tpm2-tss/4.1.3-6: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for udisks2/2.11.1-1: amd64: Pass, arm64: No tests, superficial or marked flaky ♻ (reference ♻), armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: No tests, superficial or marked flaky ♻ (reference ♻), loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Test triggered
- ∙ ∙ Autopkgtest for vim/2:9.2.0524-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for vis/0.9-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for zfs-linux/2.4.3-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: No tests, superficial or marked flaky ♻ (reference ♻), loong64: Failed (not a regression) ♻ (reference ♻), ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Lintian check waiting for test results on riscv64 - info
- ∙ ∙ Reproducibility check waiting for results on arm64 - info
- ∙ ∙ Reproducibility check waiting for results on i386 - info
- ∙ ∙ Too young, only 1 of 5 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/a/acl.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on armhf - info
- Not considered

news

[rss feed]

[2026-06-29] Accepted acl 2.4.0-1 (source) into unstable (Guillem Jover)
[2026-02-22] acl 2.3.2-3 MIGRATED to testing (Debian testing watch)
[2026-02-15] Accepted acl 2.3.2-3 (source) into unstable (Guillem Jover)
[2024-05-06] acl 2.3.2-2 MIGRATED to testing (Debian testing watch)
[2024-05-02] Accepted acl 2.3.2-2 (source) into unstable (Guillem Jover)
[2024-01-29] acl 2.3.2-1 MIGRATED to testing (Debian testing watch)
[2024-01-29] acl 2.3.2-1 MIGRATED to testing (Debian testing watch)
[2024-01-25] Accepted acl 2.3.2-1 (source) into unstable (Guillem Jover)
[2024-01-18] acl 2.3.1-6 MIGRATED to testing (Debian testing watch)
[2024-01-16] Accepted acl 2.3.1-6 (source) into unstable (Guillem Jover)
[2024-01-07] Accepted acl 2.3.1-5 (source) into experimental (Guillem Jover)
[2023-12-27] acl 2.3.1-4 MIGRATED to testing (Debian testing watch)
[2023-12-24] Accepted acl 2.3.1-4 (source) into unstable (Guillem Jover)
[2023-01-23] acl 2.3.1-3 MIGRATED to testing (Debian testing watch)
[2023-01-17] Accepted acl 2.3.1-3 (source) into unstable (Guillem Jover)
[2022-12-05] acl 2.3.1-2 MIGRATED to testing (Debian testing watch)
[2022-12-03] Accepted acl 2.3.1-2 (source) into unstable (Guillem Jover)
[2021-09-01] acl 2.3.1-1 MIGRATED to testing (Debian testing watch)
[2021-08-29] Accepted acl 2.3.1-1 (source) into unstable (Guillem Jover)
[2021-02-03] acl 2.2.53-10 MIGRATED to testing (Debian testing watch)
[2021-01-31] Accepted acl 2.2.53-10 (source) into unstable (Guillem Jover)
[2020-12-27] acl 2.2.53-9 MIGRATED to testing (Debian testing watch)
[2020-12-24] Accepted acl 2.2.53-9 (source) into unstable (Guillem Jover)
[2020-05-03] acl 2.2.53-8 MIGRATED to testing (Debian testing watch)
[2020-05-01] Accepted acl 2.2.53-8 (source) into unstable (Guillem Jover)
[2020-04-22] Accepted acl 2.2.53-7 (source amd64) into unstable, unstable (Debian FTP Masters) (signed by: Guillem Jover)
[2020-03-03] acl 2.2.53-6 MIGRATED to testing (Debian testing watch)
[2020-03-01] Accepted acl 2.2.53-6 (source) into unstable (Guillem Jover)
[2019-09-27] acl 2.2.53-5 MIGRATED to testing (Debian testing watch)
[2019-09-24] Accepted acl 2.2.53-5 (source) into unstable (Guillem Jover)

bugs [bug history graph]

all: 3
RC: 0
I&N: 2
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
screenshots
l10n (-, 91)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.3.2-2