Debian Package Tracker
Register | Log in
Subscribe

attr

filesystem extended attributes handling - utilities

Choose email to subscribe with

general
  • source: attr (main)
  • version: 1:2.6.0-1
  • maintainer: Guillem Jover (DMD)
  • arch: any
  • std-ver: 4.7.4
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 1:2.4.48-6
  • oldstable: 1:2.5.1-4
  • stable: 1:2.5.2-3
  • testing: 1:2.5.2-4
  • unstable: 1:2.6.0-1
versioned links
  • 1:2.4.48-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:2.5.1-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:2.5.2-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:2.5.2-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1:2.6.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • attr (9 bugs: 0, 7, 2, 0)
  • attr-udeb
  • libattr1
  • libattr1-dev
  • libattr1-udeb
action needed
1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:
  • CVE-2026-54371: attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.
Created: 2026-06-29 Last update: 2026-07-01 00:00
1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:
  • CVE-2026-54371: attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.
Created: 2026-06-29 Last update: 2026-07-01 00:00
1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:
  • CVE-2026-54371: attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.
Created: 2026-06-29 Last update: 2026-07-01 00:00
1 bug tagged patch in the BTS normal
The BTS contains patches fixing 1 bug, consider including or untagging them.
Created: 2026-06-02 Last update: 2026-07-01 05:30
1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:
  • CVE-2026-54371: (needs triaging) attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-06-29 Last update: 2026-07-01 00:00
Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2026-02-16 Last update: 2026-06-30 12:00
debian/patches: 5 patches to forward upstream low

Among the 7 debian patches available in version 1:2.6.0-1 of the package, we noticed the following issues:

  • 5 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2023-02-26 Last update: 2026-06-30 06:00
testing migrations
  • excuses:
    • Migration status for attr (1:2.5.2-4 to 1:2.6.0-1): BLOCKED: Maybe temporary, maybe blocked but Britney is missing information (check below)
    • Issues preventing migration:
    • ∙ ∙ Missing build on riscv64
    • ∙ ∙ Autopkgtest deferred on riscv64: missing arch:riscv64 build
    • ∙ ∙ Autopkgtest for acl: s390x: Test triggered
    • ∙ ∙ Autopkgtest for attr/1:2.6.0-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
    • ∙ ∙ Autopkgtest for flatpak/1.18.0-1: amd64: Pass, arm64: No tests, superficial or marked flaky ♻ (reference ♻), armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: No tests, superficial or marked flaky ♻ (reference ♻), loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Test triggered
    • ∙ ∙ Autopkgtest for flatpak-builder/1.4.9-1: amd64: Pass, arm64: No tests, superficial or marked flaky ♻ (reference ♻), armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: No tests, superficial or marked flaky ♻ (reference ♻), loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Test triggered
    • ∙ ∙ Autopkgtest for glusterfs/11.2-3: amd64: Pass, arm64: No tests, superficial or marked flaky ♻ (reference ♻), loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Test triggered
    • ∙ ∙ Autopkgtest for incus/7.0.0-5: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
    • ∙ ∙ Autopkgtest for libguestfs/1:1.58.1-7: amd64: Pass, arm64: Pass, loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: Pass, s390x: Test triggered
    • ∙ ∙ Autopkgtest for ostree/2026.1-1: amd64: Pass, arm64: Pass, armhf: Failed (not a regression) ♻ (reference ♻), i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
    • ∙ ∙ Autopkgtest for python-pyxattr/0.8.1-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
    • ∙ ∙ Autopkgtest for rsync/3.4.4+ds1-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, s390x: Test triggered
    • ∙ ∙ Autopkgtest for shadow/1:4.19.3-2: amd64: Pass, arm64: No tests, superficial or marked flaky ♻ (reference ♻), armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: No tests, superficial or marked flaky ♻ (reference ♻), loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Test triggered
    • ∙ ∙ Autopkgtest for systemd/261-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Failed (not a regression) ♻ (reference ♻), ppc64el: Pass, s390x: Test triggered
    • ∙ ∙ Autopkgtest for zfs-linux/2.4.3-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: No tests, superficial or marked flaky ♻ (reference ♻), loong64: Failed (not a regression) ♻ (reference ♻), ppc64el: Pass, s390x: Test triggered
    • ∙ ∙ Lintian check waiting for test results on riscv64 - info
    • ∙ ∙ Reproducibility check waiting for results on arm64 - info
    • ∙ ∙ Reproducibility check waiting for results on i386 - info
    • ∙ ∙ Too young, only 1 of 5 days old
    • Additional info (not blocking):
    • ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/a/attr.html
    • ∙ ∙ Reproduced on amd64 - info
    • ∙ ∙ Reproduced on armhf - info
    • Not considered
news
[rss feed]
  • [2026-06-29] Accepted attr 1:2.6.0-1 (source) into unstable (Guillem Jover)
  • [2026-02-22] attr 1:2.5.2-4 MIGRATED to testing (Debian testing watch)
  • [2026-02-15] Accepted attr 1:2.5.2-4 (source) into unstable (Guillem Jover)
  • [2025-02-26] attr 1:2.5.2-3 MIGRATED to testing (Debian testing watch)
  • [2025-02-21] Accepted attr 1:2.5.2-3 (source) into unstable (Guillem Jover)
  • [2024-10-18] attr 1:2.5.2-2 MIGRATED to testing (Debian testing watch)
  • [2024-10-12] Accepted attr 1:2.5.2-2 (source) into unstable (Guillem Jover)
  • [2024-01-30] attr 1:2.5.2-1 MIGRATED to testing (Debian testing watch)
  • [2024-01-25] Accepted attr 1:2.5.2-1 (source) into unstable (Guillem Jover)
  • [2023-12-27] attr 1:2.5.1-5 MIGRATED to testing (Debian testing watch)
  • [2023-12-27] attr 1:2.5.1-5 MIGRATED to testing (Debian testing watch)
  • [2023-12-24] Accepted attr 1:2.5.1-5 (source) into unstable (Guillem Jover)
  • [2023-01-23] attr 1:2.5.1-4 MIGRATED to testing (Debian testing watch)
  • [2023-01-17] Accepted attr 1:2.5.1-4 (source) into unstable (Guillem Jover)
  • [2022-12-07] attr 1:2.5.1-3 MIGRATED to testing (Debian testing watch)
  • [2022-12-07] attr 1:2.5.1-3 MIGRATED to testing (Debian testing watch)
  • [2022-12-04] Accepted attr 1:2.5.1-3 (source) into unstable (Guillem Jover)
  • [2022-12-03] Accepted attr 1:2.5.1-2 (source) into unstable (Guillem Jover)
  • [2021-09-03] attr 1:2.5.1-1 MIGRATED to testing (Debian testing watch)
  • [2021-08-29] Accepted attr 1:2.5.1-1 (source) into unstable (Guillem Jover)
  • [2020-12-27] attr 1:2.4.48-6 MIGRATED to testing (Debian testing watch)
  • [2020-12-24] Accepted attr 1:2.4.48-6 (source) into unstable (Guillem Jover)
  • [2019-09-27] attr 1:2.4.48-5 MIGRATED to testing (Debian testing watch)
  • [2019-09-24] Accepted attr 1:2.4.48-5 (source) into unstable (Guillem Jover)
  • [2019-03-12] attr 1:2.4.48-4 MIGRATED to testing (Debian testing watch)
  • [2019-03-01] Accepted attr 1:2.4.48-4 (source) into unstable (Guillem Jover)
  • [2019-03-01] Accepted attr 1:2.4.48-3 (source) into unstable (Guillem Jover)
  • [2019-03-01] Accepted attr 1:2.4.48-2 (source) into unstable (Guillem Jover)
  • [2019-02-28] Accepted attr 1:2.4.48-1 (source) into unstable (Guillem Jover)
  • [2019-02-26] attr 1:2.4.47-4 MIGRATED to testing (Debian testing watch)
  • 1
  • 2
bugs [bug history graph]
  • all: 8 9
  • RC: 0
  • I&N: 6 7
  • M&W: 2
  • F&P: 0
  • patch: 1
links
  • homepage
  • lintian
  • buildd: logs, reproducibility, cross
  • popcon
  • browse source code
  • other distros
  • security tracker
  • l10n (-, 84)
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 1:2.5.2-4

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing