OPENSUSE-SU-2026:21832-1
Vulnerability from csaf_opensuse - Published: 2026-09-11 11:45 - Updated: 2026-09-16 21:48Summary
Security update for acl, attr
Severity
Important
Notes
Title of the patch: Security update for acl, attr
Description of the patch: This update for acl, attr fixes the following issue:
- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,
getfacl/setfacl/chacl, libacl (bsc#1268867).
Changes for acl:
- Update to 2.4.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
("Too many levels of symbolic links") error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into "symbolic link directories". This is wrong. When dirlink
is a symbolic link that refers to a directory, "getfattr -Rh dirlink" will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
Changes for attr:
- Update to 2.6.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree
and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a
directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
("Too many levels of symbolic links") error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into "symbolic link directories". This is wrong. When dirlink
is a symbolic link that refers to a directory, "getfattr -Rh
dirlink" will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
Patchnames: openSUSE-Leap-16.0-1661
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.4 (High)
Affected products
Recommended
28 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:acl-2.4.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:acl-2.4.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:acl-2.4.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:acl-2.4.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:attr-2.6.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:attr-2.6.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:attr-2.6.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:attr-2.6.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
28 products, the same list as for
CVE-2026-54369
Threats
Impact
important
7.4 (High)
Affected products
Recommended
28 products, the same list as for
CVE-2026-54369
Threats
Impact
important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for acl, attr",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for acl, attr fixes the following issue:\n\n- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,\n getfacl/setfacl/chacl, libacl (bsc#1268867).\n\nChanges for acl:\n\n- Update to 2.4.0 (jsc#PED-16501):\n Major Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree and use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a directory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn\u0027t\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh dirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n\nChanges for attr:\n\n- Update to 2.6.0 (jsc#PED-16501):\nMajor Issues Fixed:\n - The libacl library functions acl_get_file(), acl_set_file(),\n acl_extended_file(), and acl_delete_def_file() take a pathname argument\n and follow symbolic links. When a privileged user calls one of those\n functions, an attacker that controls a pathname component can replace a\n file or directory with a symbolic link and redirect the operation to a\n different file. This can lead to local privilege escalation.\n (CVE-2026-54369, bsc#1268867)\n The library functions cannot be fixed without breaking compatibility; the\n described behaviour is by design.\n Instead, version 2.4.0 of the acl package introduces the additional\n functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and\n acl_delete_def_file_at(). These functions each take a dirfd file\n descriptor argument and an at_flags argument and accept the\n AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to\n control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)\n In addition, the libacl functions acl_get_fd(), acl_set_fd(), and\n acl_extended_fd() functions always operate on the access ACL; the library\n previously did not offer a way to operate on the default ACL of a directory\n file descriptor. The new functions remove that restriction.\n It will be up to each individual program to start using these new library\n functions where appropriate.\n - When walking directory trees, the getfacl, setfacl, chacl, and getfattr\n utilities constructed the full pathname of each file in the tree\nand use that\n pathname to access the file. When a privileged user used those utilities,\n an attacker that controlled a pathname component could replace a\ndirectory with\n a symbolic link and redirect the operation to a different file, leading to\n a local privilege escalation. (CVE-2026-54371, bsc#1268867)\n This is fixed by using directory file descriptors and operating relative to\n those directory file descriptors.\n - When resolving the final pathname component, the getfacl, setfacl, chacl,\n getfattr, and setfattr utilities in some cases used functions that resolve\n symbolic links. This includes the above mentioned libacl functions, but\n also stat(), chmod(), and chown().\n This is fixed by using symlink-safe functions throughout the code.\n - When restoring a backup, the setfacl and setfattr utilities read the full\n pathnames of files from the backup. When those pathnames were resolved,\n pathname components that are symbolic links were traversed. An attacker\n that controlled a pathname component could replace it with a symbolic link,\n causing a privileged user to operate on a file other than the one intended.\n This could lead to the same kind of local privilege escalation as discussed\n before.\n This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the\n directory components of a pathname, but see Compatibility Notes below for\n the details.\nMinor Issues Fixed:\n - When a symbolic link was specified on the command line but symbolic link\n traversal was disabled using option -P (--physical), the getfacl and\n setfacl utilities previously silently ignored the symlink. Now, an ELOOP\n (\"Too many levels of symbolic links\") error will result instead.\n - acl_delete_entry() now verifies that the specified entry belongs to the\n specified acl.\n - Numeric uids and gids that cannot be represented in types uid_t and gid_t\n are checked more carefully and invalid numbers are rejected.\n - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry\n several times when the size of an ACL grows unexpectedly; previously, they\n only grew the allocated buffer once before giving up.\n - When passed a directory file descriptor, function perm_copy_fd() didn\u0027t\n copy the default ACL from one directory to the other. It now does.\n - setfacl --restore accidentally ignored leading whitespace in filenames. It\n no longer does.\n - setfacl --restore accidentally called chmod() when in --test mode. It no\n longer does.\n - When the setfattr --restore option was used multiple times, a buffer was\n accessed after being freed. This no longer happens.\n - When the setfattr -h (--no-dereference) option was given after --restore,\n it was ignored. Now, the options can be passed in any order.\n - The -h (--no-dereference) option of getfattr prevented getfattr from\n recursing into \"symbolic link directories\". This is wrong. When dirlink\n is a symbolic link that refers to a directory, \"getfattr -Rh\ndirlink\" will now\n visit that directory. The -P (--physical) option can be used to prevent\n that.\n - Similarly, when a symbolic link referring to a directory was specified on\n the getfacl or setfacl command line, the -R option did not cause that\n directory to be visited. This has been fixed so that those directories\n will now be visited. The -P (--physical) option can be used to prevent\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-1661",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21832-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1268867",
"url": "https://bugzilla.suse.com/1268867"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-54369 page",
"url": "https://www.suse.com/security/cve/CVE-2026-54369/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-54370 page",
"url": "https://www.suse.com/security/cve/CVE-2026-54370/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-54371 page",
"url": "https://www.suse.com/security/cve/CVE-2026-54371/"
}
],
"title": "Security update for acl, attr",
"tracking": {
"current_release_date": "2026-09-16T21:48:50Z",
"generator": {
"date": "2026-09-11T11:45:57Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:21832-1",
"initial_release_date": "2026-09-11T11:45:57Z",
"revision_history": [
{
"date": "2026-09-11T11:45:57Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-16T20:47:55Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T21:48:50Z",
"number": "3",
"summary": "unknown changes"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "acl-2.4.0-160000.1.1.aarch64",
"product": {
"name": "acl-2.4.0-160000.1.1.aarch64",
"product_id": "acl-2.4.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:acl_project:acl:2.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/acl@2.4.0-160000.1.1?arch=aarch64\u0026upstream=acl-2.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "attr-2.6.0-160000.1.1.aarch64",
"product": {
"name": "attr-2.6.0-160000.1.1.aarch64",
"product_id": "attr-2.6.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/attr@2.6.0-160000.1.1?arch=aarch64\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libacl-devel-2.4.0-160000.1.1.aarch64",
"product": {
"name": "libacl-devel-2.4.0-160000.1.1.aarch64",
"product_id": "libacl-devel-2.4.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:acl_project:acl:2.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libacl-devel@2.4.0-160000.1.1?arch=aarch64\u0026upstream=acl-2.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libacl1-2.4.0-160000.1.1.aarch64",
"product": {
"name": "libacl1-2.4.0-160000.1.1.aarch64",
"product_id": "libacl1-2.4.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:acl_project:acl:2.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libacl1@2.4.0-160000.1.1?arch=aarch64\u0026upstream=acl-2.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libattr-devel-2.6.0-160000.1.1.aarch64",
"product": {
"name": "libattr-devel-2.6.0-160000.1.1.aarch64",
"product_id": "libattr-devel-2.6.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libattr-devel@2.6.0-160000.1.1?arch=aarch64\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libattr-devel-static-2.6.0-160000.1.1.aarch64",
"product": {
"name": "libattr-devel-static-2.6.0-160000.1.1.aarch64",
"product_id": "libattr-devel-static-2.6.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libattr-devel-static@2.6.0-160000.1.1?arch=aarch64\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libattr1-2.6.0-160000.1.1.aarch64",
"product": {
"name": "libattr1-2.6.0-160000.1.1.aarch64",
"product_id": "libattr1-2.6.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libattr1@2.6.0-160000.1.1?arch=aarch64\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "acl-2.4.0-160000.1.1.ppc64le",
"product": {
"name": "acl-2.4.0-160000.1.1.ppc64le",
"product_id": "acl-2.4.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:acl_project:acl:2.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/acl@2.4.0-160000.1.1?arch=ppc64le\u0026upstream=acl-2.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "attr-2.6.0-160000.1.1.ppc64le",
"product": {
"name": "attr-2.6.0-160000.1.1.ppc64le",
"product_id": "attr-2.6.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/attr@2.6.0-160000.1.1?arch=ppc64le\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libacl-devel-2.4.0-160000.1.1.ppc64le",
"product": {
"name": "libacl-devel-2.4.0-160000.1.1.ppc64le",
"product_id": "libacl-devel-2.4.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:acl_project:acl:2.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libacl-devel@2.4.0-160000.1.1?arch=ppc64le\u0026upstream=acl-2.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libacl1-2.4.0-160000.1.1.ppc64le",
"product": {
"name": "libacl1-2.4.0-160000.1.1.ppc64le",
"product_id": "libacl1-2.4.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:acl_project:acl:2.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libacl1@2.4.0-160000.1.1?arch=ppc64le\u0026upstream=acl-2.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libattr-devel-2.6.0-160000.1.1.ppc64le",
"product": {
"name": "libattr-devel-2.6.0-160000.1.1.ppc64le",
"product_id": "libattr-devel-2.6.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libattr-devel@2.6.0-160000.1.1?arch=ppc64le\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libattr-devel-static-2.6.0-160000.1.1.ppc64le",
"product": {
"name": "libattr-devel-static-2.6.0-160000.1.1.ppc64le",
"product_id": "libattr-devel-static-2.6.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libattr-devel-static@2.6.0-160000.1.1?arch=ppc64le\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libattr1-2.6.0-160000.1.1.ppc64le",
"product": {
"name": "libattr1-2.6.0-160000.1.1.ppc64le",
"product_id": "libattr1-2.6.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libattr1@2.6.0-160000.1.1?arch=ppc64le\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "acl-2.4.0-160000.1.1.s390x",
"product": {
"name": "acl-2.4.0-160000.1.1.s390x",
"product_id": "acl-2.4.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:acl_project:acl:2.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/acl@2.4.0-160000.1.1?arch=s390x\u0026upstream=acl-2.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "attr-2.6.0-160000.1.1.s390x",
"product": {
"name": "attr-2.6.0-160000.1.1.s390x",
"product_id": "attr-2.6.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/attr@2.6.0-160000.1.1?arch=s390x\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libacl-devel-2.4.0-160000.1.1.s390x",
"product": {
"name": "libacl-devel-2.4.0-160000.1.1.s390x",
"product_id": "libacl-devel-2.4.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:acl_project:acl:2.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libacl-devel@2.4.0-160000.1.1?arch=s390x\u0026upstream=acl-2.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libacl1-2.4.0-160000.1.1.s390x",
"product": {
"name": "libacl1-2.4.0-160000.1.1.s390x",
"product_id": "libacl1-2.4.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:acl_project:acl:2.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libacl1@2.4.0-160000.1.1?arch=s390x\u0026upstream=acl-2.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libattr-devel-2.6.0-160000.1.1.s390x",
"product": {
"name": "libattr-devel-2.6.0-160000.1.1.s390x",
"product_id": "libattr-devel-2.6.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libattr-devel@2.6.0-160000.1.1?arch=s390x\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libattr-devel-static-2.6.0-160000.1.1.s390x",
"product": {
"name": "libattr-devel-static-2.6.0-160000.1.1.s390x",
"product_id": "libattr-devel-static-2.6.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libattr-devel-static@2.6.0-160000.1.1?arch=s390x\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libattr1-2.6.0-160000.1.1.s390x",
"product": {
"name": "libattr1-2.6.0-160000.1.1.s390x",
"product_id": "libattr1-2.6.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libattr1@2.6.0-160000.1.1?arch=s390x\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "acl-2.4.0-160000.1.1.x86_64",
"product": {
"name": "acl-2.4.0-160000.1.1.x86_64",
"product_id": "acl-2.4.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:acl_project:acl:2.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/acl@2.4.0-160000.1.1?arch=x86_64\u0026upstream=acl-2.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "attr-2.6.0-160000.1.1.x86_64",
"product": {
"name": "attr-2.6.0-160000.1.1.x86_64",
"product_id": "attr-2.6.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/attr@2.6.0-160000.1.1?arch=x86_64\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libacl-devel-2.4.0-160000.1.1.x86_64",
"product": {
"name": "libacl-devel-2.4.0-160000.1.1.x86_64",
"product_id": "libacl-devel-2.4.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:acl_project:acl:2.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libacl-devel@2.4.0-160000.1.1?arch=x86_64\u0026upstream=acl-2.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libacl1-2.4.0-160000.1.1.x86_64",
"product": {
"name": "libacl1-2.4.0-160000.1.1.x86_64",
"product_id": "libacl1-2.4.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:acl_project:acl:2.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libacl1@2.4.0-160000.1.1?arch=x86_64\u0026upstream=acl-2.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libattr-devel-2.6.0-160000.1.1.x86_64",
"product": {
"name": "libattr-devel-2.6.0-160000.1.1.x86_64",
"product_id": "libattr-devel-2.6.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libattr-devel@2.6.0-160000.1.1?arch=x86_64\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libattr-devel-static-2.6.0-160000.1.1.x86_64",
"product": {
"name": "libattr-devel-static-2.6.0-160000.1.1.x86_64",
"product_id": "libattr-devel-static-2.6.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libattr-devel-static@2.6.0-160000.1.1?arch=x86_64\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libattr1-2.6.0-160000.1.1.x86_64",
"product": {
"name": "libattr1-2.6.0-160000.1.1.x86_64",
"product_id": "libattr1-2.6.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:attr_project:attr:2.6.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libattr1@2.6.0-160000.1.1?arch=x86_64\u0026upstream=attr-2.6.0-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "acl-2.4.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:acl-2.4.0-160000.1.1.aarch64"
},
"product_reference": "acl-2.4.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "acl-2.4.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:acl-2.4.0-160000.1.1.ppc64le"
},
"product_reference": "acl-2.4.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "acl-2.4.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:acl-2.4.0-160000.1.1.s390x"
},
"product_reference": "acl-2.4.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "acl-2.4.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:acl-2.4.0-160000.1.1.x86_64"
},
"product_reference": "acl-2.4.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "attr-2.6.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:attr-2.6.0-160000.1.1.aarch64"
},
"product_reference": "attr-2.6.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "attr-2.6.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:attr-2.6.0-160000.1.1.ppc64le"
},
"product_reference": "attr-2.6.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "attr-2.6.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:attr-2.6.0-160000.1.1.s390x"
},
"product_reference": "attr-2.6.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "attr-2.6.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:attr-2.6.0-160000.1.1.x86_64"
},
"product_reference": "attr-2.6.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libacl-devel-2.4.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.aarch64"
},
"product_reference": "libacl-devel-2.4.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libacl-devel-2.4.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.ppc64le"
},
"product_reference": "libacl-devel-2.4.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libacl-devel-2.4.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.s390x"
},
"product_reference": "libacl-devel-2.4.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libacl-devel-2.4.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.x86_64"
},
"product_reference": "libacl-devel-2.4.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libacl1-2.4.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.aarch64"
},
"product_reference": "libacl1-2.4.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libacl1-2.4.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.ppc64le"
},
"product_reference": "libacl1-2.4.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libacl1-2.4.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.s390x"
},
"product_reference": "libacl1-2.4.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libacl1-2.4.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.x86_64"
},
"product_reference": "libacl1-2.4.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libattr-devel-2.6.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.aarch64"
},
"product_reference": "libattr-devel-2.6.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libattr-devel-2.6.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.ppc64le"
},
"product_reference": "libattr-devel-2.6.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libattr-devel-2.6.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.s390x"
},
"product_reference": "libattr-devel-2.6.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libattr-devel-2.6.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.x86_64"
},
"product_reference": "libattr-devel-2.6.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libattr-devel-static-2.6.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.aarch64"
},
"product_reference": "libattr-devel-static-2.6.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libattr-devel-static-2.6.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.ppc64le"
},
"product_reference": "libattr-devel-static-2.6.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libattr-devel-static-2.6.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.s390x"
},
"product_reference": "libattr-devel-static-2.6.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libattr-devel-static-2.6.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.x86_64"
},
"product_reference": "libattr-devel-static-2.6.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libattr1-2.6.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.aarch64"
},
"product_reference": "libattr1-2.6.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libattr1-2.6.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.ppc64le"
},
"product_reference": "libattr1-2.6.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libattr1-2.6.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.s390x"
},
"product_reference": "libattr1-2.6.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libattr1-2.6.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.x86_64"
},
"product_reference": "libattr1-2.6.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-54369",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-54369"
}
],
"notes": [
{
"category": "general",
"text": "acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-54369",
"url": "https://www.suse.com/security/cve/CVE-2026-54369"
},
{
"category": "external",
"summary": "SUSE Bug 1268867 for CVE-2026-54369",
"url": "https://bugzilla.suse.com/1268867"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-11T11:45:57Z",
"details": "important"
}
],
"title": "CVE-2026-54369"
},
{
"cve": "CVE-2026-54370",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-54370"
}
],
"notes": [
{
"category": "general",
"text": "acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-54370",
"url": "https://www.suse.com/security/cve/CVE-2026-54370"
},
{
"category": "external",
"summary": "SUSE Bug 1268867 for CVE-2026-54370",
"url": "https://bugzilla.suse.com/1268867"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-11T11:45:57Z",
"details": "important"
}
],
"title": "CVE-2026-54370"
},
{
"cve": "CVE-2026-54371",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-54371"
}
],
"notes": [
{
"category": "general",
"text": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-54371",
"url": "https://www.suse.com/security/cve/CVE-2026-54371"
},
{
"category": "external",
"summary": "SUSE Bug 1268867 for CVE-2026-54371",
"url": "https://bugzilla.suse.com/1268867"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:acl-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:attr-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl-devel-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libacl1-2.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr-devel-static-2.6.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.s390x",
"openSUSE Leap 16.0:libattr1-2.6.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-11T11:45:57Z",
"details": "important"
}
],
"title": "CVE-2026-54371"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…