CVE-2026-35350

Katalog CVE

CVSS 6.6 · Medium EPSS 0,13%

Kerentanan Improper Preservation of Permissions pada uutils coreutils. Skor CVSS 3.1 6.6 (Medium) menurut ubuntu.com.

Deskripsi (NVD)

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.

Rincian

Terbit di NVD

22 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.6 (Medium), sumber ubuntu.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-281: Improper Preservation of Permissions

EPSS (30 hari)

0,13% peluang dieksploitasi; lebih tinggi dari 2,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/uutils/coreutils/issues/9750 exploit · issue tracking · advisory vendor