PT-2025-6914 · Libpcap+4 · Libpcap+4

Tj · Published 2025-02-13 · Updated 2026-04-15 · CVE-2025-1390

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions: libcap (affected versions not specified)

Description: The PAM module pam cap.so of libcap configuration incorrectly recognizes configurations not starting with "@" as group names, potentially leading to nonintended users being granted an inherited capability set. This may result in security risks, as attackers can exploit this issue to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

AZL-56916

AZL-57034

BDU:2025-02012

CVE-2025-1390

DLA-4092-1

ECHO-593E-D2F2-F6DA

MGASA-2025-0082

OESA-2025-1243

USN-7287-1

Affected Products

Astra Linux

Debian

Linuxmint

Ubuntu

Libpcap

References · 31

• https://advisories.mageia.org/MGASA-2025-0082.html · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2025-1390 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7287-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-1390 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1243 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-1390 · Security Note
• https://osv.dev/vulnerability/DLA-4092-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1390 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0082 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-1390 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02012 · Security Note
• https://osv.dev/vulnerability/AZL-57034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1390 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-1390 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory