An update for attr is now available for openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-2915 Final 1.0 1.0 2026-07-09 Initial 2026-07-09 2026-07-09 openEuler SA Tool V1.0 2026-07-09 attr security update An update for attr is now available for openEuler-20.03-LTS-SP4 A set of tools for manipulating extended attributes on file system objects, in particular getfattr(1) and setfattr(1). An attr(1) command is also provided, which is largely compatible with the SGI IRIX tool of the same name. Security Fix(es): attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.(CVE-2026-54371) An update for attr is now available for openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High attr https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2915 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-54371 https://nvd.nist.gov/vuln/detail/CVE-2026-54371 openEuler-20.03-LTS-SP4 attr-2.4.48-16.oe2003sp4.aarch64.rpm attr-debuginfo-2.4.48-16.oe2003sp4.aarch64.rpm attr-debugsource-2.4.48-16.oe2003sp4.aarch64.rpm attr-help-2.4.48-16.oe2003sp4.aarch64.rpm libattr-devel-2.4.48-16.oe2003sp4.aarch64.rpm attr-2.4.48-16.oe2003sp4.src.rpm attr-2.4.48-16.oe2003sp4.x86_64.rpm attr-debuginfo-2.4.48-16.oe2003sp4.x86_64.rpm attr-debugsource-2.4.48-16.oe2003sp4.x86_64.rpm attr-help-2.4.48-16.oe2003sp4.x86_64.rpm libattr-devel-2.4.48-16.oe2003sp4.x86_64.rpm attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path. 2026-07-09 CVE-2026-54371 openEuler-20.03-LTS-SP4 High 7.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N attr security update 2026-07-09 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2915