Vulnerabilities in acpid package
Summary
DSA-2362-1: acpid - several. Affects acpid versions < 1.0.8-1lenny4. Fixed in 1.0.8-1lenny4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The acpid package is the ACPI Daemon, responsible for handling Advanced Configuration and Power Interface events on a system. It provides functionality for power management and event handling. The package is commonly found in Debian-based distributions.
Vulnerability Detail
Multiple vulnerabilities have been discovered in the acpid package:
-
CVE-2011-1159: This vulnerability allows for denial of service attacks through the manipulation of sockets.
-
CVE-2011-2777: The Debian-specific powerbtn.sh script included with acpid has incorrect process handling, which could lead to local privilege escalation.
-
CVE-2011-4578: acpid sets a umask of 0 when executing scripts, potentially resulting in local privilege escalation.
How To Fix
Minimum fixed version
1.0.8-1lenny4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade acpidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
It is highly recommended to upgrade the acpid package to the fixed versions mentioned above to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for acpid →
FAQ
The acpid package is the ACPI Daemon, responsible for handling Advanced Configuration and Power Interface events on a system. It provides functionality for power management and event handling.
These vulnerabilities could lead to denial of service attacks, local privilege escalation, and potential compromise of the affected system.
The vulnerability CVE-2011-2777 does not affect the oldstable distribution (lenny). The powerbtn.sh script is only shipped as an example and is not present in older versions.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities.
You can find more information about these vulnerabilities in the Debian Security Tracker. The links to the CVEs are provided in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for acpid.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.