CVE-2025-53391

EUVD-2025-19461
The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit allow_any/allow_inactive/allow_active settings that allow a local user to escalate their privileges to root.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.3 CRITICAL
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 25%
Debian logo
Debian Releases
Debian Product
Codename
zulucrypt
bullseye
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
zulucrypt
bionic
Fixed 5.4.0-2ubuntu0.1~esm2
released
focal
Fixed 5.7.0-1ubuntu0.1~esm1
released
jammy
Fixed 5.7.1-2ubuntu0.1~esm1
released
noble
Fixed 6.2.0-1ubuntu3+esm1
released
oracular
ignored
plucky
ignored
questing
needed
resolute
dne
xenial
not-affected
Common Weakness Enumeration
References
https://bugs.debian.org/1108288
https://deb.debian.org/debian/pool/main/z/zulucrypt/zulucrypt_6.2.0-1.dsc
https://salsa.debian.org/debian/zulucrypt/-/blob/9d661c9f384c4d889d3387944e14ac70cfb9684b/debian/patches/fix_zulupolkit_policy.patch
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108288