Ubuntu alert USN-8173-1 (policykit-1)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8173-1] polkit vulnerabilities
Date:
             
 
Tue, 14 Apr 2026 10:55:29 +0000
Message-ID:
             
 
<E1wCbQX-0001rb-4f@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8173-1
April 14, 2026

policykit-1 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in polkit.

Software Description:
- policykit-1: framework for managing administrative policies and privileges

Details:

It was discovered that polkit incorrectly handled nested elements in XML
policy files. If an administrator were tricked into installing a malicious
policy file, a remote attacker could possibly use this issue to cause
polkit to crash, resulting in a denial of service. (CVE-2025-7519)

Pavel Kohout discovered that the polkit polkit-agent-helper-1 utility
incorrectly handled long input. A local attacker could possibly use this
issue to cause polkit to crash, resulting in a denial of service.
(CVE-2026-4897)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  polkitd                         126-2ubuntu0.1

Ubuntu 24.04 LTS
  policykit-1                     124-2ubuntu1.24.04.3

Ubuntu 22.04 LTS
  policykit-1                     0.105-33ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8173-1
  CVE-2025-7519, CVE-2026-4897

Package Information:
  https://launchpad.net/ubuntu/+source/policykit-1/126-2ubu...
  https://launchpad.net/ubuntu/+source/policykit-1/124-2ubu...
  https://launchpad.net/ubuntu/+source/policykit-1/0.105-33...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmneHLQACgkQcpJm3tlz
hgE5fxAAhk/tYj24Huc/5dYk6++6MLCWVN53v/1NHxTleZNUZCGAhEgxIt3PmBiw
EOCZGZD6y3EJ2gjCfwvGkyQLlSsHRrrDojKoHtkKYtZvplhQCihk9Hkuyo8CWhOh
d5rwFHY/B2c/qMeO5dxANSmTfTZJGbYKVzW3daKDKblNVdiJWyxpc4gJfexa7HaQ
oYLPYEaDfysR3WfoxWyrLM0xxMfnvz/ebIAhUSZ63IwLRriVBNibV3J/UjBY+Jtc
Jy9SVYwZ1gCClQMGiYRWWu39rkeGHJjLr+FkSYiZqayHJi0FP+dcTyVIxB3eHsbe
0IGNTvdDssmDbBKwchiR7MtDY3wE/pwWTGnPk6qkmzRe5WyO5SA+kG6A2kk2W7cd
U8OQWOPNvRogIRiEfm5c61hrdXKq0N4PG3G5UBn/lqseMLopmPt3so6YWwtrTG37
l5ooSL3xKXCRR1qsHR1rSm6C55gqblb4/ixa+sKcdnHpZBwrxTYjlPEy4LvkHaap
0GXx+SHT2XgBW7tgNJrJMME3KuXVKJa9gwZOb2IA2EVs3lmo4Z+JF7J/HUOmN6IX
4wiEkuHHnkkZJctLegucnn1k/zVB0Dcf+yQQ1KUknvUUIZkuEdsEdX9Z99XGuG+5
M1p2+3l8MyMZEay1RZ1XYosfnS9RdtlRSpxlGRrt+g823PKYiII=
=Zlct
-----END PGP SIGNATURE-----