Every CVE Search/ Get API key

CVE-2018-1063

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local,...

4.4 MediumFix available

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.40%Down 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 4.4

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.

Record
CVE-2018-1063
CVSS 3.0
4.4 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0
3.3 LowAV:L/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-59
Updated
2026-11-02
CVE List No score

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.

Record
CVE-2018-1063
Weakness
CWE-59
Updated
2026-11-02
EUVDEUVD-2018-11716 No score

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.

Record
EUVD-2018-11716
Updated
2026-11-03
GitHub AdvisoriesGHSA-p5j6-rvwf-qchg 4.4

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local,...

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.

Record
GHSA-p5j6-rvwf-qchg
CVSS 3.0
4.4 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-59
Updated
2026-11-02
OSV 4.4

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.

Record
CVE-2018-1063
CVSS 3.0
4.4 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2018-1063 4.4

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.

Record
DEBIAN-CVE-2018-1063
CVSS 3.0
4.4 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2018:0913 3.9

Red Hat Security Advisory: policycoreutils security, bug fix, and enhancement update

Record
RHSA-2018:0913
CVSS 3.0
3.9 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2018-1063 4.4

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.

Record
UBUNTU-CVE-2018-1063
CVSS 3.0
4.4 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVMGASA-2021-0032 No score

Updated policycoreutils packages fix a security vulnerability

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing) (CVE-2018-1063).

Record
MGASA-2021-0032
Updated
2026-11-02
OSVopenSUSE-SU-2024:11179-1 No score

policycoreutils-3.2-1.4 on GA media

These are all security issues fixed in the policycoreutils-3.2-1.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11179-1
Updated
2026-11-02
OSVSUSE-SU-2018:0926-1 No score

Security update for policycoreutils

This update for policycoreutils fixes the following issues:

  • CVE-2018-1063: Fixed problem to prevent chcon from following symlinks in /tmp, /var/tmp, /var/run and /var/lib/debug (bsc#1083624).
Record
SUSE-SU-2018:0926-1
Updated
2026-11-02
OSVSUSE-SU-2018:0927-1 No score

Security update for policycoreutils

This update for policycoreutils fixes the following issues:

  • CVE-2018-1063: Prevent chcon from following symlinks in /tmp, /var/tmp, /var/run and /var/lib/debug (bsc#1083624).
Record
SUSE-SU-2018:0927-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
policycoreutils
Debian:12
 before 2.7-1
2.7-1
policycoreutils
Debian:13
 before 2.7-1
2.7-1
policycoreutils
Debian:14
 before 2.7-1
2.7-1
policycoreutils
Mageia:7
 before 2.5-14.1.mga7
2.5-14.1.mga7
policycoreutils
Red Hat:enterprise_linux:7::client
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-devel
Red Hat:enterprise_linux:7::client
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-gui
Red Hat:enterprise_linux:7::client
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-newrole
Red Hat:enterprise_linux:7::client
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-python
Red Hat:enterprise_linux:7::client
 before 0:2.5-22.el7
0:2.5-22.el7
Show 36 moreShow less
Affected packages
PackageAffectedFixed
policycoreutils-sandbox
Red Hat:enterprise_linux:7::client
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-restorecond
Red Hat:enterprise_linux:7::client
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils
Red Hat:enterprise_linux:7::computenode
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-newrole
Red Hat:enterprise_linux:7::computenode
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-python
Red Hat:enterprise_linux:7::computenode
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-devel
Red Hat:enterprise_linux:7::computenode
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-gui
Red Hat:enterprise_linux:7::computenode
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-restorecond
Red Hat:enterprise_linux:7::computenode
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-sandbox
Red Hat:enterprise_linux:7::computenode
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils
Red Hat:enterprise_linux:7::server
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-devel
Red Hat:enterprise_linux:7::server
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-gui
Red Hat:enterprise_linux:7::server
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-newrole
Red Hat:enterprise_linux:7::server
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-python
Red Hat:enterprise_linux:7::server
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-sandbox
Red Hat:enterprise_linux:7::server
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-restorecond
Red Hat:enterprise_linux:7::server
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils
Red Hat:enterprise_linux:7::workstation
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-devel
Red Hat:enterprise_linux:7::workstation
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-gui
Red Hat:enterprise_linux:7::workstation
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-newrole
Red Hat:enterprise_linux:7::workstation
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-python
Red Hat:enterprise_linux:7::workstation
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-sandbox
Red Hat:enterprise_linux:7::workstation
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils-restorecond
Red Hat:enterprise_linux:7::workstation
 before 0:2.5-22.el7
0:2.5-22.el7
policycoreutils
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
 before 2.5-10.3.1
2.5-10.3.1
policycoreutils
SUSE:Linux Enterprise Server 12 SP2
 before 2.5-10.3.1
2.5-10.3.1
policycoreutils
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 2.5-10.3.1
2.5-10.3.1
policycoreutils
SUSE:Linux Enterprise Server 12 SP3
 before 2.5-10.3.1
2.5-10.3.1
policycoreutils
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 2.5-10.3.1
2.5-10.3.1
policycoreutils
SUSE:Linux Enterprise Server 11 SP4
 before 2.0.79-4.9.3.3
2.0.79-4.9.3.3
policycoreutils
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 2.0.79-4.9.3.3
2.0.79-4.9.3.3
policycoreutils
Ubuntu:14.04:LTS
 All versions, plus listed versions
2.1.13-22.2.1-12.2.4-12.2.5-1
 None known
policycoreutils
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.3-1
 None known
coreutils
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 3.2-1.4
3.2-1.4

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-1063 is a medium vulnerability (CVSS 4.4) in Selinux Project Policycoreutils, published March 2, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in policycoreutils 2.7-1.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open