Summary
The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program.
Security Fix(es):
* util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames (CVE-2025-14104)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | libblkid | 2.40.2-15.el10_1 |
| AlmaLinux · 10 | libblkid-devel | 2.40.2-15.el10_1 |
| AlmaLinux · 10 | libfdisk | 2.40.2-15.el10_1 |
| AlmaLinux · 10 | libfdisk-devel | 2.40.2-15.el10_1 |
| AlmaLinux · 10 | libmount | 2.40.2-15.el10_1 |
| AlmaLinux · 10 | libmount-devel | 2.40.2-15.el10_1 |
| AlmaLinux · 10 | libsmartcols | 2.40.2-15.el10_1 |
| AlmaLinux · 10 | libsmartcols-devel | 2.40.2-15.el10_1 |
| AlmaLinux · 10 | libuuid | 2.40.2-15.el10_1 |
| AlmaLinux · 10 | libuuid-devel | 2.40.2-15.el10_1 |
| AlmaLinux · 10 | python3-libmount | 2.40.2-15.el10_1 |
| AlmaLinux · 10 | util-linux | 2.40.2-15.el10_1 |
| AlmaLinux · 10 | util-linux-core | 2.40.2-15.el10_1 |
| AlmaLinux · 10 | uuidd | 2.40.2-15.el10_1 |
Vulnerabilities 1
-
Medium 6.1
Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.