Summary
Sebastian Krahmer discovered integer overflows in shadow utilities.
A local attacker could possibly cause them to crash or potentially
gain privileges via crafted input. (CVE-2016-6252)
Tobias Stöckmann discovered a race condition in su. A local
attacker could cause su to send SIGKILL to other processes with
root privileges. (CVE-2017-2616)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | shadow | 1:4.1.5.1-1ubuntu9.4 |
| Ubuntu · 16.04 LTS 16.04:LTS | shadow | 1:4.2-3.1ubuntu5.2 |
Vulnerabilities 2
-
Medium 5.5
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local…
-
Unscored —
Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.