Skip to content
OpenAdvisories
Unscored USN-3276-2 0 CVEs

shadow regression

Published May 17, 2017 · Updated Feb 10, 2026

Summary

USN-3276-1 intended to fix a vulnerability in su. The solution introduced
a regression in su signal handling. This update modifies the security fix.
We apologize for the inconvenience.

Original advisory details:

Sebastian Krahmer discovered integer overflows in shadow utilities.
A local attacker could possibly cause them to crash or potentially
gain privileges via crafted input. (CVE-2016-6252)

Tobias Stöckmann discovered a race condition in su. A local
attacker could cause su to send SIGKILL to other processes with
root privileges. (CVE-2017-2616)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS shadow 1:4.1.5.1-1ubuntu9.5
Ubuntu · 16.04 LTS 16.04:LTS shadow 1:4.2-3.1ubuntu5.3

References

  • report
    https://launchpad.net/bugs/1690820