shadow

19 results · Feed

• Low 3.6
  CVE-2024-56433 Public exploit

  shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 16553…

  shadow-maint shadow-utils shadow shadow Debian Ubuntu
  Dec 26, 2024
• Medium 4.7
  CVE-2023-4641

  Shadow-utils: possible password leak during passwd(1) change

  A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enoug…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Dec 27, 2023
• Unscored —
  CVE-2023-29383

  In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finge…

  shadow shadow shadow Debian Ubuntu Alpine
  Apr 14, 2023
• Unscored —
  CVE-2017-20002

  The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/sec…

  shadow Debian
  Mar 17, 2021
• Unscored —
  CVE-2019-19882

  shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtai…

  shadow Debian
  Dec 18, 2019
• Unscored —
  CVE-2013-4235

  shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees

  shadow shadow shadow shadow Debian Ubuntu
  Dec 3, 2019
• Unscored —
  CVE-2005-4890

  There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The …

  Red Hat shadow sudo sudo Debian
  Nov 4, 2019
• Medium 5.5
  CVE-2017-2616

  A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local…

  Linux util-linux util-linux shadow Linux Debian Ubuntu Alpine
  Jul 27, 2018
• Unscored —
  CVE-2018-7169

  An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be plac…

  shadow shadow Debian Ubuntu
  Feb 15, 2018
• Unscored —
  CVE-2017-12424

  In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the …

  shadow shadow shadow Debian Ubuntu Alpine
  Aug 4, 2017
• Unscored —
  CVE-2016-6252

  Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.

  shadow shadow shadow Debian Ubuntu Alpine
  Feb 17, 2017
• Unscored —
  CVE-2011-0721

  Multiple CRLF injection vulnerabilities in (1) chfn and (2) chsh in shadow 1:4.1.4 allow local users to add new users o…

  shadow Debian
  Feb 18, 2011
• Unscored —
  CVE-2008-5394 Public exploit

  /bin/login in shadow 4.0.18.1 in Debian GNU/Linux, and probably other Linux distributions, allows local users in the ut…

  shadow Debian
  Dec 9, 2008
• Unscored —
  CVE-2007-5686

  initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain s…

  shadow Debian
  Oct 28, 2007
• Unscored —
  CVE-2006-3378

  passwd command in shadow in Ubuntu 5.04 through 6.06 LTS, when called with the -f, -g, or -s flag, does not check the r…

  shadow Debian
  Jul 6, 2006
• Unscored —
  CVE-2006-1174

  useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to…

  shadow Debian
  May 28, 2006
• Unscored —
  CVE-2006-1844

  The Debian installer for the (1) shadow 4.0.14 and (2) base-config 2.53.10 packages includes sensitive information in w…

  shadow Debian
  Apr 19, 2006
• Unscored —
  CVE-2006-1376

  The installation of Debian GNU/Linux 3.1r1 from the network install CD creates /var/log/debian-installer/cdebconf with …

  shadow Debian
  Mar 24, 2006
• Unscored —
  CVE-2004-1001

  Unknown vulnerability in the passwd_check function in Shadow 4.0.4.1, and possibly other versions before 4.0.5, allows …

  shadow Debian
  Nov 4, 2004