8 results · Feed
-
Low 3.6CVE-2024-56433 Public exploit
shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 16553…
-
Medium 4.7
Shadow-utils: possible password leak during passwd(1) change
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enoug…
-
Unscored —
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finge…
-
Unscored —
shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees
-
Medium 5.5
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local…
-
Unscored —
An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be plac…
-
Unscored —
In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the …
-
Unscored —
Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.