Shadow Project Shadow
5 CVEs affecting Shadow Project Shadow. Latest disclosed: 2023-04-14. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12424 | Critical | 9.8 | 2017-08-04 | In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to cra… |
CVE-2019-19882 | High | 7.8 | 2019-12-18 | shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs ar… |
CVE-2016-6252 | High | 7.8 | 2017-02-17 | Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap. |
CVE-2018-7169 | Medium | 5.3 | 2018-02-15 | An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2… |
CVE-2023-29383 | Low | 3.3 | 2023-04-14 | In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to explo… |