kritisch
CVE-2017-12424
shadow-utils: Buffer overflow via newusers tool
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.5CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Photon OS (hoch), Red Hat (mittel), Ubuntu (niedrig).
Beschreibung
In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.10 | shadow | 4.5-r0 |
| alpine 3.11 | shadow | 4.5-r0 |
| alpine 3.12 | shadow | 4.5-r0 |
| alpine 3.13 | shadow | 4.5-r0 |
| alpine 3.14 | shadow | 4.5-r0 |
| alpine 3.15 | shadow | 4.5-r0 |
| alpine 3.16 | shadow | 4.5-r0 |
| alpine 3.17 | shadow | 4.5-r0 |
| alpine 3.18 | shadow | 4.5-r0 |
| alpine 3.19 | shadow | 4.5-r0 |
| alpine 3.20 | shadow | 4.5-r0 |
| alpine 3.21 | shadow | 4.5-r0 |
Alle 32 Einträge aus 32 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.10 | shadow | 4.5-r0 |
| alpine 3.11 | shadow | 4.5-r0 |
| alpine 3.12 | shadow | 4.5-r0 |
| alpine 3.13 | shadow | 4.5-r0 |
| alpine 3.14 | shadow | 4.5-r0 |
| alpine 3.15 | shadow | 4.5-r0 |
| alpine 3.16 | shadow | 4.5-r0 |
| alpine 3.17 | shadow | 4.5-r0 |
| alpine 3.18 | shadow | 4.5-r0 |
| alpine 3.19 | shadow | 4.5-r0 |
| alpine 3.20 | shadow | 4.5-r0 |
| alpine 3.21 | shadow | 4.5-r0 |
| alpine 3.22 | shadow | 4.5-r0 |
| alpine 3.23 | shadow | 4.5-r0 |
| alpine 3.24 | shadow | 4.5-r0 |
| alpine 3.7 | shadow | 4.5-r0 |
| alpine 3.8 | shadow | 4.5-r0 |
| alpine 3.9 | shadow | 4.5-r0 |
| alpine edge | shadow | 4.5-r0 |
| debian 11 | shadow | 1:4.5-1 |
| debian 12 | shadow | 1:4.5-1 |
| debian 13 | shadow | 1:4.5-1 |
| debian 14 | shadow | 1:4.5-1 |
| debian 7 | shadow | kein Fix angegeben |
| debian 8 | shadow | kein Fix angegeben |
| debian 9 | shadow | 1:4.4-4.1+deb9u1 |
| echo | shadow | 1:4.5-1 |
| Photon OS 1.0 | shadow | 4.2.1-11.ph1 |
| Photon OS 2.0 | shadow | 4.2.1-14.ph2 |
| root.io debian 12 | rootio-shadow | 1:4.5-1 |
| ubuntu 14.04-ESM | shadow | 1:4.1.5.1-1ubuntu9.5+esm1 |
| ubuntu 16.04-ESM | shadow | 1:4.2-3.1ubuntu5.5+esm1 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2017-12424
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756630
- https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1266675
- https://github.com/shadow-maint/shadow/commit/954e3d2e7113e9ac06632aee3c69b8d818cc8952
- https://lists.debian.org/debian-lts-announce/2021/03/msg00020.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-12424
- https://security.gentoo.org/glsa/201710-16
- https://ubuntu.com/security/notices/USN-5254-1