{"kind": "product", "path": "vulns/debian-14/util-linux", "name": "util-linux", "product": "util-linux", "ecosystem": "Debian:14", "items": [{"id": "CVE-2026-53615", "noindex": false, "published": "2026-10-14T15:56:45.310Z", "modified": "2026-10-15T15:07:57.462Z", "cvss": 8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "severity": "high", "epss": 0.00178, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-53615", "title": "util-linux libblkid DOS extended-partition overflow produces invalid partition metadata", "description": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream con", "references": ["https://github.com/util-linux/util-linux/security/advisories/GHSA-h4rw-gv36-wmp5", "https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623", "https://github.com/util-linux/util-linux/commit/a2d858176b609ab5b8535021a3af9cd302d23d31"], "fixes": ["2.42-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-53614", "noindex": false, "published": "2026-10-14T15:40:53.674Z", "modified": "2026-10-15T15:08:08.295Z", "cvss": 7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00139, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-53614", "title": "util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass", "description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. Thi", "references": ["https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9"], "fixes": ["2.42.2-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-53613", "noindex": false, "published": "2026-10-14T14:52:56.063Z", "modified": "2026-10-15T15:08:26.914Z", "cvss": 7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00128, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-53613", "title": "util-linux mount target TOCTOU allows local privilege escalation", "description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges", "references": ["https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0"], "fixes": ["2.42.2-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-53612", "noindex": false, "published": "2026-10-14T14:47:25.523Z", "modified": "2026-10-14T18:26:36.386Z", "cvss": 7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00115, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-53612", "title": "util-linux mount hook_owner TOCTOU allows local privilege escalation", "description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.", "references": ["https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4"], "fixes": ["2.42.2-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-76642", "noindex": false, "published": "2026-09-03T10:54:08.150Z", "modified": "2026-09-03T14:00:29.374Z", "cvss": 8.5, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00216, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-76642", "title": "util-linux libmount Privilege Escalation via Failed Mount Helper", "description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "references": ["https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"], "fixes": ["2.42.3-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-78409", "noindex": false, "published": "2026-09-02T15:11:47.184Z", "modified": "2026-10-21T17:51:49.053Z", "cvss": 7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00189, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-78409", "title": "Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks", "description": "The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.", "references": ["https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78409", "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"], "fixes": ["2.42.3-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-78410", "noindex": false, "published": "2026-09-02T15:05:34.414Z", "modified": "2026-10-21T17:51:51.633Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-78410", "title": "Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection", "description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "references": ["https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"], "fixes": ["2.42.3-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-78408", "noindex": false, "published": "2026-09-02T15:05:33.555Z", "modified": "2026-10-21T17:51:46.557Z", "cvss": 7.9, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "severity": "high", "epss": 0.00186, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-78408", "title": "Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "references": ["https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"], "fixes": ["2.42.4-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-13595", "noindex": false, "published": "2026-06-29T08:06:09.059Z", "modified": "2026-08-31T17:18:31.999Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "severity": "medium", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-13595", "title": "Util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to li", "references": ["https://access.redhat.com/errata/RHSA-2026:26573", "https://access.redhat.com/security/cve/CVE-2026-13595", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101"], "fixes": ["2.42.2-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-27456", "noindex": false, "published": "2026-04-03T21:23:00.984Z", "modified": "2026-04-06T15:42:35.774Z", "cvss": 4.7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00118, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-27456", "title": "util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup", "description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink", "references": ["https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g", "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4", "https://github.com/util-linux/util-linux/releases/tag/v2.41.4"], "fixes": ["2.42-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-3184", "noindex": false, "published": "2026-04-03T18:43:45.725Z", "modified": "2026-08-31T11:48:27.512Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00436, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-3184", "title": "Util-linux: util-linux: access control bypass due to improper hostname canonicalization", "description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "references": ["https://access.redhat.com/errata/RHSA-2026:7180", "https://access.redhat.com/security/cve/CVE-2026-3184", "https://bugzilla.redhat.com/show_bug.cgi?id=2442570"], "fixes": ["2.42-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2025-14104", "noindex": false, "published": "2025-12-05T16:22:09.283Z", "modified": "2026-10-14T19:31:48.792Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "severity": "medium", "epss": 0.002, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-14104", "title": "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames", "description": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.", "references": ["https://access.redhat.com/errata/RHSA-2026:1696", "https://access.redhat.com/errata/RHSA-2026:1852", "https://access.redhat.com/errata/RHSA-2026:1913"], "fixes": ["2.41.3-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-28085", "noindex": false, "published": "2024-03-27T00:00:00.000Z", "modified": "2026-10-15T00:40:25.607Z", "cvss": 3.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.02242, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-28085", "title": "CVE-2024-28085", "description": "wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.", "references": ["https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt", "https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq", "https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/"], "fixes": ["2.39.3-11"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2020-21583", "noindex": false, "published": "2023-08-22T00:00:00.000Z", "modified": "2024-12-20T13:06:39.507Z", "cvss": 6.7, "cvss_vector": "", "severity": "medium", "epss": 0.00547, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-21583", "title": "CVE-2020-21583", "description": "An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.", "references": ["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786804", "https://packetstormsecurity.com/files/132061/hwclock-Privilege-Escalation.html", "https://security.netapp.com/advisory/ntap-20241220-0006/"], "fixes": ["2.27-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2021-3996", "noindex": false, "published": "2022-08-23T00:00:00.000Z", "modified": "2024-10-15T15:26:56.079Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00641, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-3996", "title": "CVE-2021-3996", "description": "A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.", "references": ["https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.3-ReleaseNotes", "https://github.com/util-linux/util-linux/commit/166e87368ae88bf31112a30e078cceae637f4cdb", "https://www.openwall.com/lists/oss-security/2022/01/24/2"], "fixes": ["2.37.3-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2021-3995", "noindex": false, "published": "2022-08-23T00:00:00.000Z", "modified": "2024-08-03T17:16:03.736Z", "cvss": 5.5, "cvss_vector": "", "severity": "medium", "epss": 0.00637, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-3995", "title": "CVE-2021-3995", "description": "A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker in its string form. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.", "references": ["https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.3-ReleaseNotes", "https://www.openwall.com/lists/oss-security/2022/01/24/2", "https://github.com/util-linux/util-linux/commit/57202f5713afa2af20ffbb6ab5331481d0396f8d"], "fixes": ["2.37.3-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2022-0563", "noindex": false, "published": "2022-02-21T00:00:00.000Z", "modified": "2026-10-14T12:12:32.435Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.0043, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-0563", "title": "CVE-2022-0563", "description": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.", "references": ["https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u", "https://security.netapp.com/advisory/ntap-20220331-0002/", "https://security.gentoo.org/glsa/202401-08"], "fixes": [], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2021-37600", "noindex": false, "published": "2021-07-28T00:00:00.000Z", "modified": "2026-10-14T11:49:11.871Z", "cvss": 5.5, "cvss_vector": "", "severity": "medium", "epss": 0.00661, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2021-37600", "title": "CVE-2021-37600", "description": "An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.", "references": ["https://github.com/karelzak/util-linux/issues/1395", "https://github.com/karelzak/util-linux/commit/1c9143d0c1f979c3daf10e1c37b5b1e916c22a1c", "https://security.netapp.com/advisory/ntap-20210902-0002/"], "fixes": ["2.36.1-8"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2017-2616", "noindex": false, "published": "2018-07-27T19:00:00.000Z", "modified": "2025-06-09T15:37:51.878Z", "cvss": 5.5, "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00279, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2017-2616", "title": "CVE-2017-2616", "description": "A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2616", "http://www.securityfocus.com/bid/96404", "https://access.redhat.com/errata/RHSA-2017:0907"], "fixes": ["2.29.2-1"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}, {"id": "CVE-2018-7738", "noindex": false, "published": "2018-03-06T22:00:00.000Z", "modified": "2024-12-13T13:09:22.233Z", "cvss": 7.8, "cvss_vector": "", "severity": "high", "epss": 0.00432, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-7738", "title": "CVE-2018-7738", "description": "In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.", "references": ["https://github.com/karelzak/util-linux/issues/539", "https://www.debian.org/security/2018/dsa-4134", "http://www.securityfocus.com/bid/103367"], "fixes": ["2.31.1-0.5"], "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}]}], "total": 33, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "util-linux", "path": "vulns/debian-14/util-linux", "ecosystem": "Debian:14"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 4, "kev": 0}, "lastmod": "2026-10-21T17:51:51.633Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}