p PatchFirst

CVE-2017-12424

CVE-2017-12424

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.

CVSS 9.8 · Critical · EPSS 2.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • shadow Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:4.5-1

    Update to 1:4.5-1

  • shadow Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:4.5-1

    Update to 1:4.5-1

  • shadow Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:4.5-1

    Update to 1:4.5-1

  • shadow Ubuntu:Pro:14.04:LTS

    Versions
    • 1:4.1.5.1-1ubuntu6
    • 1:4.1.5.1-1ubuntu7
    • 1:4.1.5.1-1ubuntu8
    • 1:4.1.5.1-1ubuntu9
    • 1:4.1.5.1-1ubuntu9.1
    • 1:4.1.5.1-1ubuntu9.2
    • 1:4.1.5.1-1ubuntu9.4
    • 1:4.1.5.1-1ubuntu9.5
    Affected ranges
    • ECOSYSTEM: < 1:4.1.5.1-1ubuntu9.5+esm1

    Update to 1:4.1.5.1-1ubuntu9.5+esm1

  • shadow Ubuntu:Pro:16.04:LTS

    Versions
    • 1:4.1.5.1-1.1ubuntu7
    • 1:4.2-3.1ubuntu1
    • 1:4.2-3.1ubuntu2
    • 1:4.2-3.1ubuntu3
    • 1:4.2-3.1ubuntu4
    • 1:4.2-3.1ubuntu5
    • 1:4.2-3.1ubuntu5.2
    • 1:4.2-3.1ubuntu5.3
    • 1:4.2-3.1ubuntu5.4
    Affected ranges
    • ECOSYSTEM: < 1:4.2-3.1ubuntu5.5+esm1

    Update to 1:4.2-3.1ubuntu5.5+esm1

Original sources

Check your server →