https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:58:08 +0000 https://cve.radiocsirt.org/vuln/alsa-2023:6632 <p><strong>Affected:</strong> AlmaLinux:9: shadow-utils, AlmaLinux:9: shadow-utils-subid, AlmaLinux:9: shadow-utils-subid-devel</p> <p>The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts.</p> <p>Security Fix(es):</p> <p>* shadow-utils: possible password leak during passwd(1) change (CVE-2023-4641)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: shadow-utils, AlmaLinux:9: shadow-utils-subid, AlmaLinux:9: shadow-utils-subid-devel</p> <p>The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts.</p> <p>Security Fix(es):</p> <p>* shadow-utils: possible password leak during passwd(1) change (CVE-2023-4641)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2023:6632 https://cve.radiocsirt.org/vuln/bdu:2024-02776 bdu:2024-02776 https://cve.radiocsirt.org/vuln/bdu:2024-02776 https://cve.radiocsirt.org/vuln/bell-cve-2023-4641 <p><strong>Affected:</strong> Alpaquita:23: shadow, Alpaquita:stream: shadow</p> <p><strong>Affected:</strong> Alpaquita:23: shadow, Alpaquita:stream: shadow</p> https://cve.radiocsirt.org/vuln/bell-cve-2023-4641 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0585 certfr-2024-avi-0585 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0585 https://cve.radiocsirt.org/vuln/euvd-2026-257708 EUVD-2026-257708 https://cve.radiocsirt.org/vuln/euvd-2026-257708 https://cve.radiocsirt.org/vuln/fkie_cve-2023-4641 <p>A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.</p> <p>A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-4641 https://cve.radiocsirt.org/vuln/ghsa-6ggv-mmg2-jf4r <p>A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.</p> <p>A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.</p> https://cve.radiocsirt.org/vuln/ghsa-6ggv-mmg2-jf4r https://cve.radiocsirt.org/vuln/gsd-2023-4641 gsd-2023-4641 https://cve.radiocsirt.org/vuln/gsd-2023-4641 https://cve.radiocsirt.org/vuln/msrc_cve-2023-4641 msrc_CVE-2023-4641 https://cve.radiocsirt.org/vuln/msrc_cve-2023-4641 https://cve.radiocsirt.org/vuln/oesa-2023-1687 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: shadow, openEuler:20.03-LTS-SP3: shadow, openEuler:22.03-LTS: shadow, openEuler:22.03-LTS-SP1: shadow, openEuler:22.03-LTS-SP2: shadow</p> <p>This package includes the necessary programs for converting plain password files to the shadow password format and to manage user and group accounts. Security Fix(es): When gpasswd(1) asks for the new password, it asks twice (as is usual for confirming the new password). Each of those 2 password prompts uses agetpass() to get the password. If the second agetpass() fails, the first password, which has been copied into the &amp;apos;static&amp;apos; buffer &amp;apos;pass&amp;apos; via STRFCPY(), wasn&amp;apos;t being zeroed.(CVE-2023-4641)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: shadow, openEuler:20.03-LTS-SP3: shadow, openEuler:22.03-LTS: shadow, openEuler:22.03-LTS-SP1: shadow, openEuler:22.03-LTS-SP2: shadow</p> <p>This package includes the necessary programs for converting plain password files to the shadow password format and to manage user and group accounts. Security Fix(es): When gpasswd(1) asks for the new password, it asks twice (as is usual for confirming the new password). Each of those 2 password prompts uses agetpass() to get the password. If the second agetpass() fails, the first password, which has been copied into the &amp;apos;static&amp;apos; buffer &amp;apos;pass&amp;apos; via STRFCPY(), wasn&amp;apos;t being zeroed.(CVE-2023-4641)</p> https://cve.radiocsirt.org/vuln/oesa-2023-1687 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10081-1 <p>libsubid-devel-4.19.2-2.1 on GA media</p> <p>libsubid-devel-4.19.2-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10081-1 https://cve.radiocsirt.org/vuln/rhsa-2024:0417 <p>shadow-utils: possible password leak during passwd(1) change</p> <p>shadow-utils: possible password leak during passwd(1) change</p> https://cve.radiocsirt.org/vuln/rhsa-2024:0417 https://cve.radiocsirt.org/vuln/ssa-202008 <p>An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used &#34;group blacklisting&#34; (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the ar…</p> <p>An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used &#34;group blacklisting&#34; (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the ar…</p> https://cve.radiocsirt.org/vuln/ssa-202008 https://cve.radiocsirt.org/vuln/suse-su-2023:3591-1 <p>Security update for shadow</p> <p>Security update for shadow</p> https://cve.radiocsirt.org/vuln/suse-su-2023:3591-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-4641 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: shadow, Ubuntu:Pro:16.04:LTS: shadow, Ubuntu:Pro:18.04:LTS: shadow, Ubuntu:20.04:LTS: shadow, Ubuntu:22.04:LTS: shadow</p> <p>A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: shadow, Ubuntu:Pro:16.04:LTS: shadow, Ubuntu:Pro:18.04:LTS: shadow, Ubuntu:20.04:LTS: shadow, Ubuntu:22.04:LTS: shadow</p> <p>A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-4641 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2357 <p>Ein lokaler Angreifer kann eine Schwachstelle in shadow ausnutzen, um Informationen offenzulegen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in shadow ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2357