Debian/shadow: low 3.3
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user
Action: Upgrade shadow to 1:4.13+dfsg1-1+deb12u1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1:4.13+dfsg1-1+deb12u1 | - |
Fixed versions
| 1:4.13+dfsg1-1+deb12u1 |
Sources
published · modified · JSON