Debian/shadow: low 3.3
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user
Action: Upgrade shadow to 1:4.13+dfsg1-2 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1:4.13+dfsg1-2 | - |
Fixed versions
| 1:4.13+dfsg1-2 |
Sources
- osv: DEBIAN-CVE-2023-29383#Debian:13/shadow
- https://security-tracker.debian.org/tracker/CVE-2023-29383
published · modified · JSON