Search for packages
| purl | pkg:deb/debian/shadow@1:4.13%2Bdfsg1-1 |
| Tags | Ghost |
| Next non-vulnerable version | 1:4.13+dfsg1-1+deb12u1 |
| Latest non-vulnerable version | 1:4.17.4-2 |
| Risk | 2.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-5u13-xzak-aaac
Aliases: CVE-2023-4641 |
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-wtbj-a4a5-aaan
Aliases: CVE-2023-29383 |
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2025-04-26T08:10:02.839465+00:00 | Debian Oval Importer | Fixing | VCID-5u13-xzak-aaac | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-26T08:10:01.433078+00:00 | Debian Oval Importer | Fixing | VCID-wtbj-a4a5-aaan | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-05T06:05:27.783595+00:00 | Debian Importer | Affected by | VCID-5u13-xzak-aaac | None | 36.0.0 |
| 2025-04-04T04:01:41.748935+00:00 | Debian Importer | Affected by | VCID-wtbj-a4a5-aaan | https://security-tracker.debian.org/tracker/data/json | 36.0.0 |
| 2025-04-04T03:22:39.023809+00:00 | Debian Importer | Fixing | VCID-ve96-dzxq-aaak | None | 36.0.0 |
| 2025-04-04T02:21:58.286828+00:00 | Debian Importer | Affected by | VCID-wtbj-a4a5-aaan | None | 36.0.0 |
| 2025-04-04T01:58:46.363516+00:00 | Debian Importer | Fixing | VCID-ve96-dzxq-aaak | https://security-tracker.debian.org/tracker/data/json | 36.0.0 |
| 2025-04-03T23:16:03.474726+00:00 | Debian Importer | Affected by | VCID-5u13-xzak-aaac | https://security-tracker.debian.org/tracker/data/json | 36.0.0 |
| 2025-02-21T14:24:46.158501+00:00 | Debian Importer | Affected by | VCID-5u13-xzak-aaac | None | 35.1.0 |
| 2025-02-21T14:24:36.047051+00:00 | Debian Importer | Affected by | VCID-5u13-xzak-aaac | https://security-tracker.debian.org/tracker/data/json | 35.1.0 |
| 2025-02-21T10:53:49.597480+00:00 | Debian Importer | Affected by | VCID-wtbj-a4a5-aaan | None | 35.1.0 |
| 2025-02-21T10:53:43.285948+00:00 | Debian Importer | Affected by | VCID-wtbj-a4a5-aaan | https://security-tracker.debian.org/tracker/data/json | 35.1.0 |
| 2025-02-18T11:34:47.710348+00:00 | Debian Importer | Fixing | VCID-ve96-dzxq-aaak | None | 35.1.0 |
| 2025-02-18T11:34:46.998589+00:00 | Debian Importer | Fixing | VCID-ve96-dzxq-aaak | https://security-tracker.debian.org/tracker/data/json | 35.1.0 |
| 2024-11-24T03:30:24.434684+00:00 | Debian Importer | Affected by | VCID-5u13-xzak-aaac | https://security-tracker.debian.org/tracker/data/json | 35.0.0 |
| 2024-11-24T00:20:07.616868+00:00 | Debian Importer | Affected by | VCID-wtbj-a4a5-aaan | https://security-tracker.debian.org/tracker/data/json | 35.0.0 |
| 2024-11-21T09:18:37.408155+00:00 | Debian Importer | Fixing | VCID-ve96-dzxq-aaak | https://security-tracker.debian.org/tracker/data/json | 35.0.0 |
| 2024-11-19T09:05:11.303756+00:00 | Debian Importer | Fixing | VCID-ve96-dzxq-aaak | https://security-tracker.debian.org/tracker/data/json | 34.3.2 |
| 2024-10-11T00:54:00.918166+00:00 | Debian Importer | Affected by | VCID-5u13-xzak-aaac | https://security-tracker.debian.org/tracker/data/json | 34.0.2 |
| 2024-10-10T22:09:29.351350+00:00 | Debian Importer | Affected by | VCID-wtbj-a4a5-aaan | https://security-tracker.debian.org/tracker/data/json | 34.0.2 |
| 2024-10-08T09:58:55.848549+00:00 | Debian Importer | Fixing | VCID-ve96-dzxq-aaak | https://security-tracker.debian.org/tracker/data/json | 34.0.2 |
| 2024-09-23T07:58:42.610414+00:00 | Debian Importer | Fixing | VCID-ve96-dzxq-aaak | https://security-tracker.debian.org/tracker/data/json | 34.0.1 |
| 2024-09-20T05:24:05.562500+00:00 | Debian Importer | Affected by | VCID-5u13-xzak-aaac | https://security-tracker.debian.org/tracker/data/json | 34.0.1 |
| 2024-09-20T02:59:54.960837+00:00 | Debian Importer | Affected by | VCID-wtbj-a4a5-aaan | https://security-tracker.debian.org/tracker/data/json | 34.0.1 |
| 2024-04-26T05:50:42.148683+00:00 | Debian Importer | Affected by | VCID-5u13-xzak-aaac | None | 34.0.0rc4 |
| 2024-04-26T05:50:41.279858+00:00 | Debian Importer | Affected by | VCID-5u13-xzak-aaac | https://security-tracker.debian.org/tracker/data/json | 34.0.0rc4 |
| 2024-04-26T02:54:00.420915+00:00 | Debian Importer | Affected by | VCID-wtbj-a4a5-aaan | None | 34.0.0rc4 |
| 2024-04-26T02:53:58.772569+00:00 | Debian Importer | Affected by | VCID-wtbj-a4a5-aaan | https://security-tracker.debian.org/tracker/data/json | 34.0.0rc4 |
| 2024-04-24T08:37:36.268328+00:00 | Debian Importer | Fixing | VCID-ve96-dzxq-aaak | https://security-tracker.debian.org/tracker/data/json | 34.0.0rc4 |
| 2024-04-24T08:37:34.635502+00:00 | Debian Importer | Fixing | VCID-ve96-dzxq-aaak | None | 34.0.0rc4 |
| 2024-01-12T12:54:41.892248+00:00 | Debian Importer | Affected by | VCID-wtbj-a4a5-aaan | None | 34.0.0rc2 |
| 2024-01-12T12:54:41.038407+00:00 | Debian Importer | Affected by | VCID-wtbj-a4a5-aaan | https://security-tracker.debian.org/tracker/data/json | 34.0.0rc2 |
| 2024-01-10T10:33:24.314623+00:00 | Debian Importer | Fixing | VCID-ve96-dzxq-aaak | https://security-tracker.debian.org/tracker/data/json | 34.0.0rc2 |
| 2024-01-10T10:33:00.824167+00:00 | Debian Importer | Fixing | VCID-ve96-dzxq-aaak | None | 34.0.0rc2 |
| 2024-01-05T08:36:09.328815+00:00 | Debian Importer | Affected by | VCID-wtbj-a4a5-aaan | None | 34.0.0rc1 |
| 2024-01-05T08:36:08.462897+00:00 | Debian Importer | Affected by | VCID-wtbj-a4a5-aaan | https://security-tracker.debian.org/tracker/data/json | 34.0.0rc1 |
| 2024-01-04T02:57:35.516215+00:00 | Debian Importer | Fixing | VCID-ve96-dzxq-aaak | https://security-tracker.debian.org/tracker/data/json | 34.0.0rc1 |
| 2024-01-04T02:57:25.348757+00:00 | Debian Importer | Fixing | VCID-ve96-dzxq-aaak | None | 34.0.0rc1 |