shadow project records
5 published records for vendor shadow project.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-732 Incorrect Permission Assignment for Critical Resource2
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer1
- CWE-190 Integer Overflow or Wraparound1
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
5 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2017-12424No exploit | In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors.shadow project · shadow · CWE-119 | Critical9.8 | — | 2.6% | Aug 4, 2017 |
31Monitor | CVE-2019-19882No exploit | shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access becauseshadow project · shadow · CWE-732 | High7.8 | — | 0.5% | Dec 18, 2019 |
31Monitor | CVE-2016-6252No exploit | Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.shadow project · shadow · CWE-190 | High7.8 | — | 0.4% | Feb 17, 2017 |
21Monitor | CVE-2018-7169No exploit | An issue was discovered in shadow 4.5.shadow project · shadow · CWE-732 | Medium5.3 | — | 1.5% | Feb 15, 2018 |
13Monitor | CVE-2023-29383No exploit | In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger).shadow project · shadow · CWE-74 | Low3.3 | — | 0.4% | Apr 14, 2023 |
- CVE-2017-1242440Plan
In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors.
CriticalCVSS 9.8No exploitEPSS 2%shadow project · shadowAug 4, 2017
- CVE-2019-1988231Monitor
shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because
HighCVSS 7.8No exploitEPSS 0%shadow project · shadowDec 18, 2019
- CVE-2016-625231Monitor
Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.
HighCVSS 7.8No exploitEPSS 0%shadow project · shadowFeb 17, 2017
- CVE-2018-716921Monitor
An issue was discovered in shadow 4.5.
MediumCVSS 5.3No exploitEPSS 1%shadow project · shadowFeb 15, 2018
- CVE-2023-2938313Monitor
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger).
LowCVSS 3.3No exploitEPSS 0%shadow project · shadowApr 14, 2023