Every CVE Search/ Get API key

CVE-2016-6252

Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to...

7.8 HighFix available

Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.41%Down 0.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.8

Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.

Record
CVE-2016-6252
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-190
Updated
2026-11-02
CVE List No score

Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.

Record
CVE-2016-6252
Updated
2026-11-02
EUVDEUVD-2016-7182 No score

Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.

Record
EUVD-2016-7182
Updated
2026-11-03
GitHub AdvisoriesGHSA-8rg4-9fq3-cf7g 7.8

Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to...

Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.

Record
GHSA-8rg4-9fq3-cf7g
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
OSVALPINE-CVE-2016-6252 7.8

Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.

Record
ALPINE-CVE-2016-6252
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVBELL-CVE-2016-6252 7.8

CVE-2016-6252 does not affect BellSoft software

Record
BELL-CVE-2016-6252
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 8 moreShow less
OSV 7.8

Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.

Record
CVE-2016-6252
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-6252 7.8

Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.

Record
DEBIAN-CVE-2016-6252
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-6252 7.8

Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.

Record
UBUNTU-CVE-2016-6252
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2017-0024 No score

Updated shadow-utils packages fix security vulnerabilities

It was found that shadow-utils-4.2.1 had a potentially unsafe use of getlogin with the concern that the utmp entry might have a spoofed username associated with a correct uid (CVE-2016-6251).

It was found that shadow-utils-4.2.1 had an incorrect integer handling problem where it looks like the int wrap is exploitable as a LPE, as the kernel is using 32bit uid's that are truncated from unsigned longs (64bit on x64) as returned by simple_strtoul() [map_write()]. (CVE-2016-6252).

Record
MGASA-2017-0024
Updated
2026-11-02
OSVSUSE-SU-2018:1995-1 No score

Security update for shadow

This update for shadow fixes the following issues:

  • CVE-2016-6252: Fixed incorrect integer handling that could results in a local privilege escalation (bsc#1099310)
Record
SUSE-SU-2018:1995-1
Updated
2026-11-02
OSVSUSE-SU-2018:1997-1 No score

Security update for shadow

This update for shadow fixes the following issues:

  • CVE-2016-6252: Incorrect integer handling could results in local privilege escalation (bsc#1099310)
Record
SUSE-SU-2018:1997-1
Updated
2026-11-02
OSVSUSE-SU-2018:1997-2 No score

Security update for shadow

This update for shadow fixes the following issues:

  • CVE-2016-6252: Incorrect integer handling could results in local privilege escalation (bsc#1099310)
Record
SUSE-SU-2018:1997-2
Updated
2026-11-02
OSVUSN-3276-1 No score

shadow vulnerabilities

Sebastian Krahmer discovered integer overflows in shadow utilities. A local attacker could possibly cause them to crash or potentially gain privileges via crafted input. (CVE-2016-6252)

Tobias Stöckmann discovered a race condition in su. A local attacker could cause su to send SIGKILL to other processes with root privileges. (CVE-2017-2616)

Record
USN-3276-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
shadow
Alpine:v3.10
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.11
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.12
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.13
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.14
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.15
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.16
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.17
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.18
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.19
 before 4.2.1-r7
4.2.1-r7
Show 28 moreShow less
Affected packages
PackageAffectedFixed
shadow
Alpine:v3.20
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.21
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.22
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.23
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.24
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.5
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.6
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.7
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.8
 before 4.2.1-r7
4.2.1-r7
shadow
Alpine:v3.9
 before 4.2.1-r7
4.2.1-r7
shadow
Debian:12
 before 1:4.4-1
1:4.4-1
shadow
Debian:13
 before 1:4.4-1
1:4.4-1
shadow
Debian:14
 before 1:4.4-1
1:4.4-1
shadow
Debian:8
 before 1:4.2-3+deb8u3, plus listed versions
1:4.2-31:4.2-3+deb8u11:4.2-3+deb8u2
1:4.2-3+deb8u3
shadow-utils
Mageia:5
 before 4.2.1-6.mga5
4.2.1-6.mga5
shadow
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 4.1.5.1-19.8.1
4.1.5.1-19.8.1
shadow
SUSE:Linux Enterprise Server 12-LTSS
 before 4.1.5.1-19.8.1
4.1.5.1-19.8.1
shadow
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 4.1.5.1-19.8.1
4.1.5.1-19.8.1
shadow
SUSE:OpenStack Cloud 7
 before 4.2.1-27.9.1
4.2.1-27.9.1
shadow
SUSE:Linux Enterprise Desktop 12 SP3
 before 4.2.1-27.9.1
4.2.1-27.9.1
shadow
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 4.2.1-27.9.1
4.2.1-27.9.1
shadow
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 4.2.1-27.9.1
4.2.1-27.9.1
shadow
SUSE:Linux Enterprise Server 12 SP3
 before 4.2.1-27.9.1
4.2.1-27.9.1
shadow
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 4.2.1-27.9.1
4.2.1-27.9.1
shadow
SUSE:Enterprise Storage 4
 before 4.2.1-27.9.1
4.2.1-27.9.1
shadow
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 4.2.1-27.9.1
4.2.1-27.9.1
shadow
Ubuntu:14.04:LTS
 before 1:4.1.5.1-1ubuntu9.4, plus listed versions
1:4.1.5.1-1ubuntu61:4.1.5.1-1ubuntu71:4.1.5.1-1ubuntu81:4.1.5.1-1ubuntu91:4.1.5.1-1ubuntu9.11:4.1.5.1-1ubuntu9.2
1:4.1.5.1-1ubuntu9.4
shadow
Ubuntu:16.04:LTS
 before 1:4.2-3.1ubuntu5.2, plus listed versions
1:4.1.5.1-1.1ubuntu71:4.2-3.1ubuntu11:4.2-3.1ubuntu21:4.2-3.1ubuntu31:4.2-3.1ubuntu41:4.2-3.1ubuntu5
1:4.2-3.1ubuntu5.2

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-6252 is a high vulnerability (CVSS 7.8) in Shadow Project Shadow, published January 27, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in shadow 4.2.1-r7.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open