CVE-2017-12424

In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.

In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.

In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.

• SECURITY UPDATE: Crash or buffer overflow
  • debian/patches/CVE-2017-12424.patch: fix buffer overflow if NULL line is present in db in lib/commonio.c.
  • CVE-2017-12424
• SECURITY UPDATE: Access to privileged information
  • debian/patches/CVE-2018-7169.patch: newgidmap: enforce setgroups=deny if self-mapping a group in src/newgidmap.c.
  • CVE-2018-7169

• CVE-2017-12424: fix heap buffer overflow in commonio_sort when an entry has a NULL line

• CVE-2017-12424: fix heap buffer overflow in commonio_sort when an entry has a NULL line

It was found that shadow-utils had a buffer overflow where if a buffer was left NULL for a cycle the next cycle would happily write past the entries buffer (CVE-2017-12424).

This update for shadow fixes several issues.

This security issue was fixed:

• CVE-2017-12424: The newusers tool could have been forced to manipulate internal data structures in ways unintended by the authors. Malformed input may have lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors (bsc#1052261).

These non-security issues were fixed:

• bsc#1023895: Fixed man page to not contain invalid options and also prevent warnings when using these options in certain settings
• bsc#980486: Reset user in /var/log/tallylog because of the usage of pam_tally2

It was discovered that shadow incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or expose sensitive information. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2017-12424)

It was discovered that shadow incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. (CVE-2018-7169)