Shadow: Multiple vulnerabilities — GLSA 201706-02

Multiple vulnerabilities have been found in Shadow, the worst of which might allow privilege escalation.

Affected Packages

sys-apps/shadow on all architectures
Affected versions < 4.4-r2
Unaffected versions >= 4.4-r2

Background

Shadow is a set of tools to deal with user accounts.

Description

Multiple vulnerabilities have been discovered in Shadow. Please review the CVE identifiers referenced below for details.

Impact

A local attacker could possibly cause a Denial of Service condition, gain privileges via crafted input, or SIGKILL arbitrary processes.

Workaround

There is no known workaround at this time.

Resolution

All Shadow users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=sys-apps/shadow-4.4-r2"
 

References

Release Date
June 06, 2017

Latest Revision
June 06, 2017: 1

Severity
high

Exploitable
local

Bugzilla entries