CVE-2011-0721

Debian Shadow - Improper Input Validation

Title source: rule

Description

Multiple CRLF injection vulnerabilities in (1) chfn and (2) chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field.

References (11)

[Vendor Advisory] http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.380014

[Third Party Advisory, VDB Entry] http://osvdb.org/70895

[Vendor Advisory] http://secunia.com/advisories/42505

[Vendor Advisory] http://secunia.com/advisories/43345

[Vendor Advisory] http://www.ubuntu.com/usn/USN-1065-1

[Vendor Advisory] http://www.vupen.com/english/advisories/2011/0396

[Vendor Advisory] http://www.vupen.com/english/advisories/2011/0398

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/65564

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/46426

[Third Party Advisory] http://www.debian.org/security/2011/dsa-2164

[Third Party Advisory] http://www.vupen.com/english/advisories/2011/0773

Scores

EPSS 0.0142

EPSS Percentile 80.4%

Classification

CWE

CWE-20

Status draft

Affected Products (1)

debian/shadow

Timeline

Published Feb 19, 2011

Tracked Since Feb 18, 2026