Critical severity9.8NVD Advisory· Published Aug 4, 2017· Updated May 13, 2026
CVE-2017-12424
CVE-2017-12424
Description
In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.
Affected products
2- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- github.com/shadow-maint/shadow/commit/954e3d2e7113e9ac06632aee3c69b8d818cc8952nvdPatchThird Party Advisory
- bugs.debian.org/cgi-bin/bugreport.cginvdIssue TrackingThird Party Advisory
- bugs.launchpad.net/ubuntu/+source/shadow/+bug/1266675nvdIssue TrackingThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/03/msg00020.htmlnvdMailing ListThird Party Advisory
- security.gentoo.org/glsa/201710-16nvdThird Party Advisory
News mentions
0No linked articles in our index yet.