Package: shadow / 1:4.2-3+deb8u4
Metadata
Package | Version | Patches format |
---|---|---|
shadow | 1:4.2-3+deb8u4 | 3.0 (quilt) |
Patch series
view the series filePatch | File delta | Description |
---|---|---|
503_shadowconfig.8 | (download) |
man/fr/shadowconfig.8 |
26 26 + 0 - 0 ! |
--- |
008_login_log_failure_in_FTMP | (download) |
lib/getdef.c |
2 1 + 1 - 0 ! |
--- |
301 CVE 2017 2616 su properly clear child PID.patch | (download) |
src/su.c |
19 17 + 2 - 0 ! |
[patch] su: properly clear child pid If su is compiled with PAM support, it is possible for any local user to send SIGKILL to other processes with root privileges. There are only two conditions. First, the user must be able to perform su with a successful login. This does NOT have to be the root user, even using su with the same id is enough, e.g. "su $(whoami)". Second, SIGKILL can only be sent to processes which were executed after the su process. It is not possible to send SIGKILL to processes which were already running. I consider this as a security vulnerability, because I was able to write a proof of concept which unlocked a screen saver of another user this way. |
302 CVE 2016 6252 fix integer overflow.patch | (download) |
lib/getulong.c |
9 3 + 6 - 0 ! |
[patch] simplify getulong Use strtoul to read an unsigned long, rather than reading a signed long long and casting it. https://bugzilla.suse.com/show_bug.cgi?id=979282 |
303 Reset pid_child only if waitpid was successful.patch | (download) |
src/su.c |
2 1 + 1 - 0 ! |
[patch] reset pid_child only if waitpid was successful. Do not reset the pid_child to 0 if the child process is still running. This else-condition can be reached with pid being -1, therefore explicitly test this condition. This is a regression fix for CVE-2017-2616. If su receives a signal like SIGTERM, it is not propagated to the child. Reported-by: Radu Duta <raduduta@gmail.com> Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org> |
429_login_FAILLOG_ENAB | (download) |
lib/getdef.c |
2 1 + 1 - 0 ! |
--- |
401_cppw_src.dpatch | (download) |
po/POTFILES.in |
1 1 + 0 - 0 ! |
--- |
402_cppw_selinux | (download) |
src/cppw.c |
28 28 + 0 - 0 ! |
--- |
506_relaxed_usernames | (download) |
libmisc/chkname.c |
21 21 + 0 - 0 ! |
--- |
542_useradd O_option | (download) |
man/useradd.8.xml |
5 5 + 0 - 0 ! |
--- |
501_commonio_group_shadow | (download) |
lib/commonio.c |
12 10 + 2 - 0 ! |
--- |
463_login_delay_obeys_to_PAM | (download) |
lib/getdef.c |
2 1 + 1 - 0 ! |
--- |
523_su_arguments_are_concatenated | (download) |
src/su.c |
29 29 + 0 - 0 ! |
--- |
523_su_arguments_are_no_more_concatenated_by_default | (download) |
src/su.c |
17 16 + 1 - 0 ! |
--- |
508_nologin_in_usr_sbin | (download) |
src/Makefile.am |
2 1 + 1 - 0 ! |
--- |
505_useradd_recommend_adduser | (download) |
man/useradd.8.xml |
6 6 + 0 - 0 ! |
--- |
1000_configure_userns | (download) |
etc/login.defs |
4 2 + 2 - 0 ! |
--- |
1010_vietnamese_translation | (download) |
po/vi.po |
1182 439 + 743 - 0 ! |
--- |
1020_fix_user_busy_errors | (download) |
libmisc/user_busy.c |
9 9 + 0 - 0 ! |
fix user_busy to not leave subuid open in case of error. |