CVE-2018-16588: Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow packag

Q: How do I fix CVE-2018-16588?

shadow: upgrade to newer than 4.5-5.39. Exact commands for each OS are on this page.

Q: Is CVE-2018-16588 being exploited?

CVE-2018-16588 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2018-16588 affect?

CVE-2018-16588 affects shadow. Severity is high (CVSS 7.8). Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through 4.2.1-27.9.1 for SUSE Linux Enterprise 12 (SLE-12) and through 4.5-5.39 for SUSE Linux Enterprise 15 (SLE-15). Non-exist

Routine

HIGH 7.8UPGRADE

CVE-2018-16588 is a high-severity flaw (CVSS 7.8) affecting shadow. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through 4.2.1-27.9.1 for SUSE Linux Enterprise 12 (SLE-12) and through 4.5-5.39 for SUSE Linux Enterprise 15 (SLE-15). Non-existing intermediate directories are created with mode 0777 during user creation. Given that they are world-writable, local attackers might use this for privilege escalation and other unspecified attacks. NOTE: th

Why this priority

High severity

A fixed release or distro patch exists.

Risk facts

CVSS score	7.8 (High)
Attack vector	Local
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.3% (top 77%)
CISA exploited list	No
Weakness	CWE-732
Published	2018-09-26
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: suse

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2018-09-26 22:29 UTCPublished CVE record published
2026-06-17 01:44 UTCUpdated Record last modified

suse shadow UPGRADE

Affected: <= 4.2.1-27.9.1 · <= 4.5-5.39

Fixed in: newer than 4.5-5.39

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy shadow || rpm -q shadow || shadow --version

2. UPGRADE to newer than 4.5-5.39 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade shadow

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade shadow

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2018-16588?

shadow: upgrade to newer than 4.5-5.39. Exact commands for each OS are on this page.

Is CVE-2018-16588 being exploited?

CVE-2018-16588 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2018-16588 affect?

CVE-2018-16588 affects shadow. Severity is high (CVSS 7.8). Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through 4.2.1-27.9.1 for SUSE Linux Enterprise 12 (SLE-12) and through 4.5-5.39 for SUSE Linux Enterprise 15 (SLE-15). Non-exist

How urgent is CVE-2018-16588?

Priority 33/100. High severity

Related CVEs

CVE-2023-29383 LOW 3.3 DOWNGRADE In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (cha
CVE-2013-4235 MEDIUM 4.7 MITIGATE MITIGATE shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees
CVE-2019-16110 HIGH 8.1 UPGRADE The network protocol of Blade Shadow though 2.13.3 allows remote attackers to take control of a Shadow instanc
CVE-2018-7169 MEDIUM 5.3 DOWNGRADE An issue was discovered in shadow 4.5
CVE-2017-20002 HIGH 7.8 DOWNGRADE MITIGATE The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in

References

← Back to latest CVEs