https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-29383.htmlhttps://patchthecve.com/cve/CVE-2023-29383.htmlWed, 14 Oct 2026 23:17:17 +0000LOW 3.3: In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when vihttps://patchthecve.com/cve/CVE-2018-7169.htmlhttps://patchthecve.com/cve/CVE-2018-7169.htmlWed, 17 Jun 2026 02:02:43 +0000MEDIUM 5.3: An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths ihttps://patchthecve.com/cve/CVE-2017-12424.htmlhttps://patchthecve.com/cve/CVE-2017-12424.htmlWed, 17 Jun 2026 01:03:16 +0000CRITICAL 9.8: In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, chttps://patchthecve.com/cve/CVE-2016-6252.htmlhttps://patchthecve.com/cve/CVE-2016-6252.htmlWed, 17 Jun 2026 00:50:41 +0000HIGH 7.8: Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.