Shadow

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer…CVE-2017-12424Shadow Project · 2.7% likely

   CWE-119

2. An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This…CVE-2018-7169Shadow Project · 1.6% likely

   CWE-732

3. shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Spe…CVE-2019-19882Shadow Project · 0.5% likely

   CWE-732

4. In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.…CVE-2023-29383Shadow Project · 0.4% likely

   CWE-125

5. Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.CVE-2016-6252Shadow Project · 0.4% likely

   CWE-190

6. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory treesCVE-2013-4235shadow · 0.3% likely

   CWE-367

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.