CVE-2011-0721

Published: Feb 19, 2011Modified: Apr 29, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

Multiple CRLF injection vulnerabilities in (1) chfn and (2) chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field.

Affected (1)

Products: Debian: Shadow

Debian

1 product

Shadow

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Debian Shadow	Version 1\ 4.1.4

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (22)

http://osvdb.org/70895

Source: security@ubuntu.com

http://secunia.com/advisories/42505

Source: security@ubuntu.com

Vendor Advisory

http://secunia.com/advisories/43345

Source: security@ubuntu.com

Vendor Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.380014

Source: security@ubuntu.com

http://www.debian.org/security/2011/dsa-2164

Source: security@ubuntu.com

http://www.securityfocus.com/bid/46426

Source: security@ubuntu.com

http://www.ubuntu.com/usn/USN-1065-1

Source: security@ubuntu.com

http://www.vupen.com/english/advisories/2011/0396

Source: security@ubuntu.com

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0398

Source: security@ubuntu.com

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0773

Source: security@ubuntu.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/65564

Source: security@ubuntu.com

http://osvdb.org/70895