Heist/ feed

Security feed

advisoryOfficial CVE List

Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames

A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.

util-linuxRed Hat Enterprise Linux 10Red Hat Enterprise Linux 8Red Hat Enterprise Linux 8Red Hat Enterprise Linux 9Red Hat Enterprise Linux 9Cert Manager support for Red Hat OpenShift release 1.18Cert Manager support for Red Hat OpenShift release 1.18Cert Manager support for Red Hat OpenShift release 1.18Cert Manager support for Red Hat OpenShift release 1.18Cert Manager support for Red Hat OpenShift release 1.18Red Hat Ceph Storage 7Red Hat Ceph Storage 8Red Hat Ceph Storage 9Red Hat Hardened ImagesRed Hat Insights proxy 1.5Red Hat Update Infrastructure 5Red Hat Update Infrastructure 5Red Hat Update Infrastructure 5Red Hat Update Infrastructure 5Red Hat Enterprise Linux 6Red Hat Enterprise Linux 7Red Hat OpenShift Container Platform 4Red Hat OpenShift Container Platform 4CVE-2025-14104
Structured advisory · Revision 1Original source
Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-14104

util-linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/2/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/3/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/4/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/5/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Cert Manager support for Red Hat OpenShift release 1.18

Source reference: /containers/cna/affected/6/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Cert Manager support for Red Hat OpenShift release 1.18

Source reference: /containers/cna/affected/7/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Cert Manager support for Red Hat OpenShift release 1.18

Source reference: /containers/cna/affected/8/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Cert Manager support for Red Hat OpenShift release 1.18

Source reference: /containers/cna/affected/9/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Cert Manager support for Red Hat OpenShift release 1.18

Source reference: /containers/cna/affected/10/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Ceph Storage 7

Source reference: /containers/cna/affected/11/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Ceph Storage 8

Source reference: /containers/cna/affected/12/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Ceph Storage 9

Source reference: /containers/cna/affected/13/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Hardened Images

Source reference: /containers/cna/affected/14/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Insights proxy 1.5

Source reference: /containers/cna/affected/15/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Update Infrastructure 5

Source reference: /containers/cna/affected/16/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Update Infrastructure 5

Source reference: /containers/cna/affected/17/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Update Infrastructure 5

Source reference: /containers/cna/affected/18/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Update Infrastructure 5

Source reference: /containers/cna/affected/19/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Enterprise Linux 6

Source reference: /containers/cna/affected/20/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Enterprise Linux 7

Source reference: /containers/cna/affected/21/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/22/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/23/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2025-14104

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#23059 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
advisoryOfficial CVE List

util-linux mount hook_owner TOCTOU allows local privilege escalation

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

util-linuxCVE-2026-53612
Structured advisory · Revision 1Original source
Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-53612

util-linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2026-53612

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#22958 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
advisoryOfficial CVE List

CVE-2022-0563

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

util-linuxCVE-2022-0563
Structured advisory · Revision 1Original source
Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2022-0563

util-linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2022-0563

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#21796 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement