CRITICAL🇬🇧 English

CVE-2017-1000082

CVSS 9.8v3.1pub. 2017-07-07upd. 2026-05-13

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rather than the user intended.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Systemd Project Systemd

    APP
    Systemd Project
    229 – 234 (bez)
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2022-2526CRITICAL9.8ten sam produkt

A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and ...

CVE-2018-21029CRITICAL9.8ten sam produkt

systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Se...

CVE-2015-7510CRITICAL9.8ten sam produkt

Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd...

CVE-2023-26604HIGH7.8ten sam produkt

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., pl...

CVE-2020-1712HIGH7.8ten sam produkt

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit qu...