Accepted shadow 1:4.4-4.1+deb9u1 (source) into oldstable
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 17 Mar 2021 10:27:01 +0100
Source: shadow
Binary: passwd login uidmap
Architecture: source
Version: 1:4.4-4.1+deb9u1
Distribution: stretch-security
Urgency: high
Maintainer: Shadow package maintainers <pkg-shadow-devel@lists.alioth.debian.org>
Changed-By: Sylvain Beucler <beuc@debian.org>
Description:
login - system login tools
passwd - change and administer password and group data
uidmap - programs to help use subuids
Closes: 756630
Changes:
shadow (1:4.4-4.1+deb9u1) stretch-security; urgency=high
.
* Non-maintainer upload by the LTS Security Team.
* CVE-2017-20002: revert adding pts/0 and pts/1 to securetty.
Adding pts/* defeats the purpose of securetty. Let containers add it
if needed as described in #830255.
(cherry-picked from 1:4.5-1)
See also #877374 (previous proposed update) and #914957
(/etc/securetty will be dropped in bullseye).
* CVE-2017-12424: the newusers tool could be made to manipulate internal
data structures in ways unintended by the authors. Malformed input may
lead to crashes (with a buffer overflow or other memory corruption) or
other unspecified behaviors. This crosses a privilege boundary in, for
example, certain web-hosting environments in which a Control Panel
allows an unprivileged user account to create subaccounts.
(Closes: #756630)
Checksums-Sha1:
685135e254cfb9368d9fbae04bb80b01f0d088a8 2326 shadow_4.4-4.1+deb9u1.dsc
78d965cad860744e9e919c5a6168e6820200d5e7 3003036 shadow_4.4.orig.tar.gz
81f196609fc471ab8b867abc361227adf876cb94 601380 shadow_4.4-4.1+deb9u1.debian.tar.xz
829cc7da8cab8b5c1b5a1561e5234ed41be3cbc9 8168 shadow_4.4-4.1+deb9u1_amd64.buildinfo
Checksums-Sha256:
b26ba339cc5a60a15173eb6fa3d4f700aece86c6f34e89e04f9d8e11a589e8f7 2326 shadow_4.4-4.1+deb9u1.dsc
1323e7e932836e03dbfa441f7eeb349ede2c92d62b788ade0732411fd516be3d 3003036 shadow_4.4.orig.tar.gz
d9cb3b85cac743cc2b16e07601d1a6ccc261981117948694058e557d7baeec08 601380 shadow_4.4-4.1+deb9u1.debian.tar.xz
e45c9eab306ea513ce973289bd4f3e33fe6f49a7329ca7bc1f0f10ca3bb0d1bd 8168 shadow_4.4-4.1+deb9u1_amd64.buildinfo
Files:
6060e5119590fd4bca315bc6c97358d7 2326 admin required shadow_4.4-4.1+deb9u1.dsc
8b4123557c71e4c010c2188747be07ef 3003036 admin required shadow_4.4.orig.tar.gz
2b952c8322269dee9f01037e7b8d3d94 601380 admin required shadow_4.4-4.1+deb9u1.debian.tar.xz
bf6e4e13e9aa307709a3ac4b047c767b 8168 admin required shadow_4.4-4.1+deb9u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmBR+AUACgkQDTl9HeUl
XjB8Nw//YHqU6VuogSWs6sa+cCN/7Ko0Y+Y0Y8AqwVzOJKZHweQ+Q8mj+YcAKE85
wzcwvjcVgNY7bbhd7OG8xT5eUQD5egAFfj8y1TWQt0QvOoRb6xxE8v61UQRByb0a
IWfilmPS8W2eHrtwnf53h+mQTXOApcTPrWnCelWBIVxz3wuB0bvFB8UNOg4Y1iK4
cudjQPaROdXG8DPU1RwCHy6CIZQg9fDDA7aRyaAi95iATssO+sr3AmVXayQzjyCL
cC6VR7vLTRbscTTjAjB3ebnLOzX8B4wrb+cTAF/Fekbuf9BLMH83fOIoLzXya0ym
LDKjX8i2IZwv/6GXMP7gZdj4upue0Ba5XSZyI4QeBwwcRdxZyfD2zsuqwnpOseoC
W2gEtFejx/mZxslFU3u+mpZpVjU7/XH9oEzLGHazqeYbJtV7Kb5vxKGJnri4TuuX
oadlx3isJUBsN7yysjHOPky2/fMZxxpdaBW6o6u11b9AUmMiyV2UC5XPabvfzRU0
Lr3Wl7bY18imIMQKt50grQKYtdTkiO792iVgtOaappIE9/YZU9zbJYAwhTyq0P4s
0fEm+cilcSIbgQSuF2AJp8+ZkTn80oQqu9jO0NIuJr7h0Dimv86XBVenk4Wy3IYl
TL69c2FTmY9UPwlQy+rcjME9HF69Jr0GuY2mO8t0DOHS+oCcd+Y=
=gspW
-----END PGP SIGNATURE-----