CVE-2024-28085
See a problem?- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-28085
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28085.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-28085
- Aliases
-
- GHSA-xv2h-c6ww-mrjq
- Related
- Published
- 2024-03-27T19:15:48Z
- Modified
- 2024-09-18T03:26:10.488817Z
- Summary
- [none]
- Details
-
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.
- References
-
- https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq
- https://security.netapp.com/advisory/ntap-20240531-0003/
- http://www.openwall.com/lists/oss-security/2024/03/27/5
- http://www.openwall.com/lists/oss-security/2024/03/27/6
- http://www.openwall.com/lists/oss-security/2024/03/27/7
- http://www.openwall.com/lists/oss-security/2024/03/27/8
- http://www.openwall.com/lists/oss-security/2024/03/27/9
- http://www.openwall.com/lists/oss-security/2024/03/28/1
- http://www.openwall.com/lists/oss-security/2024/03/28/2
- http://www.openwall.com/lists/oss-security/2024/03/28/3
- https://github.com/skyler-ferrante/CVE-2024-28085
- https://lists.debian.org/debian-lts-announce/2024/04/msg00005.html
- https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/
- https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt
- https://www.openwall.com/lists/oss-security/2024/03/27/5
- https://security.alpinelinux.org/vuln/CVE-2024-28085
- https://security-tracker.debian.org/tracker/CVE-2024-28085
Affected packages
Alpine:v3.20 / util-linux
Package
- Name
- util-linux
- Purl
- pkg:apk/alpine/util-linux?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.40-r0
Affected versions
2.*
2.14.1-r0
2.14.1-r1
2.14.2-r0
2.16-r0
2.16-r1
2.16-r2
2.16.2-r0
2.17-r0
2.17.1-r0
2.17.1-r1
2.17.2-r0
2.18-r0
2.18-r1
2.18-r2
2.19.1-r0
2.19.1-r1
2.19.1-r2
2.20-r0
2.20-r1
2.21-r0
2.21.1-r0
2.21.2-r0
2.22.1-r0
2.22.2-r0
2.23.1-r0
2.23.2-r0
2.23.2-r1
2.23.2-r2
2.23.2-r3
2.23.2-r4
2.23.2-r5
2.24.2-r0
2.24.2-r1
2.24.2-r2
2.24.2-r3
2.24.2-r4
2.25.2-r0
2.25.2-r1
2.25.2-r2
2.26.1-r0
2.26.2-r0
2.26.2-r1
2.27-r0
2.27-r1
2.27.1-r0
2.27.1-r1
2.28-r0
2.28-r1
2.28-r2
2.28-r3
2.28-r4
2.28.1-r0
2.28.2-r0
2.28.2-r1
2.28.2-r2
2.30.1-r0
2.30.2-r0
2.31-r0
2.32-r0
2.33-r0
2.33.2-r0
2.34-r0
2.34-r1
2.35-r0
2.35.1-r0
2.35.1-r1
2.35.1-r2
2.35.1-r3
2.35.1-r4
2.35.2-r0
2.35.2-r1
2.35.2-r2
2.36-r0
2.36-r1
2.36-r2
2.36.1-r0
2.36.1-r1
2.36.2-r0
2.36.2-r1
2.36.2-r2
2.37-r0
2.37-r1
2.37-r2
2.37-r3
2.37-r4
2.37.1-r0
2.37.2-r0
2.37.2-r1
2.37.2-r2
2.37.2-r3
2.37.2-r4
2.37.2-r5
2.37.2-r6
2.37.2-r7
2.37.3-r0
2.37.3-r1
2.37.4-r0
2.37.4-r1
2.38-r0
2.38-r1
2.38-r2
2.38-r3
2.38.1-r0
2.38.1-r1
2.38.1-r2
2.38.1-r3
2.38.1-r4
2.38.1-r5
2.38.1-r6
2.38.1-r7
2.38.1-r8
2.39-r0
2.39-r1
2.39-r2
2.39-r3
2.39-r4
2.39-r5
2.39-r6
2.39-r7
2.39-r8
2.39-r9
2.39-r10
2.39.1-r0
2.39.2-r0
2.39.2-r1
2.39.3-r0
2.39.3-r1
2.39.3-r2
Debian:11 / util-linux
Package
- Name
- util-linux
- Purl
- pkg:deb/debian/util-linux?arch=source
Debian:12 / util-linux
Package
- Name
- util-linux
- Purl
- pkg:deb/debian/util-linux?arch=source
Debian:13 / util-linux
Package
- Name
- util-linux
- Purl
- pkg:deb/debian/util-linux?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.39.3-11