← CVE Intelligence

CVE-2025-14104

Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames PUBLISHED

Description (CNA)

A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.

Affected (CNA)

Vendor / productVersions
util-linux / util-linuxaffected 0 before 2.41.3
Red Hat / Red Hat Enterprise Linux 10unaffected 0:2.40.2-15.el10_1 before *
Red Hat / Red Hat Enterprise Linux 8unaffected 0:2.32.1-48.el8_10 before *
Red Hat / Red Hat Enterprise Linux 8unaffected 0:2.32.1-48.el8_10 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:2.37.4-21.el9_7 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:2.37.4-21.el9_7 before *
Red Hat / Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791459707 before *
Red Hat / Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791459711 before *
Red Hat / Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791459759 before *
Red Hat / Cert Manager support for Red Hat OpenShift release 1.18unaffected 1789029076 before *
Red Hat / Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791966259 before *
Red Hat / Red Hat Ceph Storage 7unaffected 1770632724 before *
Red Hat / Red Hat Ceph Storage 8unaffected 1770630907 before *
Red Hat / Red Hat Ceph Storage 9unaffected 1771816028 before *
Red Hat / Red Hat Hardened Imagesunaffected 2.42-7.1.hum1 before *
Red Hat / Red Hat Insights proxy 1.5unaffected 1770740405 before *
Red Hat / Red Hat Update Infrastructure 5unaffected 1770646925 before *
Red Hat / Red Hat Update Infrastructure 5unaffected 1773670073 before *
Red Hat / Red Hat Update Infrastructure 5unaffected 1773672059 before *
Red Hat / Red Hat Update Infrastructure 5unaffected 1773670137 before *
Red Hat / Red Hat Enterprise Linux 6affected
Red Hat / Red Hat Enterprise Linux 7affected
Red Hat / Red Hat OpenShift Container Platform 4affected
Red Hat / Red Hat OpenShift Container Platform 4affected

CWE

CWE-125

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.