Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames (util-linux util-linux)

CVE-2025-14104
MEDIUM 6.1

At a glance

Source
NVD
EPSS
EPSS 0.20 % · percentile 10 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Deferred

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 6.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Hredhat
CVSS 3.1MEDIUM 6.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:HNVD · secalert@redhat.com (Secondary)

European references

CERT-FR advisories

Affected products

ProductVersions
util-linux · util-linuxaffected 0 < 2.41.3
Red Hat · Red Hat Enterprise Linux 10unaffected 0:2.40.2-15.el10_1 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:2.32.1-48.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:2.32.1-48.el8_10 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:2.37.4-21.el9_7 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:2.37.4-21.el9_7 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791459707 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791459711 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791459759 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18unaffected 1789029076 < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18unaffected 1791966259 < *
Red Hat · Red Hat Ceph Storage 7unaffected 1770632724 < *
Red Hat · Red Hat Ceph Storage 8unaffected 1770630907 < *
Red Hat · Red Hat Ceph Storage 9unaffected 1771816028 < *
Red Hat · Red Hat Hardened Imagesunaffected 2.42-7.1.hum1 < *
Red Hat · Red Hat Insights proxy 1.5unaffected 1770740405 < *
Red Hat · Red Hat Update Infrastructure 5unaffected 1770646925 < *
Red Hat · Red Hat Update Infrastructure 5unaffected 1773670073 < *
Red Hat · Red Hat Update Infrastructure 5unaffected 1773672059 < *
Red Hat · Red Hat Update Infrastructure 5unaffected 1773670137 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD