Homepage
About Snyk

CVE-2024-28085 Affecting util-linux package, versions <2.33.1-0.1+deb10u1

low

Snyk CVSS

      Threat Intelligence

      EPSS 0.04% (10th percentile)
    Expand this section
    Red Hat
    8.4 high
    Expand this section
    SUSE
    8.4 high

    Do your applications use this vulnerable package?

    In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

    Test your applications
    • Snyk ID SNYK-DEBIAN10-UTILLINUX-6508628
    • published 28 Mar 2024
    • disclosed 27 Mar 2024
    Report a new vulnerability Found a mistake?

    Introduced: 27 Mar 2024

    New CVE-2024-28085 Open this link in a new tab

    How to fix?

    Upgrade Debian:10 util-linux to version 2.33.1-0.1+deb10u1 or higher.

    NVD Description

    Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

    wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.