Homepage
About Snyk

CVE-2024-28085 Affecting util-linux package, versions <2.37.2-4ubuntu3.3

medium

Snyk CVSS

      Threat Intelligence

      EPSS 0.04% (10th percentile)
    Expand this section
    Red Hat
    8.4 high
    Expand this section
    SUSE
    8.4 high

    Do your applications use this vulnerable package?

    In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

    Test your applications
    • Snyk ID SNYK-UBUNTU2204-UTILLINUX-6508372
    • published 28 Mar 2024
    • disclosed 27 Mar 2024
    Report a new vulnerability Found a mistake?

    Introduced: 27 Mar 2024

    CVE-2024-28085 Open this link in a new tab

    How to fix?

    Upgrade Ubuntu:22.04 util-linux to version 2.37.2-4ubuntu3.3 or higher.

    NVD Description

    Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

    wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.