CVE-2025-14104

A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam() function, affecting SUID (Set User ID) login-utils utilities writing to the password database.

• util-linux 2.41.3-1 (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1122058; unimportant) https://bugzilla.redhat.com/show_bug.cgi?id=2419369 https://github.com/util-linux/util-linux/issues/3585 https://github.com/util-linux/util-linux/pull/3586 Fixed by: https://github.com/util-linux/util-linux/commit/aaa9e718c88d6916b003da7ebcfe38a3c88df8e6 Fixed by: https://github.com/util-linux/util-linux/commit/9a36d77012c4c771f8d51eba46b6e62c29bf572a Affected code in setpwnam() is only used by chsh and chfn which are not build in any Debian released binary package from src:util-linux and explicitly configured as with --disable-chfn-chsh since 2.25-1.