3.3
Low
CVE-2024-28085 wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to…
Description
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| n/a | Versions not published | |
| util-linux 2.40 | earliest → 2.40 | No fix stated |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.5 → latest | No fix stated |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.5 → latest | No fix stated |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.5 → latest | No fix stated |
| RUGGEDCOM ROX MX5000 2.17 | earliest → < 2.17.0 | 2.17.0 |
| RUGGEDCOM ROX MX5000RE 2.17 | earliest → < 2.17.0 | 2.17.0 |
| RUGGEDCOM ROX RX1400 2.17 | earliest → < 2.17.0 | 2.17.0 |
| RUGGEDCOM ROX RX1500 2.17 | earliest → < 2.17.0 | 2.17.0 |
Show the 7 other branches Hide the 7 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| RUGGEDCOM ROX RX1501 2.17 | earliest → < 2.17.0 | 2.17.0 |
| RUGGEDCOM ROX RX1510 2.17 | earliest → < 2.17.0 | 2.17.0 |
| RUGGEDCOM ROX RX1511 2.17 | earliest → < 2.17.0 | 2.17.0 |
| RUGGEDCOM ROX RX1512 2.17 | earliest → < 2.17.0 | 2.17.0 |
| RUGGEDCOM ROX RX1524 2.17 | earliest → < 2.17.0 | 2.17.0 |
| RUGGEDCOM ROX RX1536 2.17 | earliest → < 2.17.0 | 2.17.0 |
| RUGGEDCOM ROX RX5000 2.17 | earliest → < 2.17.0 | 2.17.0 |
References
- people.rit.edu people.rit.edu
- github.com github.com
- mirrors.edge.kernel.org mirrors.edge.kernel.org
- www.openwall.com www.openwall.com
- github.com github.com
- [debian-lts-announce] 20240407 [SECURITY] [DLA 3782-1] util-linux security update lists.debian.org
- [oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in util-linux wall www.openwall.com
- [oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in util-linux wall www.openwall.com
- [oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in util-linux wall www.openwall.com
- [oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in util-linux wall www.openwall.com
- [oss-security] 20240327 Re: CVE-2024-28085: Escape sequence injection in util-linux wall www.openwall.com
- [oss-security] 20240328 Re: Re: CVE-2024-28085: Escape sequence injection in util-linux wall www.openwall.com
- [oss-security] 20240328 Re: CVE-2024-28085: Escape sequence injection in util-linux wall www.openwall.com
- [oss-security] 20240327 CVE-2024-28085: Escape sequence injection in util-linux wall www.openwall.com
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of n/a
The 144658 CVEs of n/a →
CVE-2026-106713
An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the…
Not rated
CVE-2026-106715
NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin…
Not rated
CVE-2026-106714
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it…
Not rated
CVE-2026-106716
ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep…
Not rated