shadow vulnerabilities

Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.

In the newusers tool in shadow before version 4.5, there is a possibility to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors.

shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees.