CVE-2018-7169

An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.

• CWE-732

• https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357Exploit, Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/201805-09Third Party Advisory
• https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357Exploit, Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/201805-09Third Party Advisory

Published

Feb 15, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7160The Node.js inspector, in 6.x and later is vulnerable to a D…8.8
• CVE-2018-7161All versions of Node.js 8.x, 9.x, and 10.x are vulnerable an…7.5
• CVE-2018-7162All versions of Node.js 9.x and 10.x are vulnerable and the …7.5
• CVE-2018-7164Node.js versions 9.7.0 and later and 10.x are vulnerable and…7.5
• CVE-2018-7166In all versions of Node.js 10 prior to 10.9.0, an argument p…7.5
• CVE-2018-7167Calling Buffer.fill() or Buffer.alloc() with some parameters…7.5
• CVE-2018-7170ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 all…5.3
• CVE-2018-7171Directory traversal vulnerability in Twonky Server 7.0.11 th…
• CVE-2018-7172In index.php in WonderCMS before 2.4.1, remote attackers can…
• CVE-2018-7173A large loop in JBIG2Stream::readSymbolDictSeg in xpdf 4.00 …
• CVE-2018-7174An issue was discovered in xpdf 4.00. An infinite loop in XR…
• CVE-2018-7175An issue was discovered in xpdf 4.00. A NULL pointer derefer…