CVE-2011-0721: Debian Shadow

Medium severity, CVSS 6.4. EPSS: 2.3% chance of exploitation in the next 30 days.

Multiple CRLF injection vulnerabilities in (1) chfn and (2) chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field.

Affected products

• Debian Shadow: version 1:4.1.4 only

Published 2011-02-19. Last modified 2026-06-16.