OPENSUSE-SU-2026:11978-1 yast2-users-5.0.9-1.1 on GA media

These are all security issues fixed in the yast2-users-5.0.9-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-105687

These are all security issues fixed in the yast2-users-5.0.9-1.1 package on the GA media of openSUSE Tumbleweed...

Security update for yast2-users

This update for yast2-users fixes the following issue: Update to version 4.7.2. CVE-2026-59680: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute bsc1272839. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:3949-1 Security update for yast2-users

This update for yast2-users fixes the following issue: Update to version 4.7.2. - CVE-2026-59680: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute bsc1272839...

SUSE-SU-2026:3948-1 Security update for yast2-users

This update for yast2-users fixes the following issue: Update to version 4.6.7. - CVE-2026-59680: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute bsc1272839...

Security update for yast2-users

This update for yast2-users fixes the following issue: Update to version 4.6.7. CVE-2026-59680: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute bsc1272839. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security update for yast2-users

This update for yast2-users fixes the following issue: Update to version 4.5.8. CVE-2026-59680: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute bsc1272839. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:3947-1 Security update for yast2-users

This update for yast2-users fixes the following issue: Update to version 4.5.8. - CVE-2026-59680: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute bsc1272839...

Security update for yast2-users

This update for yast2-users fixes the following issue: Update to version 4.4.17. CVE-2026-59680: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute bsc1272839. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:3946-1 Security update for yast2-users

This update for yast2-users fixes the following issue: Update to version 4.4.17. - CVE-2026-59680: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute bsc1272839...

Security update for yast2-users

This update for yast2-users fixes the following issue: Update to version 3.2.20. CVE-2026-59680: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute bsc1272839. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:3945-1 Security update for yast2-users

This update for yast2-users fixes the following issue: Update to version 3.2.20. - CVE-2026-59680: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute bsc1272839...

CVE-2026-59680

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...

CVE-2026-59680 yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...

CVE-2026-59680

An OS command injection vulnerability in yast2-users (through 5.0.8 ) allows root-level command execution via a malicious LDAP directory. The flaw is in get_password_term() in src/include/users/dialogs.rb, which reads the shadowLastChange and shadowExpire attributes via GetString() with no numeri...

EUVD-2026-68996

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...

CVE-2026-59680 yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...

SUSE CVE-2026-59680

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...

PT-2026-84129

Name of the Vulnerable Software and Affected Versions yast2-users versions prior to 5.0.9 Description An OS command injection issue exists when displaying the Password Settings tab of a user. The get password term function in src/include/users/dialogs.rb retrieves the shadowLastChange and...

CVE-2026-59680: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, getpasswordterm in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString, which performs no numeric validation, and passed the resulting...