sash before 3.4-4 in Debian GNU/Linux does not properly clone /etc/shadow, which makes it world-readable and could allow local users to gain privileges via password cracking.
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Debian_linux | Debian | 2.2 (including) | 2.2 (including) |