LI
Product
Linux-PAM
19
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 0Medium 4Low 0
Watch
Add Linux-PAM to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-28321 | 9.8 | Sep 19 | The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins Affected: before 1.5.2-6.1 |
| CVE-2020-27780 | 9.8 | Dec 18 | A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users Affected: 1.5.0 before 1.5.1 |
| CVE-2015-3238 | 6.5 | Aug 24 | The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate… Affected: through 1.1.8 |
| CVE-2026-54411 | 5.9 | Jun 14 | Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison Affected: through 1.7.2 |
| CVE-2024-22365 | 5.5 | Feb 6 | linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY Affected: before 1.6.0 |
| CVE-2024-10041 | 4.7 | Oct 23 | A vulnerability was found in PAM Affected: All versions, or not specified |
| CVE-2014-2583 | – | Apr 10 | Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly… Affected: 1.1.8 |
| CVE-2011-3149 | – | Jul 22 | The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can… Affected: through 1.1.4; 0.99.1.0; 0.99.2.0; 0.99.2.1; 0.99.3.0; 0.99.4.0; +20 more |
| CVE-2011-3148 | – | Jul 22 | Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash)… Affected: through 1.1.4; 0.99.1.0; 0.99.2.0; 0.99.2.1; 0.99.3.0; 0.99.4.0; +20 more |
| CVE-2010-4708 | – | Jan 24 | The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an… Affected: through 1.1.2; 0.99.1.0; 0.99.2.0; 0.99.2.1; 0.99.3.0; 0.99.4.0; +18 more |
| CVE-2010-4706 | – | Jan 24 | The pam_sm_close_session function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not properly handle a failure to determine a certain target… Affected: through 1.1.2; 0.99.1.0; 0.99.2.0; 0.99.2.1; 0.99.3.0; 0.99.4.0; +18 more |
| CVE-2010-4707 | – | Jan 24 | The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow… Affected: through 1.1.2; 0.99.1.0; 0.99.2.0; 0.99.2.1; 0.99.3.0; 0.99.4.0; +18 more |
| CVE-2010-3431 | – | Jan 24 | The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which… Affected: 1.1.2 |
| CVE-2010-3853 | – | Jan 24 | pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init… Affected: through 1.1.2; 0.99.1.0; 0.99.2.0; 0.99.2.1; 0.99.3.0; 0.99.4.0; +18 more |
| CVE-2010-3435 | – | Jan 24 | The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user… Affected: through 1.1.1; 0.99.1.0; 0.99.2.0; 0.99.2.1; 0.99.3.0; 0.99.4.0; +17 more |
| CVE-2010-3430 | – | Jan 24 | The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls,… Affected: 1.1.2 |
| CVE-2010-3316 | – | Jan 24 | The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system… Affected: through 1.1.1; 0.99.1.0; 0.99.2.0; 0.99.2.1; 0.99.3.0; 0.99.4.0; +17 more |
| CVE-2009-0579 | – | Apr 16 | Linux-PAM before 1.0.4 does not enforce the minimum password age (MINDAYS) as specified in /etc/shadow, which allows local users to bypass intended security policy and change… Affected: through 1.0.4; 0.99.1.0; 0.99.2.0; 0.99.2.1; 0.99.3.0; 0.99.4.0; +15 more |
| CVE-2009-0887 | – | Mar 12 | Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might… Affected: through 1.0.3; 0.99.1.0; 0.99.2.0; 0.99.2.1; 0.99.3.0; 0.99.4.0; +14 more |
Showing 19