Pam Krb5

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:eyrie:pam-krb5:3.3:*:*:*:*:*:*:*

part: a version: 3.3 update: *

VendorEyrie (3f363e0b-3f73-5612-b06a-78d9ebea34e0)
ProductPam Krb5 (f195f67b-cd6f-5c02-a06a-7793d9043c95)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:deb/debian/libpam-krb5 purl2cpe 2026-06-01 10:16:33.775857
pkg:deb/ubuntu/libpam-krb5 purl2cpe 2026-06-01 10:16:33.775859
pkg:github/rra/pam-krb5 purl2cpe 2026-06-01 10:16:33.775860
pkg:rpm/opensuse/pam-krb5 purl2cpe 2026-06-01 10:16:33.775862

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2009-0361 vulnerable 2026-06-08 04:51:09.100251 Details available
Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations.
Published: 2009-02-13T17:00:00.000Z
Updated: 2024-08-07T04:31:26.245Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-0360 vulnerable 2026-06-08 04:51:09.095103 Details available
Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.
Published: 2009-02-13T17:00:00.000Z
Updated: 2024-08-07T04:31:25.684Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.