Linux-PAM 1.1.2
Approved changes feed: RSS · Atom
cpe:2.3:a:linux-pam:linux-pam:1.1.2:*:*:*:*:*:*:*part: a version: 1.1.2 update: *
| Vendor | Linux Pam (c0f5cb4e-4d30-57e6-951a-93362a4cf001) |
|---|---|
| Product | Linux Pam (30bc68b0-352b-5c87-8841-8b200e9488f9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/linux-pam/linux-pam |
purl2cpe | 2026-06-01 10:16:34.555024 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2011-3149 |
vulnerable | 2026-06-08 04:58:10.776957 |
Details available
The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).
Published: 2012-07-22T17:00:00.000Z
Updated: 2024-08-06T23:22:27.630Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2011-3148 |
vulnerable | 2026-06-08 04:58:10.775351 |
Details available
Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.
Published: 2012-07-22T17:00:00.000Z
Updated: 2024-08-06T23:22:27.612Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2010-3431 |
vulnerable | 2026-06-08 04:55:14.521241 |
Details available
The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.
Published: 2011-01-24T17:00:00.000Z
Updated: 2024-08-07T03:11:44.353Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2010-3430 |
vulnerable | 2026-06-08 04:55:14.520437 |
Details available
The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.
Published: 2011-01-24T17:00:00.000Z
Updated: 2024-08-07T03:11:44.189Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.