[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f05XhS6hZz-FEnL7ZRyR_79JTKE-CgytKloS1p49tvI4":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":19,"kevVulnerabilities":85,"topProductsByCves":86,"seoMetadata":88,"meta":97},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":18},17973,"linux-pam",1,18,0,53,"2024-10-23","l",[16],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},104271,"Linux-pam is a technology vendor with 1 tracked product and 18 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[20,29,36,44,50,55,61,67,73,79],{"cveId":21,"description":22,"publishedDate":23,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":28},"CVE-2014-2583","Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.","2014-04-10",5.8,"v2","Medium",false,0.04105,{"cveId":30,"description":31,"publishedDate":32,"cvssScore":33,"cvssVersion":34,"severity":26,"isKev":27,"epssScore":35},"CVE-2015-3238","The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.","2015-08-24",6.5,"v3.0",0.02705,{"cveId":37,"description":38,"publishedDate":39,"cvssScore":40,"cvssVersion":41,"severity":42,"isKev":27,"epssScore":43},"CVE-2020-27780","A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate.","2020-12-18",9.8,"v3.1","Critical",0.01959,{"cveId":45,"description":46,"publishedDate":47,"cvssScore":48,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":49},"CVE-2009-0887","Integer signedness error in the _pam_StrTok function in libpam\u002Fpam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.","2009-03-12",6.6,0.01929,{"cveId":51,"description":52,"publishedDate":53,"cvssScore":40,"cvssVersion":41,"severity":42,"isKev":27,"epssScore":54},"CVE-2022-28321","The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.","2022-09-19",0.01579,{"cveId":56,"description":57,"publishedDate":58,"cvssScore":59,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":60},"CVE-2011-3148","Stack-based buffer overflow in the _assemble_line function in modules\u002Fpam_env\u002Fpam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~\u002F.pam_environment file.","2012-07-22",4.6,0.00696,{"cveId":62,"description":63,"publishedDate":58,"cvssScore":64,"cvssVersion":25,"severity":65,"isKev":27,"epssScore":66},"CVE-2011-3149","The _expand_arg function in the pam_env module (modules\u002Fpam_env\u002Fpam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).",2.1,"Low",0.00532,{"cveId":68,"description":69,"publishedDate":70,"cvssScore":71,"cvssVersion":41,"severity":26,"isKev":27,"epssScore":72},"CVE-2024-22365","linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.","2024-02-06",5.5,0.00459,{"cveId":74,"description":75,"publishedDate":76,"cvssScore":77,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":78},"CVE-2010-3853","pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program.","2011-01-24",6.9,0.00412,{"cveId":80,"description":81,"publishedDate":76,"cvssScore":82,"cvssVersion":25,"severity":83,"isKev":27,"epssScore":84},"CVE-2010-4708","The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an unintended environment by executing a program that relies on the pam_env PAM check.",7.2,"High",0.00369,[],[87],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},{"title":89,"metaDescription":90,"keywords":91,"structuredData":92},"Linux-pam - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Linux-pam covering 1 product with 18 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Linux-pam vulnerabilities, Linux-pam security, Linux-pam CVE, Linux-pam threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":93,"@type":94,"name":95,"description":90,"url":96},"https:\u002F\u002Fschema.org","Organization","Linux-pam","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Flinux-pam",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":98,"apiVersion":99},"2026-10-28T17:31:24.724Z","3.0"]