CVE-2011-3148

2012-07-2217:55:01

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

EPSS

Percentile

5.1%

JSON

Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.

OSVersionArchitecturePackageVersionFilename
Debian12allpam< 1.1.3-5pam_1.1.3-5_all.deb
Debian11allpam< 1.1.3-5pam_1.1.3-5_all.deb
Debian999allpam< 1.1.3-5pam_1.1.3-5_all.deb
Debian13allpam< 1.1.3-5pam_1.1.3-5_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	pam	< 1.1.3-5	pam_1.1.3-5_all.deb
Debian	11	all	pam	< 1.1.3-5	pam_1.1.3-5_all.deb
Debian	999	all	pam	< 1.1.3-5	pam_1.1.3-5_all.deb
Debian	13	all	pam	< 1.1.3-5	pam_1.1.3-5_all.deb