Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 515
Alerts This Week
Warning Icon 1 515

Stay Secure with the Latest Linux Advisories

Rockylinux Esm H800
Rocky

Rocky Linux httpd Important Denial of Service Fix RLSA-2026-42828

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H900
Ubuntu

Ubuntu Imagemagick Critical Denial of Service Vulnerabilities USN-8558-1

Calendar White Jul 21, 2026
Critical
Ubuntu Large Esm H900
Ubuntu

Ubuntu jbig2dec Important Denial of Service Vulnerabilities USN-8582-1

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H800
Ubuntu

Ubuntu 26.04 AccountsService Important Local Exec Threat CVE-2026-61897

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H900
Ubuntu

Ubuntu OpenSSH Critical Network Access Issue CVE-2026-35414 USN-8577-1

Calendar White Jul 21, 2026
Critical
Ubuntu Large Esm H900
Ubuntu

Ubuntu 16.04 CUPS Critical Control Character Injection CVE-2026-34980

Calendar White Jul 21, 2026
Critical
Ubuntu Large Esm H800
Ubuntu

Ubuntu 26.04 Snapd Critical Security Issues July 2026 USN-8579-1

Calendar White Jul 21, 2026
Critical
Debianlts Large Esm H900
Debian LTS

Debian rtpengine Critical Origin Validation Issue DLA-4691-1 CVE-2025-53399

Calendar White Jul 21, 2026
Critical
Opensuse Large Esm H900
openSUSE

openSUSE Leap 16.0 Beets Moderate Web Issue Fix SUSE-SU-2026-21383-1

Calendar White Jul 21, 2026
moderate
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found -5 articles for you...
217
Ls Advisories Oracle Esm H240
Price Tag%201security advisorysecurity updateupdate

Oracle Linux 9 ELSA-2024-11250 moderate: pam security update

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2024-11250 http://linux.oracle.com/errata/ELSA-2024-11250.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: pam-1.5.1-21.0.1.el9_5.i686.rpm pam-1.5.1-21.0.1.el9_5.x86_64.rpm pam-devel-1.5.1-21.0.1.el9_5.i686.rpm pam-devel-1.5.1-21.0.1.el9_5.x86_64.rpm pam-docs-1.5.1-21.0.1.el9_5.x86_64.rpm aarch64: pam-1.5.1-21.0.1.el9_5.aarch64.rpm pam-devel-1.5.1-21.0.1.el9_5.aarch64.rpm pam-docs-1.5.1-21.0.1.el9_5.aarch64.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates//pam-1.5.1-21.0.1.el9_5.src.rpm Related CVEs: CVE-2024-10041 Description of changes: [1.5.1-21.0.1] - pam_access: clean up the remote host matching code [Orabug: 36771903] - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36406534] [1.5.1-21] - pam_unix: always run the helper to obtain shadow password file entries. CVE-2024-10041. Resolves: RHEL-62880 [1.5.1-20] - libpam: support long lines in service files. Resolves: RHEL-40705 [1.5.1-19] - pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situations. CVE-2024-22365. Resolves: RHEL-21244 [1.5.1-18] - libpam: use getlogin() from libc and not utmp. Resolves: RHEL-16727 - pam_access: handle hostnames in access.conf. Resolves: RHEL-22300 [1.5.1-17] - pam_faillock: create tallydir before creating tallyfile. Resolves: RHEL-20943 [1.5.1-16] - libpam: use close_range() to close file descriptors. Resolves: RHEL-5099 - fix formatting of audit messages. Resolves: RHEL-5100 [1.5.1-15] - pam_misc: make length of misc_conv() configurable and set to 4096. Resolves: #2215007 _______________________________________________ El-errata mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. https://oss.oracle.com/mailman/listinfo/el-errata . Oracle Linux 9 released security update ELSA-2024-11250, addressing PAM vulnerabilities. It's classified as moderate priority, urging admins to applyupdates promptly.. Oracle Linux Updates, Moderate Security Advisory, pam Security Patch. . LinuxSecurity.com Team

Calendar%202 Dec 20, 2024 Oracle
98
Ls Advisories Redhat Esm H240
Price Tag%201security advisorymoderatebuffer overflow

Red Hat Enterprise Linux 6: RHSA-2013:0521-02 Moderate: PAM Flaws

Updated pam packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Moderate: pam security, bug fix, and enhancement update Advisory ID: RHSA-2013:0521-02 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2013:0521.html Issue date: 2013-02-21 CVE Names: CVE-2011-3148 CVE-2011-3149 ==================================================================== 1. Summary: Updated pam packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 3. Description: Pluggable Authentication Modules (PAM) provide a system whereby administrators can set up authentication policies without having to recompile programs to handle authentication. A stack-based buffer overflow flaw was found in the way the pam_env module parsed users' "~/.pam_environment" files. If an application's PAM configuration contained "user_readenv=1" (this is not the default), a local attacker could use this flaw to crash the application or, possibly, escalate theirprivileges. (CVE-2011-3148) A denial of service flaw was found in the way the pam_env module expanded certain environment variables. If an application's PAM configuration contained "user_readenv=1" (this is not the default), a local attacker could use this flaw to cause the application to enter an infinite loop. (CVE-2011-3149) Red Hat would like to thank Kees Cook of the Google ChromeOS Team for reporting the CVE-2011-3148 and CVE-2011-3149 issues. These updated pam packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Usersare directed to the Red Hat Enterprise Linux 6.4 Technical Notes, linked to in the References, for information on the most significant of these changes. All pam users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 588893 - pam does not enforce password complexity restrictions on root 673398 - request for additional pam_cracklib checks 723297 - limits.conf should mention limits.d directory 746619 - CVE-2011-3148 pam (pam_env): Stack-based buffer overflow by parsing user's pam_environment file 746620 - CVE-2011-3149 pam (pam_env): Infinite loop by expanding certain arguments 750601 - pam_namespace cannot verify status of SELinux in MLS 811168 - fix pam_get_authtok_verify() to respect the authtok_type= option 811243 - pam_cracklib: difignore is no-op in the current package - needs man page update 815516 - pam remember can check wrong username if it is a substring of another username 6. Package List: Red Hat Enterprise Linux Desktop (v.6): Source: i386: pam-1.1.1-13.el6.i686.rpm pam-debuginfo-1.1.1-13.el6.i686.rpm x86_64: pam-1.1.1-13.el6.i686.rpm pam-1.1.1-13.el6.x86_64.rpm pam-debuginfo-1.1.1-13.el6.i686.rpm pam-debuginfo-1.1.1-13.el6.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): Source: i386: pam-debuginfo-1.1.1-13.el6.i686.rpm pam-devel-1.1.1-13.el6.i686.rpm x86_64: pam-debuginfo-1.1.1-13.el6.i686.rpm pam-debuginfo-1.1.1-13.el6.x86_64.rpm pam-devel-1.1.1-13.el6.i686.rpm pam-devel-1.1.1-13.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: x86_64: pam-1.1.1-13.el6.i686.rpm pam-1.1.1-13.el6.x86_64.rpm pam-debuginfo-1.1.1-13.el6.i686.rpm pam-debuginfo-1.1.1-13.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: x86_64: pam-debuginfo-1.1.1-13.el6.i686.rpm pam-debuginfo-1.1.1-13.el6.x86_64.rpm pam-devel-1.1.1-13.el6.i686.rpm pam-devel-1.1.1-13.el6.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: i386: pam-1.1.1-13.el6.i686.rpm pam-debuginfo-1.1.1-13.el6.i686.rpm pam-devel-1.1.1-13.el6.i686.rpm ppc64: pam-1.1.1-13.el6.ppc.rpm pam-1.1.1-13.el6.ppc64.rpm pam-debuginfo-1.1.1-13.el6.ppc.rpm pam-debuginfo-1.1.1-13.el6.ppc64.rpm pam-devel-1.1.1-13.el6.ppc.rpm pam-devel-1.1.1-13.el6.ppc64.rpm s390x: pam-1.1.1-13.el6.s390.rpm pam-1.1.1-13.el6.s390x.rpm pam-debuginfo-1.1.1-13.el6.s390.rpm pam-debuginfo-1.1.1-13.el6.s390x.rpm pam-devel-1.1.1-13.el6.s390.rpm pam-devel-1.1.1-13.el6.s390x.rpm x86_64: pam-1.1.1-13.el6.i686.rpm pam-1.1.1-13.el6.x86_64.rpm pam-debuginfo-1.1.1-13.el6.i686.rpm pam-debuginfo-1.1.1-13.el6.x86_64.rpm pam-devel-1.1.1-13.el6.i686.rpm pam-devel-1.1.1-13.el6.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: i386: pam-1.1.1-13.el6.i686.rpm pam-debuginfo-1.1.1-13.el6.i686.rpm pam-devel-1.1.1-13.el6.i686.rpm x86_64: pam-1.1.1-13.el6.i686.rpm pam-1.1.1-13.el6.x86_64.rpm pam-debuginfo-1.1.1-13.el6.i686.rpm pam-debuginfo-1.1.1-13.el6.x86_64.rpm pam-devel-1.1.1-13.el6.i686.rpm pam-devel-1.1.1-13.el6.x86_64.rpm These packages are GPG signed by RedHat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2011-3148 https://access.redhat.com/security/cve/CVE-2011-3149 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2013 Red Hat, Inc. . Red Hat Security Advisory Synopsis: Moderate: pam security, bug fix, and enhancement update Advisory. updated, packages, security, various, enhancements. . LinuxSecurity.com Team

Calendar%202 Feb 21, 2013 Red Hat
Banner 2 1028x280 1708121730 1 1771599631
98
Ls Advisories Redhat Esm H240
Price Tag%201security advisoryRed Hatprivilege escalation

Red Hat 6: RHSA-2010-0891 Moderate: PAM Security Update Details

Updated pam packages that fix three security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: pam security update Advisory ID: RHSA-2010:0891-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2010:0891.html Issue date: 2010-11-16 CVE Names: CVE-2010-3316 CVE-2010-3435 CVE-2010-3853 ==================================================================== 1. Summary: Updated pam packages that fix three security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 3. Description: Pluggable Authentication Modules (PAM) provide a system whereby administrators can set up authentication policies without having to recompile programs that handle authentication. It was discovered that the pam_namespace module executed the external script namespace.init with an unchanged environment inherited from an application calling PAM. In cases where such an environment was untrusted (for example, when pam_namespace was configured for setuid applications suchas su or sudo), a local, unprivileged user could possibly use this flaw to escalate their privileges. (CVE-2010-3853) It was discovered that the pam_env and pam_mail modules used root privileges while accessing user's files. A local, unprivileged user could use this flaw to obtain information, from the lines that have the KEY=VALUE format expected by pam_env, from an arbitrary file. Also, in certain configurations, a local, unprivileged user using a service for which the pam_mail module was configured for, could use this flaw to obtain limited information about files or directories that they do not have access to. (CVE-2010-3435) Note: As part of the fix for CVE-2010-3435, this update changes the default value of pam_env's configuration option user_readenv to 0, causing the module to not read user's ~/.pam_environment configuration file by default, as reading it may introduce unexpected changes to the environment of the service using PAM, or PAM modules consulted after pam_env. It was discovered that the pam_xauth module did not verify the return values of the setuid() and setgid() system calls. A local, unprivileged user could use this flaw to execute the xauth command with root privileges and make it read an arbitrary input file. (CVE-2010-3316) Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team for reporting the CVE-2010-3435 issue. All pam users should upgrade to these updated packages, which contain backported patches to correct these issues. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bugs fixed (https://bugzilla.redhat.com/): 637898 - CVE-2010-3316 pam: pam_xauth missing return value checks from setuid() and similar calls 641335 - CVE-2010-3435 pam: pam_env and pam_mail accessing users' file with root privileges 643043 - CVE-2010-3853 pam: pam_namespace executesnamespace.init with service's environment 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: i386: pam-1.1.1-4.el6_0.1.i686.rpm pam-debuginfo-1.1.1-4.el6_0.1.i686.rpm x86_64: pam-1.1.1-4.el6_0.1.i686.rpm pam-1.1.1-4.el6_0.1.x86_64.rpm pam-debuginfo-1.1.1-4.el6_0.1.i686.rpm pam-debuginfo-1.1.1-4.el6_0.1.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): Source: i386: pam-debuginfo-1.1.1-4.el6_0.1.i686.rpm pam-devel-1.1.1-4.el6_0.1.i686.rpm x86_64: pam-debuginfo-1.1.1-4.el6_0.1.i686.rpm pam-debuginfo-1.1.1-4.el6_0.1.x86_64.rpm pam-devel-1.1.1-4.el6_0.1.i686.rpm pam-devel-1.1.1-4.el6_0.1.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: x86_64: pam-1.1.1-4.el6_0.1.i686.rpm pam-1.1.1-4.el6_0.1.x86_64.rpm pam-debuginfo-1.1.1-4.el6_0.1.i686.rpm pam-debuginfo-1.1.1-4.el6_0.1.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: x86_64: pam-debuginfo-1.1.1-4.el6_0.1.i686.rpm pam-debuginfo-1.1.1-4.el6_0.1.x86_64.rpm pam-devel-1.1.1-4.el6_0.1.i686.rpm pam-devel-1.1.1-4.el6_0.1.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: i386: pam-1.1.1-4.el6_0.1.i686.rpm pam-debuginfo-1.1.1-4.el6_0.1.i686.rpm pam-devel-1.1.1-4.el6_0.1.i686.rpm ppc64: pam-1.1.1-4.el6_0.1.ppc.rpm pam-1.1.1-4.el6_0.1.ppc64.rpm pam-debuginfo-1.1.1-4.el6_0.1.ppc.rpm pam-debuginfo-1.1.1-4.el6_0.1.ppc64.rpm pam-devel-1.1.1-4.el6_0.1.ppc.rpm pam-devel-1.1.1-4.el6_0.1.ppc64.rpm s390x: pam-1.1.1-4.el6_0.1.s390.rpm pam-1.1.1-4.el6_0.1.s390x.rpm pam-debuginfo-1.1.1-4.el6_0.1.s390.rpm pam-debuginfo-1.1.1-4.el6_0.1.s390x.rpm pam-devel-1.1.1-4.el6_0.1.s390.rpm pam-devel-1.1.1-4.el6_0.1.s390x.rpm x86_64: pam-1.1.1-4.el6_0.1.i686.rpm pam-1.1.1-4.el6_0.1.x86_64.rpm pam-debuginfo-1.1.1-4.el6_0.1.i686.rpm pam-debuginfo-1.1.1-4.el6_0.1.x86_64.rpm pam-devel-1.1.1-4.el6_0.1.i686.rpm pam-devel-1.1.1-4.el6_0.1.x86_64.rpm Red Hat Enterprise Linux Workstation (v.6): Source: i386: pam-1.1.1-4.el6_0.1.i686.rpm pam-debuginfo-1.1.1-4.el6_0.1.i686.rpm pam-devel-1.1.1-4.el6_0.1.i686.rpm x86_64: pam-1.1.1-4.el6_0.1.i686.rpm pam-1.1.1-4.el6_0.1.x86_64.rpm pam-debuginfo-1.1.1-4.el6_0.1.i686.rpm pam-debuginfo-1.1.1-4.el6_0.1.x86_64.rpm pam-devel-1.1.1-4.el6_0.1.i686.rpm pam-devel-1.1.1-4.el6_0.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2010-3316 https://access.redhat.com/security/cve/CVE-2010-3435 https://access.redhat.com/security/cve/CVE-2010-3853 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2010 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFM4sn5XlSAg2UNWIIRAuB5AJ9gtuG2ADentMBkpczlTA5YkRDunACdF62K kp2lIAPhH4sSN0LC7ZfJxHI=eM9w -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Regular security enhancement for PAM modules on Red Hat to tackle elevation of privilege vulnerabilities.. Red Hat, PAM Update, Privilege Escalation, Authentication Security, Security Advisory. . LinuxSecurity.com Team

Calendar%202 Nov 16, 2010 Red Hat
98
Ls Advisories Redhat Esm H240
Price Tag%201security advisorymoderatesecurity update

Red Hat Enterprise Linux 5: RHSA-2007:0555-04 Moderate PAM Security Fix

Updated pam packages that fix two security flaws, resolve several bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. A flaw was found in the way pam_console set console device permissions. It was possible for various console devices to retain ownership of the console user after logging out, possibly leaking information to another local user. This update has been rated as having moderate security impact by the Red Hat Security Response Team.. - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: pam security, bug fix, and enhancement update Advisory ID: RHSA-2007:0555-04 Advisory URL: https://access.redhat.com/errata/RHSA-2007:0555.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux Keywords: limits namespace LSPP polyinstantiation audit device ownership tty SELinux CVE Names: CVE-2007-1716 CVE-2007-3102 - ---------------------------------------------------------------------1. Summary: Updated pam packages that fix two security flaws, resolve several bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: Pluggable Authentication Modules (PAM) provide a system whereby administrators can set up authentication policies without having to recompile programs that handle authentication. A flaw was found in the way pam_console set console device permissions. It was possible for various console devices to retain ownership of the console user after logging out, possibly leaking information to another localuser. (CVE-2007-1716) A flaw was found in the way the PAM library wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102) As well, these updated packages fix the following bugs: * truncated MD5-hashed passwords in "/etc/shadow" were treated as valid, resulting in insecure and invalid passwords. * the pam_namespace module did not convert context names to raw format and did not unmount polyinstantiated directories in some cases. It also crashed when an unknown user name was used in "/etc/security/namespace.conf", the pam_namespace configuration file. * the pam_selinux module was not relabeling the controlling tty correctly, and in some cases it did not send complete information about user role and level change to the audit subsystem. These updated packages add the following enhancements: * pam_limits module now supports parsing additional config files placed into the /etc/security/limits.d/ directory. These files are read after the main configuration file. * the modules pam_limits, pam_access, and pam_time now send a message to the audit subsystem when a user is denied access based on the number of login sessions, origin of user, and time of login. * pam_unix module security properties were improved. Functionality in the setuid helper binary, unix_chkpwd, which was not required for user authentication, was moved to a new non-setuid helper binary, unix_update. All users of PAM should upgrade to these updated packages, which resolve these issues and add these enhancements. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bug IDs fixed (http://bugzilla.redhat.com/): 227345 - pam_namespace should convertthe context names before it uses them as filenames 230120 - LSPP: Not able to log into the machine with large number of categories 232993 - FIPS 200: audit rejection based on number of sessions, origin and time 233581 - CVE-2007-1716 Ownership of devices not returned to root after logout from console 234513 - [LSPP] pam_namespace crashes with non-existent users in namespace.conf 234781 - [LSPP] incorrect information in pam_selinux audit record 236316 - LSPP: Unable to change expired password on ssh login 237163 - namespace.conf: $HOME used in polyinstantiated directory name not being expanded 237249 - LSPP: polyinstantiation behavior correct and documented 243204 - CVE-2007-3102 audit logging of failed logins 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: 8d551576c99cc43b6ec69d1372bb8d0d pam-0.99.6.2-3.26.el5.src.rpm i386: 84d48c3be0870e9dbfe2dc27395de114 pam-0.99.6.2-3.26.el5.i386.rpm c1b7da6238f60f4debac539d71b53222 pam-debuginfo-0.99.6.2-3.26.el5.i386.rpm x86_64: 84d48c3be0870e9dbfe2dc27395de114 pam-0.99.6.2-3.26.el5.i386.rpm 5372f04b4d5c7e311ccbc470b0ce296a pam-0.99.6.2-3.26.el5.x86_64.rpm c1b7da6238f60f4debac539d71b53222 pam-debuginfo-0.99.6.2-3.26.el5.i386.rpm 296cd65817f32b98dc9f0d6be63e779d pam-debuginfo-0.99.6.2-3.26.el5.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: 8d551576c99cc43b6ec69d1372bb8d0d pam-0.99.6.2-3.26.el5.src.rpm i386: c1b7da6238f60f4debac539d71b53222 pam-debuginfo-0.99.6.2-3.26.el5.i386.rpm d622f4f24b1022924db60a27c510ac7c pam-devel-0.99.6.2-3.26.el5.i386.rpm x86_64: c1b7da6238f60f4debac539d71b53222 pam-debuginfo-0.99.6.2-3.26.el5.i386.rpm 296cd65817f32b98dc9f0d6be63e779d pam-debuginfo-0.99.6.2-3.26.el5.x86_64.rpm d622f4f24b1022924db60a27c510ac7c pam-devel-0.99.6.2-3.26.el5.i386.rpm 4c244fb63c0f7404ebad4f9b2c8023d9 pam-devel-0.99.6.2-3.26.el5.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: 8d551576c99cc43b6ec69d1372bb8d0d pam-0.99.6.2-3.26.el5.src.rpm i386: 84d48c3be0870e9dbfe2dc27395de114 pam-0.99.6.2-3.26.el5.i386.rpm c1b7da6238f60f4debac539d71b53222 pam-debuginfo-0.99.6.2-3.26.el5.i386.rpm d622f4f24b1022924db60a27c510ac7c pam-devel-0.99.6.2-3.26.el5.i386.rpm ia64: 84d48c3be0870e9dbfe2dc27395de114 pam-0.99.6.2-3.26.el5.i386.rpm f1107cda14d5f5e06c34567f4c960ce9 pam-0.99.6.2-3.26.el5.ia64.rpm c1b7da6238f60f4debac539d71b53222 pam-debuginfo-0.99.6.2-3.26.el5.i386.rpm 567b72218dac642e9ab0e211df9aa025 pam-debuginfo-0.99.6.2-3.26.el5.ia64.rpm 71b979597060947cc876725399b9f110 pam-devel-0.99.6.2-3.26.el5.ia64.rpm ppc: b8bdf7f7059ef8b82c48477373db3d9a pam-0.99.6.2-3.26.el5.ppc.rpm d513db5dc35eed0401410bf4bff2bd78 pam-0.99.6.2-3.26.el5.ppc64.rpm 9f11916618717cbd1a58b667ad35beb5 pam-debuginfo-0.99.6.2-3.26.el5.ppc.rpm 8496bc7427358b5f0435b04af8e9c0d6 pam-debuginfo-0.99.6.2-3.26.el5.ppc64.rpm 83b06532e32e2e3f61e52b67af67e1df pam-devel-0.99.6.2-3.26.el5.ppc.rpm 19bc56166f397d5507ee63419c30c425 pam-devel-0.99.6.2-3.26.el5.ppc64.rpm s390x: c9a1ffc67c7eb25e418130f48962f20f pam-0.99.6.2-3.26.el5.s390.rpm b1208395f4bbe301a56fd0d1a263b0cd pam-0.99.6.2-3.26.el5.s390x.rpm 9cb56666c2455672a440b85be60417b3 pam-debuginfo-0.99.6.2-3.26.el5.s390.rpm 0ed494671540c9f78406f3b0b3b64f64 pam-debuginfo-0.99.6.2-3.26.el5.s390x.rpm a63e62356e6ffd4a964212e4da6ec3e2 pam-devel-0.99.6.2-3.26.el5.s390.rpm 9472719bcff3e5d4244da94b32443dbf pam-devel-0.99.6.2-3.26.el5.s390x.rpm x86_64: 84d48c3be0870e9dbfe2dc27395de114 pam-0.99.6.2-3.26.el5.i386.rpm 5372f04b4d5c7e311ccbc470b0ce296a pam-0.99.6.2-3.26.el5.x86_64.rpm c1b7da6238f60f4debac539d71b53222 pam-debuginfo-0.99.6.2-3.26.el5.i386.rpm 296cd65817f32b98dc9f0d6be63e779d pam-debuginfo-0.99.6.2-3.26.el5.x86_64.rpm d622f4f24b1022924db60a27c510ac7c pam-devel-0.99.6.2-3.26.el5.i386.rpm 4c244fb63c0f7404ebad4f9b2c8023d9 pam-devel-0.99.6.2-3.26.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify thesignature are available from https://access.redhat.com/security/team/key#package 7. References: https://www.cve.org/CVERecord?id=CVE-2007-1716 https://www.cve.org/CVERecord?id=CVE-2007-3102 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. . Balanced guidance for kernel revisions in Ubuntu targeting vulnerabilities and errors to ensure improved safety.. Red Hat PAM Security, Security Bug Fix, PAM Updates, Security Enhancements. . LinuxSecurity.com Team

Calendar%202 Nov 07, 2007 Red Hat
Banner 2 1028x280 1708121730 1 1771599631
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics