Linux-pam

This hub aggregates every CVE we track for Linux-pam, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Linux-pam.

• CVE-2026-54411Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison5.9Jun 14, 2026
• CVE-2025-8941Linux-pam: incomplete fix for cve-2025-60207.8Aug 13, 2025
• CVE-2025-6018Pam-config: lpe from unprivileged to allow_active in pam7.8Jul 23, 2025
• CVE-2025-6020Linux-pam: linux-pam directory traversal7.8Jun 17, 2025
• CVE-2024-10041Pam: libpam: libpam vulnerable to read hashed password4.7Oct 23, 2024
• CVE-2024-22365linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.5.5Feb 6, 2024
• CVE-2022-28321The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from...9.8Sep 19, 2022
• CVE-2020-27780A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case o...9.8Dec 17, 2020
• CVE-2018-17953pam_access does not handle netmask matches correctly7.5Nov 27, 2018
• CVE-2015-3238The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denia...6.5Aug 24, 2015
• CVE-2014-2583Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authenticati...5.8Apr 10, 2014
• CVE-2011-3148Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly exec...4.6Jul 22, 2012
• CVE-2011-3149The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allow...2.1Jul 22, 2012
• CVE-2010-4706The pam_sm_close_session function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not properly handle a failure to determine a certain target uid, which might a...4.9Jan 24, 2011
• CVE-2010-4708The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an unintended environment ...7.2Jan 24, 2011