| Package | Affected versions | Patched versions |
|---|---|---|
| linux-pam | = 0.99.1.0= 0.99.10.0= 0.99.2.0= 0.99.2.1= 0.99.3.0= 0.99.4.0= 0.99.5.0= 0.99.6.0= 0.99.6.1= 0.99.6.2= 0.99.6.3= 0.99.7.0= 0.99.7.1= 0.99.8.0= 0.99.8.1= 0.99.9.0= 1.0.0= 1.0.1= 1.0.2= 1.0.3= 1.0.4= 1.1.0≤ 1.1.1 |
The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pam_xauth PAM check.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free