CVE-2011-3149 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Linux-pam
Severity
2.1LOWNVD
EPSS
0.1%
top 80.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 22
Latest updateMay 14
Description
The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).
CVSS vector
AV:L/AC:L/C:N/I:N/A:PExploitability: 3.9 | Impact: 2.9
Affected Packages3 packages
🔴Vulnerability Details
2📋Vendor Advisories
3💬Community
3Bugzilla
▶
Bugzilla▶
CVE-2011-3148 pam (pam_env): Stack-based buffer overflow by parsing user's pam_environment file↗2011-10-17