Search for packages
Package details: pkg:deb/debian/libpam-krb5@4.3-1
purl pkg:deb/debian/libpam-krb5@4.3-1
Next non-vulnerable version 4.9-2
Latest non-vulnerable version 4.9-2
Risk 4.4
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-nnwe-q43v-aaaq
Aliases:
CVE-2020-10595
pam-krb5 before 4.9 has a buffer overflow that might cause remote code execution in situations involving supplemental prompting by a Kerberos library. It may overflow a buffer provided by the underlying Kerberos library by a single '\0' byte if an attacker responds to a prompt with an answer of a carefully chosen length. The effect may range from heap corruption to stack corruption depending on the structure of the underlying Kerberos library, with unknown effects but possibly including code execution. This code path is not used for normal authentication, but only when the Kerberos library does supplemental prompting, such as with PKINIT or when using the non-standard no_prompt PAM configuration option.
4.7-4+deb9u1
Affected by 1 other vulnerability.
4.8-2+deb10u1
Affected by 1 other vulnerability.
4.9-2
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (2)
Vulnerability Summary Aliases
VCID-cq4v-6npr-aaae Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations. CVE-2009-0361
VCID-h411-6zh8-aaan Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application. CVE-2009-0360

Date Actor Action Vulnerability Source VulnerableCode Version
2025-06-21T16:40:33.921662+00:00 Debian Oval Importer Fixing VCID-cq4v-6npr-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.3
2025-06-21T16:01:05.717353+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.3
2025-06-21T14:48:50.508903+00:00 Debian Oval Importer Fixing VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.3
2025-06-21T10:45:21.053110+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-20T23:57:38.223191+00:00 Debian Oval Importer Fixing VCID-cq4v-6npr-aaae None 36.1.3
2025-06-20T23:57:09.999965+00:00 Debian Oval Importer Fixing VCID-h411-6zh8-aaan None 36.1.3
2025-06-20T20:05:07.207852+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq None 36.1.3
2025-06-08T12:12:13.543169+00:00 Debian Oval Importer Fixing VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.1.0
2025-06-08T09:26:05.084592+00:00 Debian Oval Importer Fixing VCID-cq4v-6npr-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.0
2025-06-08T08:54:24.958751+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.0
2025-06-08T07:42:12.198392+00:00 Debian Oval Importer Fixing VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.0
2025-06-08T04:23:11.785150+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-07T17:20:32.170666+00:00 Debian Oval Importer Fixing VCID-cq4v-6npr-aaae None 36.1.0
2025-06-07T17:20:04.295112+00:00 Debian Oval Importer Fixing VCID-h411-6zh8-aaan None 36.1.0
2025-06-07T13:51:58.719522+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq None 36.1.0
2025-04-12T21:41:08.504117+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-12T21:09:38.227351+00:00 Debian Oval Importer Fixing VCID-cq4v-6npr-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-12T17:57:53.634724+00:00 Debian Oval Importer Fixing VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-08T07:58:25.701603+00:00 Debian Oval Importer Fixing VCID-cq4v-6npr-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.0.0
2025-04-08T07:25:58.605092+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.0.0
2025-04-08T06:14:41.424720+00:00 Debian Oval Importer Fixing VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.0.0
2025-04-08T02:52:58.338151+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-07T15:54:33.641914+00:00 Debian Oval Importer Fixing VCID-cq4v-6npr-aaae None 36.0.0
2025-04-07T15:54:04.037694+00:00 Debian Oval Importer Fixing VCID-h411-6zh8-aaan None 36.0.0
2025-04-07T12:26:53.566291+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq None 36.0.0
2024-11-27T00:34:53.799765+00:00 Debian Oval Importer Fixing VCID-cq4v-6npr-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 35.0.0
2024-11-27T00:33:49.323217+00:00 Debian Oval Importer Fixing VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 35.0.0
2024-10-12T22:56:17.865592+00:00 Debian Oval Importer Fixing VCID-cq4v-6npr-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.2
2024-10-12T22:55:38.591551+00:00 Debian Oval Importer Fixing VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.2
2024-09-20T18:15:46.243470+00:00 Debian Oval Importer Fixing VCID-cq4v-6npr-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.1
2024-09-20T18:15:17.494044+00:00 Debian Oval Importer Fixing VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.1