Search for packages
Package details: pkg:deb/debian/libpam-krb5@2.6-1etch1
purl pkg:deb/debian/libpam-krb5@2.6-1etch1
Next non-vulnerable version 4.9-2
Latest non-vulnerable version 4.9-2
Risk 10.0
Vulnerabilities affecting this package (3)
Vulnerability Summary Fixed by
VCID-cq4v-6npr-aaae
Aliases:
CVE-2009-0361
Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations.
4.3-1
Affected by 1 other vulnerability.
VCID-h411-6zh8-aaan
Aliases:
CVE-2009-0360
Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.
4.3-1
Affected by 1 other vulnerability.
VCID-nnwe-q43v-aaaq
Aliases:
CVE-2020-10595
pam-krb5 before 4.9 has a buffer overflow that might cause remote code execution in situations involving supplemental prompting by a Kerberos library. It may overflow a buffer provided by the underlying Kerberos library by a single '\0' byte if an attacker responds to a prompt with an answer of a carefully chosen length. The effect may range from heap corruption to stack corruption depending on the structure of the underlying Kerberos library, with unknown effects but possibly including code execution. This code path is not used for normal authentication, but only when the Kerberos library does supplemental prompting, such as with PKINIT or when using the non-standard no_prompt PAM configuration option.
4.7-4+deb9u1
Affected by 1 other vulnerability.
4.8-2+deb10u1
Affected by 1 other vulnerability.
4.9-2
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2025-06-21T16:40:33.916408+00:00 Debian Oval Importer Affected by VCID-cq4v-6npr-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.3
2025-06-21T16:01:05.713477+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.3
2025-06-21T14:48:50.503806+00:00 Debian Oval Importer Affected by VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.3
2025-06-21T10:45:21.049597+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.3
2025-06-20T23:57:38.218232+00:00 Debian Oval Importer Affected by VCID-cq4v-6npr-aaae None 36.1.3
2025-06-20T23:57:09.996093+00:00 Debian Oval Importer Affected by VCID-h411-6zh8-aaan None 36.1.3
2025-06-20T20:05:07.203996+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq None 36.1.3
2025-06-08T12:12:13.540159+00:00 Debian Oval Importer Affected by VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.1.0
2025-06-08T09:26:05.081548+00:00 Debian Oval Importer Affected by VCID-cq4v-6npr-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.0
2025-06-08T08:54:24.955755+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.0
2025-06-08T07:42:12.195176+00:00 Debian Oval Importer Affected by VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.0
2025-06-08T04:23:11.781483+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.1.0
2025-06-07T17:20:32.167445+00:00 Debian Oval Importer Affected by VCID-cq4v-6npr-aaae None 36.1.0
2025-06-07T17:20:04.291297+00:00 Debian Oval Importer Affected by VCID-h411-6zh8-aaan None 36.1.0
2025-06-07T13:51:58.715831+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq None 36.1.0
2025-04-12T21:41:08.494286+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-12T21:09:38.217400+00:00 Debian Oval Importer Affected by VCID-cq4v-6npr-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-12T17:57:53.624683+00:00 Debian Oval Importer Affected by VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-08T07:58:25.691519+00:00 Debian Oval Importer Affected by VCID-cq4v-6npr-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.0.0
2025-04-08T07:25:58.595113+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.0.0
2025-04-08T06:14:41.414634+00:00 Debian Oval Importer Affected by VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.0.0
2025-04-08T02:52:58.328278+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq https://www.debian.org/security/oval/oval-definitions-stretch.xml.bz2 36.0.0
2025-04-07T15:54:33.631537+00:00 Debian Oval Importer Affected by VCID-cq4v-6npr-aaae None 36.0.0
2025-04-07T15:54:04.027585+00:00 Debian Oval Importer Affected by VCID-h411-6zh8-aaan None 36.0.0
2025-04-07T12:26:53.555688+00:00 Debian Oval Importer Affected by VCID-nnwe-q43v-aaaq None 36.0.0
2024-11-27T00:34:53.790067+00:00 Debian Oval Importer Affected by VCID-cq4v-6npr-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 35.0.0
2024-11-27T00:33:49.313191+00:00 Debian Oval Importer Affected by VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 35.0.0
2024-10-12T22:56:17.855871+00:00 Debian Oval Importer Affected by VCID-cq4v-6npr-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.2
2024-10-12T22:55:38.581743+00:00 Debian Oval Importer Affected by VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.2
2024-09-20T18:15:46.232953+00:00 Debian Oval Importer Affected by VCID-cq4v-6npr-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.1
2024-09-20T18:15:17.481294+00:00 Debian Oval Importer Affected by VCID-h411-6zh8-aaan https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.1