High ELSA-2025-10027 1 CVE

Important: pam security update (Oracle Linux 8)

Published Jul 1, 2025 · Updated Jul 1, 2025

Ecosystem: Oracle Linux

Summary

[1.3.1-37.0.1]
- pam_limits: fix use after free in pam_sm_open_session [Orabug: 36272695]

[1.3.1-37]
- pam_namespace: fix potential privilege escalation.
Resolves: CVE-2025-6020 and RHEL-96724

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 8	pam	0:1.3.1-37.0.1.el8_10
Oracle Linux · 8	pam-devel	0:1.3.1-37.0.1.el8_10

Vulnerabilities 1

High 7.8

CVE-2025-6020 Public exploit

Linux-pam: linux-pam directory traversal

A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux

Jun 17, 2025