Description
The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pam | 1.1.3-1 | — |
| Debian 13 | pam | 1.1.3-1 | — |
| Debian 12 | pam | 1.1.3-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | pam +1 | 1.1.1-4.el6_0.1 | RHSA-2010:0891 |
| RHEL 5 | pam +1 | 0.99.6.2-6.el5_5.2 | RHSA-2010:0819 |
Advisories 2
- RHSA-2010:0819 Red Hat Security Advisory: pam security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0891 Red Hat Security Advisory: pam security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- [oss-security] 20100927 Re: Minor security flaw with pam_xauth mailing-list
- [oss-security] 20100921 Re: Minor security flaw with pam_xauth mailing-list
- GLSA-201206-31 vendor-advisory
- [security-announce] 20110307 VMSA-2011-0004 VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm mailing-list
- ADV-2011-0606 vdb-entry
- 20110308 VMSA-2011-0004 VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm. mailing-list
- [oss-security] 20100924 Re: Minor security flaw with pam_xauth mailing-list
- [oss-security] 20100928 Re: Minor security flaw with pam_xauth mailing-list
- [oss-security] 20100927 Re: Minor security flaw with pam_xauth mailing-list
- MDVSA-2010:220 vendor-advisory
- 49711 third-party-advisory
- http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=06f882f30092a39a1db867c9744b2ca8d60e4ad6
- [oss-security] 20100928 Re: Minor security flaw with pam_xauth mailing-list
- RHSA-2010:0891 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=641335
- [oss-security] 20101025 Re: Minor security flaw with pam_xauth mailing-list
- RHSA-2010:0819 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2011-0004.html
- [oss-security] 20100927 Re: Minor security flaw with pam_xauth mailing-list