Description
The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an unintended environment by executing a program that relies on the pam_env PAM check.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pam | 1.1.3-7.1 | — |
| Debian 13 | pam | 1.1.3-7.1 | — |
| Debian 12 | pam | 1.1.3-7.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | pam +1 | 1.1.1-4.el6_0.1 | RHSA-2010:0891 |
Advisories 1
- RHSA-2010:0891 Red Hat Security Advisory: pam security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- linuxpam-pamenv-priv-escalation(65037) vdb-entry
- GLSA-201206-31 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=641335
- http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.8.xml?r1=1.7&r2=1.8
- 49711 third-party-advisory
- [oss-security] 20100928 Re: Minor security flaw with pam_xauth mailing-list
- http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.c?r1=1.22&r2=1.23
- 46046 vdb-entry