CVE-2012-1502 Double free vulnerability in the PyPAM_conv in PAMmodule.c in PyPam 0.5.0 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a....
HighCVSS 7.5
EPSS 14.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Double free vulnerability in the PyPAM_conv in PAMmodule.c in PyPam 0.5.0 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a NULL byte in a password string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/python-pam(Debian:12) | < 0.4.2-13 | 0.4.2-13 |
| debian/python-pam(Debian:13) | < 0.4.2-13 | 0.4.2-13 |
| debian/python-pam(Debian:14) | < 0.4.2-13 | 0.4.2-13 |
| pypam | <= 0.5.0 | No fix listed |
References
- Debian Security Tracker CVE-2012-1502 vendor-advisory
- openSUSE-SU-2012:0487 vendor-advisory
- 48312 third-party-advisory vendor-advisory
- 48332 third-party-advisory vendor-advisory
- 48746 third-party-advisory vendor-advisory
- USN-1395-1 vendor-advisory
- DSA-2430 vendor-advisory
- www.lsexperts.de exploit
- 79892 vdb-entry
- pypam-password-dos(73857) vdb-entry
- GLSA-201507-09 vendor-advisory