What’s Vulnerable › Vulnerabilities

CVE-2010-4707

• Severity: medium (CVSS 4.9 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2011-01-24 · updated 2026-06-16
• Weakness: CWE-399

Description

The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service (resource consumption) via a special file.

Affected products

• Linux-PAM: through 1.1.2; 0.99.1.0, 0.99.2.0, 0.99.2.1, 0.99.3.0, 0.99.4.0, 0.99.5.0 (+17)

References

• http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=Linux-PAM-1_1_2-2-gffe7058c70253d574b1963c7c93002bd410fddc9
• http://openwall.com/lists/oss-security/2010/10/03/1
• http://secunia.com/advisories/49711
• http://security.gentoo.org/glsa/glsa-201206-31.xml
• http://www.securityfocus.com/bid/46045
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65036
• http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=Linux-PAM-1_1_2-2-gffe7058c70253d574b1963c7c93002bd410fddc9
• http://openwall.com/lists/oss-security/2010/10/03/1
• http://secunia.com/advisories/49711
• http://security.gentoo.org/glsa/glsa-201206-31.xml
• http://www.securityfocus.com/bid/46045
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65036

Get alerted when CVE-2010-4707 or the next vulnerability affects your stack