VULNERABILITY INTELLIGENCE
CVE-2009-0887
CVSS score6.6 MEDIUM
EPSS probability1.93%
CISA KEVNot currently listed
Published2009-03-12
Last modified2026-06-16
CVSS vectorAV:L/AC:M/Au:S/C:C/I:C/A:C
Description
Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.