CVE-2010-3316

Priority
Description
The run_coprocess function in pam_xauth.c in the pam_xauth module in
Linux-PAM (aka pam) before 1.1.2 does not check the return values of the
setuid, setgid, and setgroups system calls, which might allow local users
to read arbitrary files by executing a program that relies on the pam_xauth
PAM check.
Notes
mdeslaurpatch below also includes partial fix for CVE-2010-3435, but
introduces CVE-2010-3430 and CVE-2010-3431
see complete patch list in CVE-2010-3435
More Information

Updated: 2019-12-05 20:55:32 UTC (commit 0aa5e7c87c8b55d2ec5c7f4ca1179cf75de91961)