A double free vulnerability in PyPAM could result in execution of arbitrary code or Denial of Service.
|Package||dev-python/pypam on all architectures|
|Affected versions||< 0.5.0-r3|
|Unaffected versions||>= 0.5.0-r3|
PyPAM is a PAM binding for Python.
PyPAM does not handle passwords correctly if there is NULL byte in the string.
A remote attacker could possibly execute arbitrary code or cause a Denial of Service condition.
There is no known workaround at this time.
All PyPAM users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-python/pypam-0.5.0-r3"
July 09, 2015
July 09, 2015: 1