Multiple directory traversal vulnerabilities in pamtimestamp.c in the pamtimestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAMRUSER value to the getruser function or (2) PAMTTY value to the checktty function, which is used by the formattimestampname function.