It was discovered that the PAM pam_userdb module incorrectly used a case-insensitive method when comparing hashed passwords. A local attacker could possibly use this issue to make brute force attacks easier. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2013-7041)
Sebastian Krahmer discovered that the PAM pam_timestamp module incorrectly performed filtering. A local attacker could use this issue to create arbitrary files, or possibly bypass authentication. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2583)
Sebastien Macke discovered that the PAM pam_unix module incorrectly handled large passwords. A local attacker could possibly use this issue in certain environments to enumerate usernames or cause a denial of service. (CVE-2015-3238)
{ "availability": "No subscription required", "binaries": [ { "binary_version": "1.1.8-1ubuntu2.1", "binary_name": "libpam-cracklib" }, { "binary_version": "1.1.8-1ubuntu2.1", "binary_name": "libpam-cracklib-dbgsym" }, { "binary_version": "1.1.8-1ubuntu2.1", "binary_name": "libpam-doc" }, { "binary_version": "1.1.8-1ubuntu2.1", "binary_name": "libpam-modules" }, { "binary_version": "1.1.8-1ubuntu2.1", "binary_name": "libpam-modules-bin" }, { "binary_version": "1.1.8-1ubuntu2.1", "binary_name": "libpam-modules-bin-dbgsym" }, { "binary_version": "1.1.8-1ubuntu2.1", "binary_name": "libpam-modules-dbgsym" }, { "binary_version": "1.1.8-1ubuntu2.1", "binary_name": "libpam-runtime" }, { "binary_version": "1.1.8-1ubuntu2.1", "binary_name": "libpam0g" }, { "binary_version": "1.1.8-1ubuntu2.1", "binary_name": "libpam0g-dbgsym" }, { "binary_version": "1.1.8-1ubuntu2.1", "binary_name": "libpam0g-dev" } ] }