It was discovered that the PAM pam_userdb module incorrectly used a case-insensitive method when comparing hashed passwords. A local attacker could possibly use this issue to make brute force attacks easier. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2013-7041)
Sebastian Krahmer discovered that the PAM pam_timestamp module incorrectly performed filtering. A local attacker could use this issue to create arbitrary files, or possibly bypass authentication. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2583)
Sebastien Macke discovered that the PAM pam_unix module incorrectly handled large passwords. A local attacker could possibly use this issue in certain environments to enumerate usernames or cause a denial of service. (CVE-2015-3238)
{ "availability": "No subscription required", "binaries": [ { "libpam-doc": "1.1.8-1ubuntu2.1", "libpam-modules-bin": "1.1.8-1ubuntu2.1", "libpam-runtime": "1.1.8-1ubuntu2.1", "libpam-cracklib": "1.1.8-1ubuntu2.1", "libpam0g-dbgsym": "1.1.8-1ubuntu2.1", "libpam-modules-dbgsym": "1.1.8-1ubuntu2.1", "libpam0g-dev": "1.1.8-1ubuntu2.1", "libpam-modules-bin-dbgsym": "1.1.8-1ubuntu2.1", "libpam0g": "1.1.8-1ubuntu2.1", "libpam-modules": "1.1.8-1ubuntu2.1", "libpam-cracklib-dbgsym": "1.1.8-1ubuntu2.1" } ] }