advisories/16212.adv

type: security
subject: Updated pam package fixes security vulnerability
CVE:
 - CVE-2015-3238
src:
  4:
   core:
     - pam-1.1.8-7.2.mga4
  5:
   core:
     - pam-1.1.8-10.1.mga5
description: |
  If SELinux is enabled, the _unix_run_helper_binary function in Linux-PAM
  1.1.8 and earlier hangs indefinitely when verifying a password of 65536
  characters, which allows attackers to conduct username enumeration and
  denial of service attacks (CVE-2015-3238).
references:
 - https://bugs.mageia.org/show_bug.cgi?id=16212
 - https://lists.fedoraproject.org/pipermail/package-announce/2015-June/161249.html
ID: MGASA-2015-0266
1	type: security
2	subject: Updated pam package fixes security vulnerability
3	CVE:
4	- CVE-2015-3238
5	src:
6	4:
7	core:
8	- pam-1.1.8-7.2.mga4
9	5:
10	core:
11	- pam-1.1.8-10.1.mga5
12	description: \|
13	If SELinux is enabled, the _unix_run_helper_binary function in Linux-PAM
14	1.1.8 and earlier hangs indefinitely when verifying a password of 65536
15	characters, which allows attackers to conduct username enumeration and
16	denial of service attacks (CVE-2015-3238).
17	references:
18	- https://bugs.mageia.org/show_bug.cgi?id=16212
19	- https://lists.fedoraproject.org/pipermail/package-announce/2015-June/161249.html
20	ID: MGASA-2015-0266