{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [ "linux-image-6.8.0-139-generic", "linux-modules-6.8.0-139-generic" ], "removed": [ "linux-image-6.8.0-138-generic", "linux-modules-6.8.0-138-generic" ], "diff": [ "bsdutils", "coreutils", "diffutils", "fdisk", "gpgv", "libattr1", "libblkid1", "libbz2-1.0", "libfdisk1", "libgcrypt20", "libmount1", "libncursesw6", "libp11-kit0", "libpam-modules", "libpam-modules-bin", "libpam-runtime", "libpam0g", "libsmartcols1", "libssh-4", "libtinfo6", "libuuid1", "linux-image-virtual", "mount", "ncurses-base", "ncurses-bin", "openssh-client", "openssh-server", "openssh-sftp-server", "perl-base", "util-linux", "zlib1g" ] } }, "diff": { "deb": [ { "name": "bsdutils", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "1:2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "1:2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "coreutils", "from_version": { "source_package_name": "coreutils", "source_package_version": "9.4-3ubuntu6.2", "version": "9.4-3ubuntu6.2" }, "to_version": { "source_package_name": "coreutils", "source_package_version": "9.4-3ubuntu6.3", "version": "9.4-3ubuntu6.3" }, "cves": [ { "cve": "CVE-2025-5278", "url": "https://ubuntu.com/security/CVE-2025-5278", "cve_description": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.", "cve_priority": "low", "cve_public_date": "2025-05-27 21:15:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-5278", "url": "https://ubuntu.com/security/CVE-2025-5278", "cve_description": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.", "cve_priority": "low", "cve_public_date": "2025-05-27 21:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: out-of-bounds read in sort", " - debian/patches/CVE-2025-5278.patch: sort: fix buffer under-read in", " src/sort.c, tests/local.mk, tests/sort/sort-field-limit.sh,", " Makefile.in.", " - CVE-2025-5278", "" ], "package": "coreutils", "version": "9.4-3ubuntu6.3", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 25 Aug 2026 11:09:03 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "diffutils", "from_version": { "source_package_name": "diffutils", "source_package_version": "1:3.10-1build1", "version": "1:3.10-1build1" }, "to_version": { "source_package_name": "diffutils", "source_package_version": "1:3.10-1ubuntu0.1", "version": "1:3.10-1ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-53910", "url": "https://ubuntu.com/security/CVE-2026-53910", "cve_description": "diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815  NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.", "cve_priority": "medium", "cve_public_date": "2026-07-22 14:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-53910", "url": "https://ubuntu.com/security/CVE-2026-53910", "cve_description": "diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815  NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.", "cve_priority": "medium", "cve_public_date": "2026-07-22 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Integer Overflow", " - debian/patches/CVE-2026-53910-1.patch: diff3: check for integer overflows", " when reading line numbers from diff in NEWS, THANKS, src/diff3.c.", " - debian/patches/CVE-2026-53910-2.patch: diff3: prevent overflow in line", " offsets in src/diff3.c.", " - CVE-2026-53910", "" ], "package": "diffutils", "version": "1:3.10-1ubuntu0.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 26 Aug 2026 14:15:46 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "fdisk", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "gpgv", "from_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.4", "version": "2.4.4-2ubuntu17.4" }, "to_version": { "source_package_name": "gnupg2", "source_package_version": "2.4.4-2ubuntu17.6", "version": "2.4.4-2ubuntu17.6" }, "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-57062", "url": "https://ubuntu.com/security/CVE-2026-57062", "cve_description": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "cve_priority": "low", "cve_public_date": "2026-06-23 18:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Input Validation", " - debian/patches/CVE-2026-57062.patch: gpgsm: Require a minimum tag length", " for GCM decryption. in sm/decrypt.c.", " - CVE-2026-57062", "" ], "package": "gnupg2", "version": "2.4.4-2ubuntu17.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Wed, 02 Sep 2026 15:38:56 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libattr1", "from_version": { "source_package_name": "attr", "source_package_version": "1:2.5.2-1build1.1", "version": "1:2.5.2-1build1.1" }, "to_version": { "source_package_name": "attr", "source_package_version": "1:2.5.2-1ubuntu0.1", "version": "1:2.5.2-1ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-54371", "url": "https://ubuntu.com/security/CVE-2026-54371", "cve_description": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54371", "url": "https://ubuntu.com/security/CVE-2026-54371", "cve_description": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Symlink Traversal", " - d/p/CVE-2026-54371-01-add-visibility-attribute-header.patch: Add", " visibility attribute header in include/Makemodule.am, include/visibility-", " hidden.h.", " - d/p/CVE-2026-54371-02-add-xattrat-syscall-wrappers.patch: Add xattrat", " syscall wrappers in configure.ac, include/Makemodule.am,", " include/xattrat.h, libmisc/Makemodule.am, libmisc/xattrat.c.", " - d/p/CVE-2026-54371-03-add-xattrat-syscall-backwards-compatibility-", " code.patch: Add xattrat syscall backwards compatibility code in", " include/Makemodule.am, include/xattrat_compat.h, libmisc/Makemodule.am,", " libmisc/getxattrat_compat.c, libmisc/listxattrat_compat.c, libmisc/proc-", " self-fd.c, libmisc/proc-self-fd.h, libmisc/removexattrat_compat.c,", " libmisc/setxattrat_compat.c.", " - d/p/CVE-2026-54371-04-rename-walk_tree-to-old_walk_tree.patch: Rename", " walk_tree to old_walk_tree in include/Makemodule.am,", " include/old_walk_tree.h, libmisc/Makemodule.am, libmisc/old_walk_tree.c,", " tools/getfattr.c.", " - d/p/CVE-2026-54371-05-add-the-new-walk_tree-helper.patch: Add the new", " walk_tree helper in include/Makemodule.am, include/walk_tree.h,", " libmisc/Makemodule.am, libmisc/walk_tree.c.", " - debian/patches/CVE-2026-54371-06-harden-getfattr.patch: harden getfattr in", " man/man1/getfattr.1, tools/getfattr.c, test/root/getfattr.test.", " - d/p/CVE-2026-54371-07-setfattr-multiple-restore-accesses-freed-", " buffer.patch: setfattr: multiple --restore accesses freed buffer in", " tools/setfattr.c.", " - d/p/CVE-2026-54371-08-setfattr-do-not-ignore-no-dereference-after-", " restore.patch: setfattr: Do not ignore --no-dereference after --restore in", " tools/setfattr.c.", " - d/p/CVE-2026-54371-09-add-openat2-syscall-wrapper.patch: Add openat2", " syscall wrapper in configure.ac, include/Makemodule.am, include/openat2.h,", " libmisc/Makemodule.am, libmisc/openat2.c.", " - debian/patches/CVE-2026-54371-10-harden-setfattr-restore.patch: harden", " setfattr --restore in configure.ac, man/man1/setfattr.1,", " test/Makemodule.am, tools/setfattr.c, test/restore.test.", " - CVE-2026-54371", "" ], "package": "attr", "version": "1:2.5.2-1ubuntu0.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Sun, 23 Aug 2026 21:39:46 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblkid1", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libbz2-1.0", "from_version": { "source_package_name": "bzip2", "source_package_version": "1.0.8-5.1build0.1", "version": "1.0.8-5.1build0.1" }, "to_version": { "source_package_name": "bzip2", "source_package_version": "1.0.8-5.1ubuntu0.1", "version": "1.0.8-5.1ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-42250", "url": "https://ubuntu.com/security/CVE-2026-42250", "cve_description": "bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67", "cve_priority": "low", "cve_public_date": "2026-05-28 14:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-42250", "url": "https://ubuntu.com/security/CVE-2026-42250", "cve_description": "bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67", "cve_priority": "low", "cve_public_date": "2026-05-28 14:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: out-of-bounds write", " - debian/patches/CVE-2026-42250.patch: bzip2recover: Make sure to not", " process more than BZ_MAX_HANDLED_BLOCKS in bzip2recover.c.", " - CVE-2026-42250", "" ], "package": "bzip2", "version": "1.0.8-5.1ubuntu0.1", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Shishir Subedi ", "date": "Thu, 27 Aug 2026 09:50:50 +0545" } ], "notes": null, "is_version_downgrade": false }, { "name": "libfdisk1", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libgcrypt20", "from_version": { "source_package_name": "libgcrypt20", "source_package_version": "1.10.3-2ubuntu0.1", "version": "1.10.3-2ubuntu0.1" }, "to_version": { "source_package_name": "libgcrypt20", "source_package_version": "1.10.3-2ubuntu0.2", "version": "1.10.3-2ubuntu0.2" }, "cves": [ { "cve": "CVE-2024-2236", "url": "https://ubuntu.com/security/CVE-2024-2236", "cve_description": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.", "cve_priority": "low", "cve_public_date": "2024-03-06 22:15:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2024-2236", "url": "https://ubuntu.com/security/CVE-2024-2236", "cve_description": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.", "cve_priority": "low", "cve_public_date": "2024-03-06 22:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: timing-based side-channel flaw in RSA implementation", " - debian/patches/CVE-2024-2236-1.patch: rsa: Do not accept invalid PKCS#1.5", " padding when deciphering in cipher/rsa-common.c, src/const-time.h.", " - debian/patches/CVE-2024-2236-2.patch: rsa: Constant time blinding removal", " in cipher/rsa.c, configure.ac, mpi/Makefile.am, mpi/mpi-internal.h,", " mpi/mpi-mul-cs.c, mpi/mpi-mul.c, src/gcrypt-int.h.", " - debian/patches/CVE-2024-2236-3.patch: Constant time conversion of the", " message to the SEXP in cipher/rsa.c, src/const-time.c, src/const-time.h,", " src/sexp.c.", " - debian/patches/CVE-2024-2236-4.patch: rsa: Implement constant-time", " conversion of MPI to string in cipher/rsa-common.c.", " - debian/patches/CVE-2024-2236-5.patch: cipher: Use the constant time", " conversion also for OAEP in cipher/rsa-common.c, cipher/rsa.c.", " - debian/patches/CVE-2024-2236-6.patch: Implement implicit rejection for", " PKCS#1.5 decipher in cipher/pubkey-internal.h, cipher/pubkey-util.c,", " cipher/rsa-common.c, cipher/rsa.c, src/cipher.h, src/const-time.c,", " src/const-time.h, tests/pkcs1v2-v15c.h, tests/pkcs1v2.c.", " - debian/rules: build with --enable-marvin-workaround.", " - Thanks for Red Hat for the patches!", " - CVE-2024-2236", "" ], "package": "libgcrypt20", "version": "1.10.3-2ubuntu0.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 24 Aug 2026 14:06:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libmount1", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libncursesw6", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.1", "version": "6.4+20240113-1ubuntu2.1" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.2", "version": "6.4+20240113-1ubuntu2.2" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.4+20240113-1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libp11-kit0", "from_version": { "source_package_name": "p11-kit", "source_package_version": "0.25.3-4ubuntu2.1", "version": "0.25.3-4ubuntu2.1" }, "to_version": { "source_package_name": "p11-kit", "source_package_version": "0.25.3-4ubuntu2.2", "version": "0.25.3-4ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-18938", "url": "https://ubuntu.com/security/CVE-2026-18938", "cve_description": "A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems.", "cve_priority": "medium", "cve_public_date": "2026-08-07 09:16:00 UTC" }, { "cve": "CVE-2026-13757", "url": "https://ubuntu.com/security/CVE-2026-13757", "cve_description": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.", "cve_priority": "medium", "cve_public_date": "2026-06-29 19:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-18938", "url": "https://ubuntu.com/security/CVE-2026-18938", "cve_description": "A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems.", "cve_priority": "medium", "cve_public_date": "2026-08-07 09:16:00 UTC" }, { "cve": "CVE-2026-13757", "url": "https://ubuntu.com/security/CVE-2026-13757", "cve_description": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.", "cve_priority": "medium", "cve_public_date": "2026-06-29 19:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: integer overflow in nested attribute decoding", " - debian/patches/CVE-2026-18938.patch: guard against overflow when", " decoding nested attributes (32-bit only, heap OOB write, DoS).", " - CVE-2026-18938", " * SECURITY UPDATE: unbounded recursion in RPC attribute parsing", " - debian/patches/CVE-2026-13757.patch: add recursion depth limit into", " RPC attribute parsing (stack exhaustion, DoS).", " - CVE-2026-13757", "" ], "package": "p11-kit", "version": "0.25.3-4ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Leonidas Da Silva Barbosa ", "date": "Mon, 24 Aug 2026 13:57:12 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-modules", "from_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.6", "version": "1.5.3-5ubuntu5.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.7", "version": "1.5.3-5ubuntu5.7" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" }, { "cve": "CVE-2024-10963", "url": "https://ubuntu.com/security/CVE-2024-10963", "cve_description": "A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.", "cve_priority": "medium", "cve_public_date": "2024-11-07 16:15:00 UTC" }, { "cve": "CVE-2025-6020", "url": "https://ubuntu.com/security/CVE-2025-6020", "cve_description": "A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.", "cve_priority": "medium", "cve_public_date": "2025-06-17 13:15:00 UTC" }, { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" }, { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" }, { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" }, { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" }, { "cve": "CVE-2015-3238", "url": "https://ubuntu.com/security/CVE-2015-3238", "cve_description": "The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.", "cve_priority": "low", "cve_public_date": "2015-08-24 14:59:00 UTC" }, { "cve": "CVE-2013-7041", "url": "https://ubuntu.com/security/CVE-2013-7041", "cve_description": "The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack.", "cve_priority": "low", "cve_public_date": "2014-05-08 14:29:00 UTC" }, { "cve": "CVE-2014-2583", "url": "https://ubuntu.com/security/CVE-2014-2583", "cve_description": "Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.", "cve_priority": "low", "cve_public_date": "2014-04-10 20:29:00 UTC" }, { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2010-3853", "url": "https://ubuntu.com/security/CVE-2010-3853", "cve_description": "pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3316", "url": "https://ubuntu.com/security/CVE-2010-3316", "cve_description": "The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pam_xauth PAM check.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3430", "url": "https://ubuntu.com/security/CVE-2010-3430", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3431", "url": "https://ubuntu.com/security/CVE-2010-3431", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3435", "url": "https://ubuntu.com/security/CVE-2010-3435", "cve_description": "The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-0832", "url": "https://ubuntu.com/security/CVE-2010-0832", "cve_description": "pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to \"user file stamps\" and the motd.legal-notice file.", "cve_priority": "high", "cve_public_date": "2010-07-12 16:30:00 UTC" }, { "cve": "CVE-2009-0887", "url": "https://ubuntu.com/security/CVE-2009-0887", "cve_description": "Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.", "cve_priority": "low", "cve_public_date": "2009-03-12 15:20:00 UTC" }, { "cve": "CVE-2005-2977", "url": "https://ubuntu.com/security/CVE-2005-2977", "cve_description": "The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unix_chkpwd, which does not log failed guesses or delay its responses.", "cve_priority": "medium", "cve_public_date": "2005-11-01 12:47:00 UTC" } ], "launchpad_bugs_fixed": [ 2164901, 2087827, 2064360, 2064350, 2059859, 2055453, 1953201, 1953201, 1916509, 1860826, 772121, 1860826, 1935972, 1927796, 1659719, 1856703, 1855092, 1192719, 1192719, 1538284, 1081323, 1571864, 1487103, 1558114, 557013, 1160288, 1126404, 110287, 955032, 1095887, 937005, 110287, 871083, 744944, 871943, 805423, 745004, 882794, 871943, 805423, 874469, 874565, 794531, 253096, 746655, 391761, 745532, 663090, 744944, 733501, 297408, 588547, 562566, 552175, 513955, 356766, 424566, 287715, 410171, 399071, 399071, 314222, 303515, 305882, 303515, 305882, 303515, 305882, 294513, 295135, 295441, 65244, 256238, 291091, 272232, 270328, 260371, 260122, 259867, 216990, 216990, 245786, 9224, 64064, 216990, 141309, 187822, 139075, 64064, 216990, 208419, 198714, 187822, 139075, 141309, 139065, 141309, 139075, 43169, 14505, 80431 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:35 -0400" }, { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411-pre1.patch: libpam: add helper to compare", " strings in constant time in libpam/include/pam_inline.h.", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 09:44:01 -0400" }, { "cves": [ { "cve": "CVE-2024-10963", "url": "https://ubuntu.com/security/CVE-2024-10963", "cve_description": "A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.", "cve_priority": "medium", "cve_public_date": "2024-11-07 16:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: pam_access hostname confusion", " - debian/patches/CVE-2024-10963.patch: add \"nodns\" option to disallow", " resolving of tokens as hostname in", " modules/pam_access/access.conf.5.xml,", " modules/pam_access/pam_access.8.xml,", " modules/pam_access/pam_access.c.", " - CVE-2024-10963", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.5", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 15 Sep 2025 08:37:15 -0400" }, { "cves": [ { "cve": "CVE-2025-6020", "url": "https://ubuntu.com/security/CVE-2025-6020", "cve_description": "A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.", "cve_priority": "medium", "cve_public_date": "2025-06-17 13:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: privilege escalation via pam_namespace", " - debian/patches/pam_namespace_170.patch: sync pam_namespace module to", " version 1.7.0.", " - debian/patches/pam_namespace_post170-*.patch: add post-1.7.0 changes", " from upstream git tree.", " - debian/patches/pam_namespace_revert_abi.patch: revert ABI change to", " prevent unintended issues in running daemons.", " - debian/patches/CVE-2025-6020-1.patch: fix potential privilege", " escalation.", " - debian/patches/CVE-2025-6020-2.patch: add flags to indicate path", " safety.", " - debian/patches/CVE-2025-6020-3.patch: secure_opendir: do not look at", " the group ownership.", " - debian/patches/pam_namespace_o_directory.patch: removed, included in", " patch cluster above.", " - CVE-2025-6020", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.4", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 12 Jun 2025 10:45:28 -0400" }, { "cves": [], "log": [ "", " * d/p/031_pam_include: fix loading from /usr/lib/pam.d (LP: #2087827)", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2087827 ], "author": "Simon Chopin ", "date": "Mon, 26 May 2025 16:34:46 +0200" }, { "cves": [], "log": [ "", " [ Sam Hartman ]", " * Correct Build depends for docbook5 (LP: #2064360)", " * Depend on libdb-dev again, bringing back pam_userdb (LP: #2064350)", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2064360, 2064350 ], "author": "Dan Bungert ", "date": "Thu, 02 May 2024 16:20:13 -0600" }, { "cves": [], "log": [ "", " * d/p/pam_env-remove-deprecation-notice-for-user_readenv.patch: drop", " deprecation warning about user_readenv from pam_env (LP: #2059859)", "" ], "package": "pam", "version": "1.5.3-5ubuntu5", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2059859 ], "author": "Andreas Hasenack ", "date": "Wed, 10 Apr 2024 16:19:22 -0300" }, { "cves": [ { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" } ], "log": [ "", " * No-change rebuild for CVE-2024-3094", "" ], "package": "pam", "version": "1.5.3-5ubuntu4", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 31 Mar 2024 00:03:23 +0000" }, { "cves": [], "log": [ "", " * No-change rebuild against libdb5.3t64", "" ], "package": "pam", "version": "1.5.3-5ubuntu3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 02 Mar 2024 20:36:06 +0000" }, { "cves": [], "log": [ "", " * Fix FTBFS when built with -Werror=implicit-function-declaration", " (LP: #2055453)", "" ], "package": "pam", "version": "1.5.3-5ubuntu2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2055453 ], "author": "Dan Bungert ", "date": "Thu, 29 Feb 2024 11:53:08 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager", " when there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", "" ], "package": "pam", "version": "1.5.3-5ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Dan Bungert ", "date": "Thu, 29 Feb 2024 10:25:41 -0700" }, { "cves": [], "log": [ "", " * Revert renaming libpam0g to libpam0t64 for time_t transition: apt", " sometimes removes libpam0g rather than simply letting libpam0t64", " replace libpam0g (and deconfiguring libpam0g), leaving a system where", " essential packages are broken, Closes: #1065017", " * Since libpam0t64 is going away, we do not need dpkg-diversions for it.", " * As a consequence libpam_misc has an ABI break without a package name", " change. We believe nothing in the archive depends on this ABI, and at", " least until we come up with a better solution this is the least bad option.", " * For now remove libdb-dev so that libdb-dev can undergo time_t", " transition. That means this version of pam does not include", " pam_userdb, which makes pam unsuitable for release. ", " * Replace/break libpam0t64", "" ], "package": "pam", "version": "1.5.3-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 29 Feb 2024 09:46:54 -0700" }, { "cves": [ { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" } ], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0t64.postinst: only ask questions during update-manager", " when there are non-default services running.", " - debian/libpam0t64.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " * Dropped changes, included in Debian:", " - SECURITY UPDATE: pam_namespace local denial of service", " - debian/patches/CVE-2024-22365.patch: use O_DIRECTORY to", " prevent local DoS situations in modules/pam_namespace/pam_namespace.c.", " - CVE-2024-22365", " - Install into /usr/{lib,sbin} instead of /{lib,sbin}. Assumes", " usrmerge aliasing symlinks are in place since bookworm to keep", " compatibility with PAM modules still installing into /lib.", " (DEP17 M2) (Closes: #1060160).", " - Mitigate /usr-move file loss. (Closes: #1062802)", " - Update lintian override for setgid binary.", "" ], "package": "pam", "version": "1.5.3-4ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Dan Bungert ", "date": "Wed, 28 Feb 2024 21:07:18 -0700" }, { "cves": [], "log": [ "", " * Upload to unstable", " * Revert 1.5.2-9.1 changes to debian/rules now that we use", " debian/patches properly.", "" ], "package": "pam", "version": "1.5.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 27 Feb 2024 21:30:52 -0700" }, { "cves": [], "log": [ "", " [ Helmut Grohne ]", " * Mitigate /usr-move file loss. (Closes: #1062802)", "" ], "package": "pam", "version": "1.5.3-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Helmut Grohne ", "date": "Sat, 03 Feb 2024 12:18:52 +0100" }, { "cves": [ { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" } ], "log": [ "", " * Rename libpam0g to libpamt64 for time_t transition", " * New Swedish Translations, Thanks Martin Bagge / brother, Closes: #1057775", " * pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS", " situations (CVE-2024-22365) (Closes: #1061097)", "" ], "package": "pam", "version": "1.5.3-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 02 Feb 2024 11:27:45 -0700" }, { "cves": [], "log": [ "", " [ Sam Hartman ]", " * New upstream version", " * Since we no longer build with NIS support, drop Debian patches related", " to NIS", " [ Debian Janitor]", " * Update lintian override info to new format:", " + debian/libpam-runtime.lintian-overrides: line 5, 7, 9-13", " + debian/libpam-modules.lintian-overrides: line 5-10, 14", " * Trim trailing whitespace.", " * Move source package lintian overrides to debian/source.", " * Update renamed lintian tag names in lintian overrides.", " * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository-Browse.", " * Drop unnecessary dependency on dh-autoreconf.", " * Update standards version to 4.6.2, no changes needed.", "", " [ Andreas Henriksson ]", " * debian/rules: use --enable-usergroups configure flag (Closes: #583958)", " * Use pam_umask.so in common-session{-noninteractive} (Closes: #711104)", "", " [ Debian Janitor ]", " * Apply multi-arch hints. + libpam-doc: Add Multi-Arch: foreign.", "", " [ Sam Hartman ]", " * Drop NIS patches and rearrange other patches.", " * Update patch to move pam manpage to section 7: docbook tools now take", " the man page output name from the xml so we need to update the", " Makefile. ", " * Now PAM.7 is actually installed as pam.7 so update packaging", " * pam-auth-update: Session-Interactive-Only set to anything other than", " yes counts as undefined/no, thanks Lucas Nussbaum, Closes: #982309", " * Use logind instead of utmp in pam_issue and pam_timestamp; utmp is not", " y2038-safe.", "", " [ Sam Hartman ]", " * Add new common-session-* templates to pam-auth-update.", "", " [ Chris Hofstaedtler ]", " * Install into /usr/{lib,sbin} instead of /{lib,sbin}. Assumes", " usrmerge aliasing symlinks are in place since bookworm to keep", " compatibility with PAM modules still installing into /lib.", " (DEP17 M2) (Closes: #1060160).", " * Update lintian override for setgid binary.", " " ], "package": "pam", "version": "1.5.3-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 15 Jan 2024 15:45:50 -0700" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Install into /usr/{lib,sbin} instead of /{lib,sbin}. Assumes", " usrmerge aliasing symlinks are in place since bookworm to keep", " compatibility with PAM modules still installing into /lib.", " (DEP17 M2) (Closes: #1060160).", " * Update lintian override for setgid binary.", "", " [ Helmut Grohne ]", " * Mitigate /usr-move file loss. (Closes: #1062802)", "" ], "package": "pam", "version": "1.5.2-9.1ubuntu3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Thu, 22 Feb 2024 13:24:31 +0100" }, { "cves": [ { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: pam_namespace local denial of service", " - debian/patches-applied/CVE-2024-22365.patch: use O_DIRECTORY to", " prevent local DoS situations in modules/pam_namespace/pam_namespace.c.", " - CVE-2024-22365", "" ], "package": "pam", "version": "1.5.2-9.1ubuntu2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 17 Jan 2024 12:28:44 -0500" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " * debian/update-motd.5: fix a typo; thanks to David", " Collantes .", "" ], "package": "pam", "version": "1.5.2-9.1ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 20 Nov 2023 06:39:20 -0800" }, { "cves": [], "log": [ "", " * Non-maintainer upload acked by Sam Hartman.", " * Really fix quilt-related FTBFS: (Closes: #1054505)", " pam is a 3.0 (quilt) source package and has a .pc directory after unpack", " despite having no debian/patches. Even when setting QUILT_PATCH_DIR or", " QUILT_PATCHES, quilt is now mislead to using the non-existent", " debian/patches and this makes dh_quilt_unpatch fail, so we delete that", " directory unless it corresponds to the real debian/patches-applied that we", " want to be used.", "" ], "package": "pam", "version": "1.5.2-9.1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Helmut Grohne ", "date": "Tue, 24 Oct 2023 19:38:53 +0200" }, { "cves": [], "log": [ "", " * Revert 1.5.2-8 upload; as far as I can tell the change is incorrect,", " Closes: #1054493", " " ], "package": "pam", "version": "1.5.2-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 24 Oct 2023 09:19:43 -0600" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * Drop reference to stale package version in libpam-modules.postinst;", " thanks, Gioele Barabucci .", "", " [ Sam Hartman ]", " * Fix pam-auth-update --disable logic error, Closes: #1039873", " * Set myself as maintainer; thanks Steve for past and future work.", " * Fix watch file, thanks Daniel Lewart, Closes: #1040310", " * Install upstream NEWS file as main upstream changelog; detailed", " CHANGELOG only in libpam-doc, Closes: #1040315", " * Updated Turkish Debconf translations, Thanks Atila KOÇ, Closes: #1029002", "" ], "package": "pam", "version": "1.5.2-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 16 Aug 2023 17:22:53 -0600" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", "" ], "package": "pam", "version": "1.5.2-6ubuntu1", "urgency": "medium", "distributions": "mantic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 15 May 2023 15:17:53 -0700" }, { "cves": [], "log": [ "", " * Update debian/copyright, Thanks Bastian Germann, Closes: #460232", " * When pam-auth-update is called with --root, use", " /usr/share/pam-configs from the root not from the host system, Thanks", " Johannes Schauer Marin Rodrigues, Closes: #1022952", " * Build-depend on libcrypt-dev, Closes: #1024645", " * Add pam-auth-udpate --disable, Closes: #1004000", " * Add autopkgtests", "" ], "package": "pam", "version": "1.5.2-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 03 Jan 2023 13:15:23 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable; remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", "" ], "package": "pam", "version": "1.5.2-5ubuntu1", "urgency": "medium", "distributions": "lunar", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Nov 2022 12:53:39 -0800" }, { "cves": [], "log": [ "", " * pam_namespace_helper manpage *wasn't* missing, it was just being", " wrongly shipped in libpam-modules instead - so complete the moving", " of the manpage to the libpam-modules-bin where it belongs with the", " binary. Really Closes: #1021336.", "" ], "package": "pam", "version": "1.5.2-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 06 Oct 2022 18:56:06 +0000" }, { "cves": [], "log": [ "", " * pam_namespace_helper manpage was missing, but namespace.conf.5 was", " already shipped in libpam-modules. Leave it there. Closes: #1021336.", "" ], "package": "pam", "version": "1.5.2-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 06 Oct 2022 17:28:36 +0000" }, { "cves": [], "log": [ "", " * Add missing manpages for pam_namespace which for some reason don't get", " installed by the upstream rules", " * Drop obsolete upgrade code from maintainer scripts which is no longer", " used", " * Drop manual multiarch file handling in favor of dh-exec.", " * No special-case needed for pam_modutil_sanitize_helper_fds in symbols", " file, it's covered by the existing globs.", " * debian/local/Debian-PAM-MiniPolicy: drop references to ancient", " package versions. Thanks, Marc Haber.", " * Support DPKG_ROOT in the postinst scripts. Closes: #993161.", " Thanks, Johannes Schauer Marin Rodrigues.", " * Further proof libpam-runtime postinst for DPKG_ROOT just in case.", "" ], "package": "pam", "version": "1.5.2-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 06 Oct 2022 04:05:02 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " * Dropped changes, no longer needed:", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", " * Refresh patches.", " * debian/patches-applied/extrausers.patch: update for upstream changes.", "" ], "package": "pam", "version": "1.5.2-2ubuntu1", "urgency": "medium", "distributions": "kinetic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Aug 2022 18:16:30 +0000" }, { "cves": [], "log": [ "", " * Pass --with-systemdunitdir=/usr/lib/systemd/system for consistent", " builds whether we are or aren't building in an environment with systemd", " present.", " * Install the pam_namespace.service unit in the libpam-modules-bin", " package.", "" ], "package": "pam", "version": "1.5.2-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Aug 2022 16:47:57 +0000" }, { "cves": [], "log": [ "", " * New upstream release.", " - fixes compatibility with libpam-systemd. Closes: #1017467.", " - fixes bashisms in configure.ac. Closes: #998361.", " * Refresh patches.", " * Drop patches included or obsoleted upstream:", " - debian/patches-applied/pam_unix_fix_sgid_shadow_auth.patch", " - debian/patches-applied/pam_unix_initialize_daysleft", " - debian/patches-applied/pam_faillock_create_directory", " - debian/patches-applied/pam_unix_avoid_checksalt", " - debian/patches-applied/pam_env-allow-environment-files-without-EOL-at-EOF.patch", " * Drop libpam-cracklib which has been obsoleted upstream.", " * Add pkgconfig .pc files to libpam0g-dev. Closes: #1012688.", " * Update .symbols file.", " * Updated Romanian debconf translation, thanks Andrei Popescu, Closes:", " #986416", " * Drop versioning of quilt build-dependency to quiet lintian, since the", " version is satisfied by oldoldoldstable.", " * Drop unused build-build-dependency on bzip2.", " * Adjust lintian overrides for latest lintian syntax.", " * Update Standards-Version.", " * Bump debhelper compat to 13.", " * debian/not-installed: document upstream files that aren't used.", " * Override incorrect lintian warning about use of dpkg database.", " * Override lintian warning for PAM module manpages being in section 8", " * Override lintian warning for unused debconf templates", " * Install additional upstream manpages: faillock(8), environment(5),", " pwhistory_helper(8)", " * Install additional helpers in libpam-modules-bin: pam_namespace_helper,", " pwhistory_helper", " * Fix wrong syntax in symbols file", "" ], "package": "pam", "version": "1.5.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Aug 2022 07:27:16 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", "" ], "package": "pam", "version": "1.4.0-13ubuntu1", "urgency": "medium", "distributions": "kinetic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 26 Apr 2022 11:10:38 -0700" }, { "cves": [], "log": [ "", " * Don't build with NIS support. This is only used for password changes on", " NIS systems, and is pulling a large dependency chain into the Essential", " package set which is not justifiable.", "" ], "package": "pam", "version": "1.4.0-13", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 25 Apr 2022 16:12:04 -0700" }, { "cves": [], "log": [ "", " * Drop Recommends on update-motd which is no longer used and is not being", " maintained.", "" ], "package": "pam", "version": "1.4.0-11ubuntu2", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 23 Mar 2022 18:43:24 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", " * Dropped changes, included in Debian:", " - d/p/pam_env-allow-environment-files-without-EOL-at-EOF.patch:", " Allow /etc/environment files without EOL at EOF.", "" ], "package": "pam", "version": "1.4.0-11ubuntu1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Feb 2022 08:51:50 -0800" }, { "cves": [], "log": [ "", " * Whitespace fixes in debconf templates.", "", " [ Sergio Durigan Junior ]", " * d/p/pam_env-allow-environment-files-without-EOL-at-EOF.patch:", " Allow /etc/environment files without EOL at EOF. In other words,", " allow files without a newline at the end. (LP: #1953201)", "" ], "package": "pam", "version": "1.4.0-11", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 1953201 ], "author": "Steve Langasek ", "date": "Mon, 06 Dec 2021 11:11:31 -0800" }, { "cves": [], "log": [ "", " [ Sergio Durigan Junior ]", " * d/p/pam_env-allow-environment-files-without-EOL-at-EOF.patch:", " Allow /etc/environment files without EOL at EOF. In other words,", " allow files without a newline at the end. (LP: #1953201)", "" ], "package": "pam", "version": "1.4.0-10ubuntu2", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1953201 ], "author": "Steve Langasek ", "date": "Mon, 06 Dec 2021 11:05:28 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable (LP: #1916509). Remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", " * Dropped changes, obsoleted:", " - pam_motd: Export MOTD_SHOWN=pam after showing MOTD", " - Return only PAM_IGNORE or error from pam_motd", " - Fix patches to fix FTBFS", " - Backport pam_faillock module from pam 1.4.0", " - debian/patches-applied/nullok_secure-compat.patch: Support", " nullok_secure as a deprecated alias for nullok.", " - debian/pam-configs/unix: use nullok, not nullok_secure.", " * Patches:", " - d/p/pam_motd-legal-notice: refreshed", " - Refreshed d/p/pam_umask_usergroups_from_login.defs.patch to use", " pam_modutil_search_key instead of our own hand-rolled version", " - d/p/extrausers.patch: Refreshed the patch and fixed the", " HAVE_LIBSELINUX conditional removed upstream.", " * d/local/pam-auth-update: refreshed the md5sum for debian/local/common-session", "" ], "package": "pam", "version": "1.4.0-10ubuntu1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1916509 ], "author": "Simon Chopin ", "date": "Tue, 26 Oct 2021 10:49:14 +0200" }, { "cves": [], "log": [ "", " * Fix syntax error in libpam0g.postinst when a systemd unit fails,", " Closes: #992538", " * Include upstream patch not to use crypt_checksalt; without this", " passwords set prior to bullseye were considered expired, Closes:", " #992848", " * Support DPKG_ROOT for pam-auth-update, thanks Johannes 'josch' Schauer", " Closes: #983427", "", "" ], "package": "pam", "version": "1.4.0-10", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 26 Aug 2021 13:43:23 -0600" }, { "cves": [], "log": [ "", " * Revert prefer the multiarch path from 1.4.0-8: It turns out that", " Debian uses DEFAULT_MODULE_PATH and _PAM_ISA in the opposite meaning", " of upstream. If I had read the patch header of", " patches-applied/lib_security_multiarch_compat more closely I would", " have noticed this. The effect of 1.4.0-9 is what is stated in the", " 1.4.0-8 changelog: we prefer multiarch paths, but the original patch", " did that.", " * I did test this in 1.4.0-8, but my test design was flawed. I placed a", " invalid shared object in /lib/security and confirmed it did not shadow", " an object in /lib/x86_64-linux-gnu/security. However I realized", " shortly after releasing 1.4.0-8 that a valid shared object in", " /lib/security will shadow one in the multiarch path.", "" ], "package": "pam", "version": "1.4.0-9", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 09 Jul 2021 10:55:02 -0600" }, { "cves": [], "log": [ "", " [ Hideki Yamane ]", " * debian/patches-applied/lib_security_multiarch_compat", " - Fix regression introduced in 1.4.0-1: search both /lib/security and", " /lib/[multiarch_tripple]/security/, Closes: #990790", "", " [ Sam Hartman ]", " * Reword changelog", " * Prefer the multiarch path (_PAM_ISA) to the non-multiarch path.", " That's different than buster, but guarantees everything already", " working in bullseye will continue to work and also guarantees that", " when multiarch modules are available we use them.", "" ], "package": "pam", "version": "1.4.0-8", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Hideki Yamane ", "date": "Tue, 06 Jul 2021 22:09:15 +0900" }, { "cves": [], "log": [ "", " * Updated portuguese debconf translation, thanks Pedro Ribeiro, Closes:", " #983594", " * Updated Simplified Chinese Translations, thanks Boyuan Yang", " * Updated Bulgarian Translation, Thanks Damyan Ivanov", " * Updated translation from the Slovak team, thanks Ladislav Michnovič,", " Closes: #984891", " * Updated Catalan translation, thanks Alex Muntada, Closes: #984568", " * Updated Brazilian Portuguese translation, Thanks Adriano Rafael Gomes,", " Closes: #984656", " * French Debconf translations, thanks Jean-Pierre Giraud , Closes:", " #984910", " * Updated russian Debconf translations, thanks Алексей Шилин, Closes:", " #984878", " * Updated Dutch debconf templates, Thanks Frans Spiesschaert, Closes:", " #984823", " * Updated German Debconf translations, Thanks Sven Joachim", " * Code review fixes for the fix to #982295, thanks Mark Hindley", " - Actually set service to $1 rather than happening to use a variable", " of the same name in enclosing scope", " - Remove dead code setting idl when not used", " * Code review fixes to the fix for #982530, thanks Martin Schurz", " - Include '-' in the file matching regexp so we search", " /etc/pam.d/common-* for uses of pam_tally. The profile check will", " catch this unless the user has overwridden the configuration", " - Fix capitalization of pam_Tally in debconf description", "", "" ], "package": "pam", "version": "1.4.0-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 15 Mar 2021 15:01:55 -0400" }, { "cves": [], "log": [ "", " * Clearly it's been too long since I've done debconf; run", " debconf-updatepo so the translations will show up as needing", " translating.", "" ], "package": "pam", "version": "1.4.0-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 26 Feb 2021 10:48:23 -0500" }, { "cves": [], "log": [ "", " * Remove profiles containing pam_tally or pam_tally2 since we no longer", " build them.", " * Also, fail to permit profiles to be selected that include pam_tally", " once the new pam-auth-update is installed", " * Check for any user-added references to pam_tally and halt the upgrade,", " Closes: #982530", " * Handle services with systemd units but no init scripts, Closes: #982295", " * Register md5sum for new common-password template, Closes: #982898", " * After reading pam-auth-update source, I agree with Lucas Nussbaum", " that common-session is intended only for interactive sessions.", " Otherwise pam-auth-update should not duplicate module configurations", " between common-session-noninteractive and common-session, so update", " the documentation, Closes: #982297", "" ], "package": "pam", "version": "1.4.0-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 25 Feb 2021 15:48:22 -0500" }, { "cves": [], "log": [ "", " * Document in README.source how to avoid multi-arch problems with documentation, Closes: #851650", " * Update header to common-password talking about sha512", " * The fix for #977648 incorrectly assumed how prerm scripts are called; update.", "" ], "package": "pam", "version": "1.4.0-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 03 Feb 2021 12:35:12 -0500" }, { "cves": [], "log": [ "", " [ Josh Triplett ]", " * libpam-runtime.postrm: Remove session-noninteractive files on purge,", " Closes: #978601", "", " [ Sam Hartman ]", " * patches-applied/pam_mkhomedir_stat_before_opendir: Stat the skeleton", " directory before opendir, Closes: #834589", " * libpam-modules.install: Install pam_faillock binaries, Closes: #981092", " * debian/patches-applied/pam_unix_initialize_daysleft : Initialize days before password expire, Closes: #980285", " * pam-configs/unix: Default to yescript rather than sha512. From a theoretical security standpoint, it looks like yescript has similar security properties, assuming (as we typically do in the crypto protocol community) that sha256 is still reasonable. However, in terms of practical resistant to password cracking, particularly in terms of valuing space complexity as well as time complexity, yescript is superior, Closes: #978553", " * No infinite loop on purge of libpam-runtime, Closes: #977648", " * patches-applied/pam_faillock_create_directory: create /run/faillock when needed.", "", "" ], "package": "pam", "version": "1.4.0-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 01 Feb 2021 15:27:08 -0500" }, { "cves": [], "log": [ "", " * Restart services on upgrade to 1.4.0. Closes: #978555.", "" ], "package": "pam", "version": "1.4.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 28 Dec 2020 19:20:38 -0800" }, { "cves": [], "log": [ "", " * New upstream release. Closes: #948188.", " - Stop using obsoleted selinux headers. Closes: #956355.", " - Continue building pam_cracklib, which is deprecated upstream;", " the replacement, pam_passwdqc, is packaged separately.", " - Update symbols file for new symbols.", " - Refresh lintian overrides for changes to available pam modules.", " * Drop patches to implement \"nullok_secure\" option for pam_unix.", " Closes: #674857, #936071, LP: #1860826.", " * debian/patches-applied/cve-2010-4708.patch: drop, applied upstream.", " * debian/patches-applied/nullok_secure-compat.patch: Support", " nullok_secure as a deprecated alias for nullok.", " * debian/pam-configs/unix: use nullok, not nullok_secure.", " * Drop pam_tally and pam_tally2 modules, which have been deprecated", " upstream in favor of pam_faillock. Closes: #569746, LP: #772121.", " * Add hardening+=bindnow to build options, per lintian.", "" ], "package": "pam", "version": "1.4.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 1860826, 772121 ], "author": "Steve Langasek ", "date": "Mon, 28 Dec 2020 06:05:13 +0000" }, { "cves": [], "log": [ "", " * extrausers.patch: update for compatibility with the removal of", " nullok_secure.", "" ], "package": "pam", "version": "1.3.1-5ubuntu11", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 15 Sep 2021 22:39:58 -0700" }, { "cves": [], "log": [ "", " * Fix up the nullok_secure-compat.patch to apply properly on 1.3.1.", "" ], "package": "pam", "version": "1.3.1-5ubuntu10", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 15 Sep 2021 18:28:12 -0700" }, { "cves": [], "log": [ "", " * Correctly document current VCS in debian/control.", " * Drop patches to implement \"nullok_secure\" option for pam_unix.", " Closes: #674857, #936071, LP: #1860826.", " * debian/patches-applied/nullok_secure-compat.patch: Support", " nullok_secure as a deprecated alias for nullok.", " * debian/pam-configs/unix: use nullok, not nullok_secure.", "" ], "package": "pam", "version": "1.3.1-5ubuntu9", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1860826 ], "author": "Steve Langasek ", "date": "Wed, 15 Sep 2021 18:18:19 -0700" }, { "cves": [], "log": [ "", " * Disable custom daemon restart detection code if needrestart is available", " (LP: #1935972)", "" ], "package": "pam", "version": "1.3.1-5ubuntu8", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1935972 ], "author": "Simon Chopin ", "date": "Tue, 13 Jul 2021 10:28:04 +0200" }, { "cves": [], "log": [ "", " * Backport pam_faillock module from pam 1.4.0 (LP: #1927796)", " - debian/patches-applied/add_pam_faillock.patch: add module.", " - debian/patches-applied/pam_faillock_create_directory: create dir", " before creating file in modules/pam_faillock/faillock.c.", " - debian/rules: set execute permissions on pam_faillock test.", " - debian/libpam-modules-bin.install: install faillock binary and man", " page.", "" ], "package": "pam", "version": "1.3.1-5ubuntu7", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1927796 ], "author": "Richard Maciel Costa ", "date": "Thu, 08 Apr 2021 07:06:27 -0400" }, { "cves": [], "log": [ "", " * Fix FTBFS with selinux/flask.h", " - debian/patches-applied/selinux_flask_ftbfs.patch: Fix FTBFS due to", " deprecated selinux/flask.h", "" ], "package": "pam", "version": "1.3.1-5ubuntu6", "urgency": "medium", "distributions": "groovy", "launchpad_bugs_fixed": [], "author": "Mike Salvatore ", "date": "Wed, 05 Aug 2020 21:10:51 -0400" }, { "cves": [], "log": [ "", " * debian/libpam-modules.postinst: Add /snap/bin to $PATH in", " /etc/environment. (LP: #1659719)", "" ], "package": "pam", "version": "1.3.1-5ubuntu5", "urgency": "medium", "distributions": "groovy", "launchpad_bugs_fixed": [ 1659719 ], "author": "Michael Hudson-Doyle ", "date": "Fri, 10 Jul 2020 08:35:49 +1200" }, { "cves": [], "log": [ "", " * Return only PAM_IGNORE or error from pam_motd (LP: #1856703)", "" ], "package": "pam", "version": "1.3.1-5ubuntu4", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [ 1856703 ], "author": "Balint Reczey ", "date": "Tue, 17 Dec 2019 17:41:40 +0100" }, { "cves": [], "log": [ "", " * Fix patches to fix FTBFS", "" ], "package": "pam", "version": "1.3.1-5ubuntu3", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [], "author": "Balint Reczey ", "date": "Thu, 05 Dec 2019 13:18:35 +0100" }, { "cves": [], "log": [ "", " * pam_motd: Export MOTD_SHOWN=pam after showing MOTD (LP: #1855092)", "" ], "package": "pam", "version": "1.3.1-5ubuntu2", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [ 1855092 ], "author": "Balint Reczey ", "date": "Wed, 04 Dec 2019 12:23:57 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", "" ], "package": "pam", "version": "1.3.1-5ubuntu1", "urgency": "medium", "distributions": "disco", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 23:16:59 -0800" }, { "cves": [], "log": [ "", " * xdm restart check was inverted in the prior upload; turn it the right", " way around", " * Correctly display the notification when a manual DM restart is needed.", "" ], "package": "pam", "version": "1.3.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 14 Feb 2019 07:08:47 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " * Dropped changes, included in Debian:", " - Fix the name of the samba service being restarted", " - Fix debian/patches-applied/update-motd to apply the correct changes", " to the README", "" ], "package": "pam", "version": "1.3.1-4ubuntu1", "urgency": "medium", "distributions": "disco", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 15:43:33 -0800" }, { "cves": [], "log": [ "", " * Fix the name of the samba services to be restarted on upgrade.", "" ], "package": "pam", "version": "1.3.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 23:39:03 +0000" }, { "cves": [], "log": [ "", " * Fix debian/patches-applied/update-motd to apply the correct changes", " to the README (should be forwarded to Debian)", " * debian/libpam-modules.lintian-overrides: update for the current lintian", " warning given for DSOs with no dependencies.", " * debian/rules: set $DEB_HOST_MULTIARCH only if unset.", " * debian/source.lintian-overrides: update for the current quilt warnings.", " * debian/control: drop redundant priority fields.", " * Standards-Version 4.3.0.", " * Restore lintian overrides for hardening false-positives.", " * debian/libpam0g.postinst: update the xdm restart handling to cope with", " changes to what xdm writes to utmp. Closes: #922239.", "" ], "package": "pam", "version": "1.3.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 20:41:46 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " * Dropped changes, included in Debian:", " - pam-configs/mkhomedir: Added a config for pam_mkhomedir, disabled", " by default.", " * Dropped changes, obsoleted:", " - debian/patches-applied/cve-2015-3238.patch: removed manpage changes", " so they don't get regenerated during build and cause a multiarch", " installation issue.", " * Fix the name of the samba service being restarted, which was now", " differently wrong in each of Debian and Ubuntu.", " * Update extrausers.patch for changes in the upstream build system.", " * Fix debian/patches-applied/update-motd to apply the correct changes", " to the README (should be forwarded to Debian)", " * debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include changes to the README.", " * Add lintian override for pam_extrausers_chkpwd", "" ], "package": "pam", "version": "1.3.1-2ubuntu1", "urgency": "medium", "distributions": "disco", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 06:07:03 +0000" }, { "cves": [], "log": [ "", " * Bump the version check for service restarts to 1.3.1-2.", " Closes: #922178.", " * Drop hard-coded pre-dep on libpam0g, now superseded by shlibdeps.", "" ], "package": "pam", "version": "1.3.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2019 23:52:04 +0000" }, { "cves": [], "log": [ "", " * New upstream release. Closes: #821408.", " - Don't try to close an excessive number of fds when we have a high", " ulimit. Closes: #890524.", " - Clarify pam_access docs regarding handling of daemons and X sessions.", " Closes: #762110.", " - Fix handling of rhost and tty fields in pam_succeed_if.", " Closes: #889910.", " - Fix wrong documentation of pam_umask module behavior.", " Closes: #825782.", " * Refresh patches.", " * Drop patches included or obsoleted upstream:", " - debian/patches-applied/README-rebuild", " - debian/patches-applied/pam-loginuid-in-containers", " - debian/patches-applied/cve-2013-7041.patch", " - debian/patches-applied/cve-2014-2583.patch", " - debian/patches-applied/cve-2015-3238.patch", " - debian/patches-applied/pam_namespace_fix_bashism.patch", " * Drop unused lintian overrides.", " * Fix lintian warnings; thanks to Andreas Henriksson ", " and Florian Vessaz ", " * Switch source package to 3.0 (quilt) to consume upstream .tar.xz.", " * Update debian/watch.", "", " [ Andreas Henriksson ]", " * Update debian/libpam0g.symbols", " * debian/patches-applied/fix-autoreconf.patch: Do not override user", " variables in Makefile.am", "" ], "package": "pam", "version": "1.3.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2019 07:38:11 +0000" }, { "cves": [], "log": [ "", " * Acknowledge various NMUs; thanks to the various folks who have helped", " keep this package in good condition.", " * debian/control: update VCS headers to point to git (temporarily under", " my personal salsa namespace, until I get around to restoring team", " setup).", " * Actually remove Roger Leigh from uploaders (change not included in", " previous upload). Thanks Roger for your contributions to Debian!", " * Use DEB_BUILD_PROFILES instead of the obsolete DEB_BUILD_PROFILE.", " Closes: #907492.", " * Don't include changes to autogenerated files in patches.", " * Use LC_ALL=C.UTF-8, not LC_ALL=C, when generating documentation.", " * Consistently include documentation changes in patches, for clean source", " package.", " * debian/patches-applied/README-rebuild: rebuild README files with", " current docs toolchain.", "" ], "package": "pam", "version": "1.1.8-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 09 Jan 2019 00:29:55 +0000" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Set Rules-Requires-Root to binary-targets as pam relies on", " chgrp in debian/rules.", " * Update pam-auth-update to detect write errors and properly", " fail when that happens. (Closes: #880501)", " * Remove Roger Leigh from uploaders as he has restired from", " Debian. (Closes: #869348)", " * Reduce priority of libpam0g to optional.", " * Rebuild with a recent version of dpkg-source, which ensures", " that the Build-Depends are correct in the .dsc file.", " (Closes: #890602)", " * Apply patch from Felix Lechner to make pam-auth-update ignore", " editor backup files. (Closes: #519361)", " * Apply update to Brazilian Portuguese translations of the", " debconf templates. Thanks to Adriano Rafael Gomes.", " (Closes: #799417)", "" ], "package": "pam", "version": "1.1.8-3.8", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Niels Thykier ", "date": "Sat, 11 Aug 2018 15:31:24 +0000" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * libpam-modules: Added a config for pam_mkhomedir, disabled by default.", " (Closes: #568577)", " * pam-auth-update: Add support for --enable option which is useful for", " enabling non-default configs without prompting the admin. (LP: #1192719)", "" ], "package": "pam", "version": "1.1.8-3.7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 1192719 ], "author": "Timo Aaltonen ", "date": "Fri, 02 Feb 2018 16:57:43 +0200" }, { "cves": [], "log": [ "", " * pam-auth-update: Add support for --enable option which is useful for", " enabling non-default configs without asking the admin. (LP:", " #1192719)", "" ], "package": "pam", "version": "1.1.8-3.6ubuntu2", "urgency": "medium", "distributions": "bionic", "launchpad_bugs_fixed": [ 1192719 ], "author": "Timo Aaltonen ", "date": "Thu, 05 Apr 2018 15:27:42 +0300" }, { "cves": [], "log": [ "", " * Merge with Debian unstable.", " - Fixes unescaped brace in pam_getenv regex. LP: #1538284.", " - Fixes pam_namespace defaults for compatibility with dash. LP: #1081323.", " * Remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - pam-configs/mkhomedir: Added a config for pam_mkhomedir, disabled", " by default.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/cve-2015-3238.patch: removed manpage changes", " so they don't get regenerated during build and cause a multiarch", " installation issue.", " * Dropped changes, included in Debian:", " - Build-depend on libfl-dev.", " - debian/patches-applied/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE.", " * Fix references to /var/run in update-motd.5. LP: #1571864", " * Fix service restart handling to integrate with systemd instead of", " upstart.", "" ], "package": "pam", "version": "1.1.8-3.6ubuntu1", "urgency": "medium", "distributions": "bionic", "launchpad_bugs_fixed": [ 1538284, 1081323, 1571864 ], "author": "Steve Langasek ", "date": "Thu, 26 Oct 2017 23:23:18 -0700" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * cve-2015-3238.patch: Add the changes in the generated pam_exec.8", " and pam_unix.8 in addition to (and after) the changes to the", " source .xml files. This avoids unwanted rebuilds that can cause", " problems due to differing files on different architectures of", " the Multi-Arch: same libpam-modules. (Closes: #851545)", "" ], "package": "pam", "version": "1.1.8-3.6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Adrian Bunk ", "date": "Sat, 27 May 2017 18:44:02 +0300" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Build-Depend on libfl-dev:native as well, for cross builds.", " Re-closes: #846459", " * Fix \"Unescaped left brace in regex\" with Perl 5.22. Closes: #810873", "" ], "package": "pam", "version": "1.1.8-3.5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Adam Borowski ", "date": "Fri, 30 Dec 2016 14:37:29 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Add libfl-dev to Build-Depends, fixing FTBFS. Closes: #846459", " * Move xsl stuff to Build-Depends from -Indep to fix misbuilt manpages.", " Closes: #812566", "" ], "package": "pam", "version": "1.1.8-3.4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Adam Borowski ", "date": "Sun, 18 Dec 2016 01:03:58 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " [ Steve Langasek ]", " * Updated Swedish translation to correct a typo, thanks to Anders Jonsson", " and Martin Bagge. Closes: #743875", " * Updated Turkish translation, thanks to Mert Dirik .", " (closes: #756756)", " * d/applied-patches/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE. Thanks to Robie Basak", " for the patch. Closes: #783105.", " * Acknowledge security NMU.", " * pam-auth-update: don't mishandle trailing whitespace in profiles.", " LP: #1487103.", "", " [ Laurent Bigonville ]", " * debian/control: Fix Vcs-* and Homepage fields (Closes: #752343)", " * debian/watch: Update watch file and point it to http://www.linux-pam.org", " * debian/patches-applied/pam_namespace_fix_bashism.patch: Fix bashism in", " namespace.init script (Closes: #624842)", " * debian/control: Build-depends against debhelper (>= 9) to match the", " defined debhelper compatibility", " * Rename the cve-2011-4708.patch to cve-2010-4708.patch to match reality,", " thanks to Jakub Wilk for noticing (Closes: #761594)", " * debian/control: Bump Standards-Version to 3.9.8 (no further changes)", " * debian/libpam-doc.doc-base.applications-guide: Fix spelling", " * debian/libpam0g-dev.examples: Do not use shell brace expansion", " * debian/patches-applied/pam-loginuid-in-containers: Updated with the version", " from Ubuntu, this should fix logins in containers (Closes: #726661)", " * debian/patches-applied/update-motd: Updated with the version from Ubuntu:", " use /run/motd.dynamic instead of /var/run/motd, nothing in the archive", " uses the later (Closes: #743286)", " * debian/patches-applied/make_documentation_reproducible.patch: Make the", " build reproducible, removes differences when building with different", " locale values (Closes: #792127)", "" ], "package": "pam", "version": "1.1.8-3.3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 1487103 ], "author": "Laurent Bigonville ", "date": "Wed, 18 May 2016 02:04:29 +0200" }, { "cves": [], "log": [ "", " * No-change rebuild to pick up -fPIE compiler default in static", " libraries", "" ], "package": "pam", "version": "1.1.8-3.2ubuntu3", "urgency": "medium", "distributions": "artful", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 21 Apr 2017 20:53:23 +0000" }, { "cves": [], "log": [ "", " * debian/patches-applied/cve-2015-3238.patch: removed manpage changes", " so they don't get regenerated during build and cause a multiarch", " installation issue. (LP: #1558114)", "" ], "package": "pam", "version": "1.1.8-3.2ubuntu2", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [ 1558114 ], "author": "Marc Deslauriers ", "date": "Wed, 16 Mar 2016 13:34:02 -0400" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include patch to autogenerated manpage file", " - debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - debian/patches-applied/extrausers.patch: Ship pre-generated man page", " - debian/patches-applied/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE.", " - debian/control: have libpam-modules recommend update-motd package", "" ], "package": "pam", "version": "1.1.8-3.2ubuntu1", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 16 Mar 2016 09:50:51 -0400" }, { "cves": [ { "cve": "CVE-2015-3238", "url": "https://ubuntu.com/security/CVE-2015-3238", "cve_description": "The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.", "cve_priority": "low", "cve_public_date": "2015-08-24 14:59:00 UTC" } ], "log": [ "", " * Non-maintainer upload.", " * Fix CVE-2015-3238: DoS/user enumeration due to blocking pipe in pam_unix", " module (Closes: #789986)", "" ], "package": "pam", "version": "1.1.8-3.2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Tianon Gravi ", "date": "Wed, 06 Jan 2016 15:53:31 -0800" }, { "cves": [], "log": [ "", " * d/applied-patches/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE.", "" ], "package": "pam", "version": "1.1.8-3.1ubuntu3", "urgency": "medium", "distributions": "vivid", "launchpad_bugs_fixed": [], "author": "Robie Basak ", "date": "Wed, 22 Apr 2015 08:55:24 +0000" }, { "cves": [], "log": [ "", " * debian/control:", " - have libpam-modules recommend update-motd package", " + while libpam-modules provides pam_motd, which does dynamically", " generate the motd from /etc/update-motd.d on login, hundreds of", " users have asked in the past few years how they might \"force\"", " a MOTD update; this is provided by /usr/sbin/update-motd", " in the tiny update-motd package (already in main); recommend", " this package", "" ], "package": "pam", "version": "1.1.8-3.1ubuntu2", "urgency": "medium", "distributions": "vivid", "launchpad_bugs_fixed": [], "author": "Dustin Kirkland ", "date": "Tue, 11 Nov 2014 12:49:14 -0600" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include patch to autogenerated manpage file", " - debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - debian/patches-applied/extrausers.patch: Ship pre-generated man page", "" ], "package": "pam", "version": "1.1.8-3.1ubuntu1", "urgency": "low", "distributions": "vivid", "launchpad_bugs_fixed": [], "author": "Michael Vogt ", "date": "Mon, 27 Oct 2014 09:57:52 +0100" }, { "cves": [ { "cve": "CVE-2013-7041", "url": "https://ubuntu.com/security/CVE-2013-7041", "cve_description": "The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack.", "cve_priority": "low", "cve_public_date": "2014-05-08 14:29:00 UTC" }, { "cve": "CVE-2014-2583", "url": "https://ubuntu.com/security/CVE-2014-2583", "cve_description": "Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.", "cve_priority": "low", "cve_public_date": "2014-04-10 20:29:00 UTC" } ], "log": [ "", " * Non-maintainer upload by the Security Team.", " * Fix CVE-2013-7041: case-insensitive comparison used for verifying", " passwords in the pam_userdb module (closes: #731368).", " * Fix CVE-2014-2583: multiple directory traversal issues in the", " pam_timestamp module (closes: 757555)", "" ], "package": "pam", "version": "1.1.8-3.1", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Gilbert ", "date": "Sat, 09 Aug 2014 09:50:42 +0000" }, { "cves": [], "log": [ "", " * No-change rebuild to get debug symbols on all architectures.", "" ], "package": "pam", "version": "1.1.8-3ubuntu4", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [], "author": "Brian Murray ", "date": "Tue, 21 Oct 2014 12:32:23 -0700" }, { "cves": [], "log": [ "", " * debian/patches-applied/extrausers.patch:", " - Ship pre-generated man page", "" ], "package": "pam", "version": "1.1.8-3ubuntu3", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [], "author": "Michael Terry ", "date": "Tue, 22 Jul 2014 14:13:31 -0400" }, { "cves": [], "log": [ "", " * debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " * debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " * debian/rules: Make pam_extrausers_chkpwd sguid shadow", "" ], "package": "pam", "version": "1.1.8-3ubuntu2", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [], "author": "Michael Terry ", "date": "Fri, 18 Jul 2014 14:52:08 -0400" }, { "cves": [], "log": [ "", " [ Stéphane Graber ]", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include patch to autogenerated manpage file", " - debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", "", " [ Timo Aaltonen ]", " * pam-configs/mkhomedir: Added a config for pam_mkhomedir, disabled", " by default. (LP: #557013)", "" ], "package": "pam", "version": "1.1.8-3ubuntu1", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [ 557013 ], "author": "Stéphane Graber ", "date": "Fri, 02 May 2014 14:59:10 -0400" }, { "cves": [], "log": [ "", " * debian/rules: On hurd, link libpam explicitly with -lpthread since glibc", " will not dynamically switch between the libc stubs and the libpthread", " implementations on this architecture. Thanks to Samuel Thibault for the", " patch. Closes: #743891.", "" ], "package": "pam", "version": "1.1.8-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Apr 2014 17:49:38 -0700" }, { "cves": [], "log": [ "", " * Mark the libaudit-dev build-dependency linux-any, since it's not", " available on non-Linux archs. Closes: #737035.", "" ], "package": "pam", "version": "1.1.8-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 13 Feb 2014 15:02:00 -0800" }, { "cves": [], "log": [ "", " * debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", "" ], "package": "pam", "version": "1.1.8-1ubuntu2", "urgency": "medium", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Stéphane Graber ", "date": "Fri, 31 Jan 2014 22:11:02 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " * debian/patches-applied/pam_umask_usergroups_from_login.defs.patch: include", " patch to autogenerated manpage file", "" ], "package": "pam", "version": "1.1.8-1ubuntu1", "urgency": "medium", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 16 Jan 2014 02:40:41 +0000" }, { "cves": [], "log": [ "", " * New upstream release.", " - includes upstream changes to pam_exec. Closes: #670147.", " - adds support for newer hashing algorithms to pam_userdb.", " Closes: #671740.", " - fixes handling of 'quiet' argument to pam_listfile, to match the", " documentation. Closes: #592219.", " - fixes handling of @users@@hosts netgroup syntax in access.conf.", " Closes: #681223.", " - fixes installation of the /etc/security/namespace.d directory.", " Closes: #710998.", " - 027_pam_limits_better_init_allow_explicit_root: support for reading", " /proc/1/limits is upstream, this patch now only handles the policy", " of resetting limits by default and not applying glob limits to root.", " - debian/patches/fix-manpage-crud: drop, manpages now being generated", " upstream with a newer, fixed xsltproc.", " - debian/patches/pam_env-fix-overflow.patch, pam_env-fix-dos.patch,", " glibc-2_16-compilation-fix.patch, sys-types-include.patch: drop,", " included upstream.", " * Add build-dependency on pkg-config.", " * Ensure autogenerated files are after source files in all relevant patches,", " so that regenerating documentation doesn't cause build skew.", " * Drop the --disable-regenerate-docu argument, restoring the HTML manuals", " to the libpam-doc package. Closes: #700485.", " * No need to override dh_compress in debian/rules, it already handles .html", " files correctly.", " * debian/libpam-cracklib.prerm: use $DPKG_MAINTSCRIPT_PACKAGE_COUNT to avoid", " prematurely removing the PAM config when the package is installed for", " multiple architectures. Closes: #647428.", "" ], "package": "pam", "version": "1.1.8-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 16 Jan 2014 00:38:42 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " * Dropped changes, merged in Debian:", " - Disable libaudit for stage1 bootstrap.", "" ], "package": "pam", "version": "1.1.3-11ubuntu1", "urgency": "medium", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 13 Jan 2014 21:41:05 -0800" }, { "cves": [], "log": [ "", " [ Wookey ]", " * Disable libaudit for stage1 bootstrap.", "", " [ Steve Langasek ]", " * debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Ignore failure in user namespaces.", " * Use [linux-any] in build-deps, instead of hard-coding a list of", " non-Linux archs. Closes: #634516.", "" ], "package": "pam", "version": "1.1.3-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 14 Jan 2014 03:33:31 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Disable libaudit for stage1 bootstrap.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", "" ], "package": "pam", "version": "1.1.3-10ubuntu1", "urgency": "low", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 20 Oct 2013 18:21:34 -0700" }, { "cves": [], "log": [ "", " * Fix pam-auth-update handling of trailing blank lines in the fields of", " profiles. LP: #1160288.", " * Reintroduce libaudit support now that libaudit has been multiarched.", " Closes: #699159.", "" ], "package": "pam", "version": "1.1.3-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 1160288 ], "author": "Steve Langasek ", "date": "Sun, 20 Oct 2013 15:30:46 -0700" }, { "cves": [], "log": [ "", " * Revert libaudit support for now, because libaudit isn't multiarched yet", " in unstable so this regresses cross-installability. Reopens bug", " #699159.", " * Add an or'ed dependency on cdebconf, which also implements the", " xloadtemplatefile extension that prevents us from depending on just", " 'debconf-2.0'. Thanks to Régis Boudin for the info.", " Closes: #677278.", "" ], "package": "pam", "version": "1.1.3-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2013 23:06:30 +0000" }, { "cves": [], "log": [ "", " * Adjust debian/patches-applied/update-motd to write to /run/motd.dynamic,", " as sysvinit/ssh/login in Debian have been changed to use this file and", " no longer links /etc/motd to /var/run/motd.", "" ], "package": "pam", "version": "1.1.3-8ubuntu3", "urgency": "low", "distributions": "saucy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 18 May 2013 00:07:43 -0500" }, { "cves": [], "log": [ "", " * Disable libaudit for stage1 bootstrap (LP: #1126404)", "" ], "package": "pam", "version": "1.1.3-8ubuntu2", "urgency": "low", "distributions": "raring", "launchpad_bugs_fixed": [ 1126404 ], "author": "Wookey ", "date": "Fri, 15 Feb 2013 12:45:27 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH. LP: #110287.", "" ], "package": "pam", "version": "1.1.3-8ubuntu1", "urgency": "low", "distributions": "raring", "launchpad_bugs_fixed": [ 110287 ], "author": "Steve Langasek ", "date": "Mon, 11 Feb 2013 22:08:44 -0800" }, { "cves": [], "log": [ "", " * Confirm NMU for bug #611136; thanks to Michael Gilbert.", " - As a side effect, there will no longer be errors from reading the", " .pam_environment twice since we are now reading it 0 times.", " LP: #955032.", " * Adjust the pam_env documentation to match the module behavior resulting", " from the previous security upload. Closes: #693995.", " * debian/rules: never regenerate manpages at build time; this may cause", " build skew that breaks the world in a multiarch context. LP: #1095887.", " * debian/patches-applied/glibc-2_16-compilation-fix.patch: fix missing", " include causing build failure with eglibc 2.16. Thanks to Daniel", " Schepler . Closes: #693450.", " * Ditch autoconf patch in favor of a build-dependency on dh-autoreconf,", " which will let us keep up-to-date with newer autotools. In the present", " instance, this gets us aarch64 support.", " * Install pam_timestamp_check - and while we're at it, move the manpage", " to the correct binary package. Closes: #648695.", " * Update lintian overrides to suppress some noise about hardening and", " manpages.", " * Enable audit support, by popular demand. This should have no major", " impact unless you're also running auditd; but I reserve the right to", " disable this again in the event that this causes a performance hit or", " breaks upgrades (since the dependency is pulled into libpam, not just", " into pam_tty_audit). Closes: #699159, LP: #937005.", "" ], "package": "pam", "version": "1.1.3-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 955032, 1095887, 937005 ], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2013 05:36:29 +0000" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Fix cve-2010-4708: user-configurable .pam_environment allows", " administrator-level changes without root access (closes: #611136).", "" ], "package": "pam", "version": "1.1.3-7.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Gilbert ", "date": "Sun, 29 Apr 2012 02:23:26 -0400" }, { "cves": [], "log": [ "", " [ Nathan Williams ]", " * Add /usr/local/games to PATH. LP: #110287.", "" ], "package": "pam", "version": "1.1.3-7ubuntu3", "urgency": "low", "distributions": "quantal", "launchpad_bugs_fixed": [ 110287 ], "author": "Steve Langasek ", "date": "Tue, 03 Jul 2012 06:55:25 +0000" }, { "cves": [], "log": [ "", " * No-change rebuild with gzip 1.4-1ubuntu2 to get multiarch-clean", " compression of manpages. LP: #871083.", "" ], "package": "pam", "version": "1.1.3-7ubuntu2", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [ 871083 ], "author": "Steve Langasek ", "date": "Wed, 08 Feb 2012 17:15:39 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", "" ], "package": "pam", "version": "1.1.3-7ubuntu1", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 28 Jan 2012 11:36:07 -0800" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Danish, thanks to Joe Dalton (closes: #648382)", " - French, thanks to Jean-Baka Domelevo Entfellner ", " (closes: #649850)", " - Dutch, thanks to Jeroen Schot ", " (closes: #650755)", " - Russian, thanks to Yuri Kozlov (closes: #650867)", " - Portuguese, thanks to Pedro Ribeiro ", " (closes: #652493)", " - German, thanks to Sven Joachim (closes: #653407)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #654043)", " - Bulgarian, thanks to Damyan Ivanov (closes: #656518)", " - Slovak, thanks to Ivan Masár (closes: #656521)", " - Japanese, thanks to Kenshi Muto (closes: #656834)", " - Polish, thanks to Michał Kułach ", " (closes: #657476)", " - Catalan, thanks to Innocent De Marchi ", " (closes: #657489)", " - Czech, thanks to Miroslav Kure ", " (closes: #657578)", " - Swedish, thanks to Martin Bagge (closes: #651349)", "" ], "package": "pam", "version": "1.1.3-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 28 Jan 2012 10:57:49 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " * Dropped changes, included in Debian:", " - debian/patches-applied/update-motd: set a sane umask before calling", " run-parts, and restore the old mask afterwards, so /run/motd gets", " consistent permissions.", " - debian/patches-applied/update-motd: new module option for pam_motd,", " 'noupdate', which suppresses the call to run-parts /etc/update-motd.d.", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " * Build-depend on libfl-dev in addition to flex, for cross-building", " support.", "" ], "package": "pam", "version": "1.1.3-6ubuntu1", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Nov 2011 21:15:00 -0800" }, { "cves": [], "log": [ "", " * debian/patches-applied/hurd_no_setfsuid: we don't want to check all", " setre*id() calls; we know that there are situations where some of these", " may fail but we don't care. As long as the last setre*id() call in each", " set succeeds, that's the state we mean to be in.", " * debian/libpam0g.postinst: according to Kubuntu developers, kdm no longer", " keeps libpam loaded persistently at runtime, so it's not necessary to", " force a kdm restart on ABI bump. Which is good, since restarting kdm", " now seems to also log users out of running sessions, which we rather", " want to avoid. Closes: #632673, LP: #744944.", " * debian/patches-applied/update-motd: set a sane umask before calling", " run-parts, and restore the old mask afterwards, so /run/motd gets", " consistent permissions. LP: #871943.", " * debian/patches-applied/update-motd: new module option for pam_motd,", " 'noupdate', which suppresses the call to run-parts /etc/update-motd.d.", " LP: #805423.", " * debian/libpam0g.templates, debian/libpam0g.postinst: add a new question,", " libraries/restart-without-asking, that allows admins to accept the", " service restarts once for all so that they don't have to repeatedly", " say \"ok\". LP: #745004.", " * debian/libpam-runtime.templates, debian/local/pam-auth-update: add a", " new 'title' template, so pam-auth-update doesn't give a blank title", " when called outside of a maintainer script. LP: #882794.", "" ], "package": "pam", "version": "1.1.3-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 744944, 871943, 805423, 745004, 882794 ], "author": "Steve Langasek ", "date": "Sun, 06 Nov 2011 19:43:14 -0800" }, { "cves": [], "log": [ "", " * Rebuild with dpkg 1.16.1.1ubuntu2 to restore large file support.", "" ], "package": "pam", "version": "1.1.3-5ubuntu2", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 01 Nov 2011 16:59:55 -0400" }, { "cves": [ { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" } ], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - add debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " (Closes: #583958)", " * Dropped changes, included in Debian:", " - debian/patches-applied/CVE-2011-3148.patch", " - debian/patches-applied/CVE-2011-3149.patch", " - debian/patches-applied/update-motd: updated to use clean environment", " and absolute paths in modules/pam_motd/pam_motd.c.", " * debian/libpam0g.postinst: the init script for 'samba' is now named 'smbd'", " in Ubuntu, so fix the restart handling.", " * debian/patches-applied/update-motd: set a sane umask before calling", " run-parts, and restore the old mask afterwards, so /run/motd gets", " consistent permissions. LP: #871943.", " * debian/patches-applied/update-motd: new module option for pam_motd,", " 'noupdate', which suppresses the call to run-parts /etc/update-motd.d.", " LP: #805423.", "" ], "package": "pam", "version": "1.1.3-5ubuntu1", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [ 871943, 805423 ], "author": "Steve Langasek ", "date": "Sun, 30 Oct 2011 09:45:00 -0600" }, { "cves": [ { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" } ], "log": [ "", " [ Kees Cook ]", " * debian/patches-applied/pam_unix_dont_trust_chkpwd_caller.patch: use", " setresgid() to wipe out saved-gid just in case.", " * debian/patches-applied/008_modules_pam_limits_chroot:", " - fix off-by-one when parsing configuration file.", " - when using chroot, chdir() to root to lose links to old tree.", " * debian/patches-applied/022_pam_unix_group_time_miscfixes,", " debian/patches-applied/026_pam_unix_passwd_unknown_user,", " debian/patches-applied/054_pam_security_abstract_securetty_handling:", " improve descriptions.", " * debian/patches-applied/{007_modules_pam_unix,055_pam_unix_nullok_secure}:", " drop unneeded no-op change to reduce delta from upstream.", " * debian/patches-applied/hurd_no_setfsuid: check all set*id() calls.", " * debian/patches-applied/update-motd: correctly clear environment when", " building motd.", " * debian/patches-applied/pam_env-fix-overflow.patch: fix stack overflow", " in environment file parsing (CVE-2011-3148).", " * debian/patches-applied/pam_env-fix-dos.patch: fix DoS in environment", " file parsing (CVE-2011-3149).", "" ], "package": "pam", "version": "1.1.3-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 27 Oct 2011 21:33:57 -0700" }, { "cves": [], "log": [ "", " * Make sure shared library links are also installed to the multiarch", " directory, not just the .a files; otherwise the static libs get found", " first by the linker. Thanks to Russ Allbery for catching this.", " Closes: #642952.", "" ], "package": "pam", "version": "1.1.3-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 25 Sep 2011 22:33:55 +0000" }, { "cves": [], "log": [ "", " * Look for /etc/init.d/postgresql, not /etc/init.d/postgresql-8.{2,3},", " for service restarts; the latter are obsolete since squeeze.", " Closes: #631511.", " * Move debian/libpam0g-dev.install to debian/libpam0g-dev.install.in", " and substitute the multiarch path at build time, so our .a files go to", " the multiarch dir instead of to /usr/lib. Thanks to Riku Voipio for", " pointing out the bug.", " * debian/control: adjust the package descriptions, as the current ones", " use some awkward language that's gone unnoticed for a long time. Thanks", " to Martin Eberhard Schauer for pointing this", " out. Closes: #633863.", " * Build-depend on debhelper 8.9.4 and bump debian/compat to 9 for", " dpkg-buildflags integration, and drop manual setting of -g -O options in", " CFLAGS now that we can let dh do it for us", " * Don't set --sbindir when calling configure; upstream takes care of this", " for us", "" ], "package": "pam", "version": "1.1.3-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 24 Sep 2011 20:08:56 +0000" }, { "cves": [ { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: possible code execution via incorrect environment file", " parsing (LP: #874469)", " - debian/patches-applied/CVE-2011-3148.patch: correctly count leading", " whitespace when parsing environment file in modules/pam_env/pam_env.c.", " - CVE-2011-3148", " * SECURITY UPDATE: denial of service via overflowed environment variable", " expansion (LP: #874565)", " - debian/patches-applied/CVE-2011-3149.patch: when overflowing, exit", " with PAM_BUF_ERR in modules/pam_env/pam_env.c.", " - CVE-2011-3149", " * SECURITY UPDATE: code execution via incorrect environment cleaning", " - debian/patches-applied/update-motd: updated to use clean environment", " and absolute paths in modules/pam_motd/pam_motd.c.", " - CVE-2011-XXXX", "" ], "package": "pam", "version": "1.1.3-2ubuntu2.1", "urgency": "low", "distributions": "oneiric-security", "launchpad_bugs_fixed": [ 874469, 874565 ], "author": "Marc Deslauriers ", "date": "Tue, 18 Oct 2011 09:33:47 -0400" }, { "cves": [], "log": [ "", " * Merge with Debian to get bug fix for unknown kernel rlimits. Remaining", " changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - add debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " (Closes: #583958)", " * Dropped changes:", " - debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " no need to bump the hard limit for number of file descriptors any more", " since we read kernel limits directly now.", "" ], "package": "pam", "version": "1.1.3-2ubuntu1", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Kees Cook ", "date": "Thu, 18 Aug 2011 16:41:18 -0500" }, { "cves": [], "log": [ "", " [ Kees Cook ]", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " - only report about unknown kernel rlimits when \"debug\" is set", " (Closes: 625226, LP: #794531).", "", " [ Steve Langasek ]", " * Build for multiarch. Closes: #463420.", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " don't reset the process niceness for root; since it's root, they can", " still renice to a lower nice level if they need to and changing the", " nice level by default is unexpected behavior. Closes: #594377.", "" ], "package": "pam", "version": "1.1.3-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 794531 ], "author": "Steve Langasek ", "date": "Tue, 21 Jun 2011 11:41:12 -0700" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * debian/patches/pam_motd-legal-notice: use pam_modutil_gain/drop_priv", " common helper functions, instead of hand-rolled uid-setting code.", "", " [ Martin Pitt ]", " * debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " (LP: #253096, UbuntuSpec:umask-to-0002)", " * debian/local/pam-auth-update: Add the new md5sum of above files.", " * Add debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it from", " /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined there.", " This restores compatibility with the pre-PAM behaviour of login.", " (Closes: #583958)", "" ], "package": "pam", "version": "1.1.3-1ubuntu3", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [ 253096 ], "author": "Martin Pitt ", "date": "Fri, 24 Jun 2011 11:07:57 +0200" }, { "cves": [], "log": [ "", " * debian/patches-applied/update-motd-manpage-ref: refresh patch to apply", " cleanly against new upstream.", "" ], "package": "pam", "version": "1.1.3-1ubuntu2", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 04 Jun 2011 14:20:17 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " bump the hard limit for number of file descriptors, to keep pace with", " the changes in the kernel.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - New patch, lib_security_multiarch_compat, which lets us reuse the", " upstream --enable-isadir functionality to support a true path for", " module lookups; this way we don't have to force a hard transition to", " multiarch, but can support resolving modules in both the multiarch and", " non-multiarch directories.", " - build for multiarch, splitting our executables out of libpam-modules", " into a new package, libpam-modules-bin, so that modules can be", " co-installable between architectures.", " * Dropped changes:", " - bumping the service restart version in libpam0g.postinst to ensure", " servers don't fail to find the pam modules in the new paths; the min", " version requirement upstream is higher than this now.", "" ], "package": "pam", "version": "1.1.3-1ubuntu1", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 04 Jun 2011 14:04:19 -0700" }, { "cves": [ { "cve": "CVE-2010-3853", "url": "https://ubuntu.com/security/CVE-2010-3853", "cve_description": "pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3316", "url": "https://ubuntu.com/security/CVE-2010-3316", "cve_description": "The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pam_xauth PAM check.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3430", "url": "https://ubuntu.com/security/CVE-2010-3430", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3431", "url": "https://ubuntu.com/security/CVE-2010-3431", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3435", "url": "https://ubuntu.com/security/CVE-2010-3435", "cve_description": "The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" } ], "log": [ "", " * New upstream release.", " - Fixes CVE-2010-3853, executing namespace.init with an insecure", " environment set by the caller. Closes: #608273.", " - Fixes CVE-2010-3316 CVE-2010-3430 CVE-2010-3431 CVE-2010-3435.", " Closes: #599832.", " * Port hurd_no_setfsuid patch to new pam_modutil_{drop,restore}_priv", " interface; now possibly upstreamable", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " set a better default RLIMIT_MEMLOCK value for BSD kernels. Thanks to", " Petr Salinger for the fix. Closes: #602902.", " * bump the minimum version check in maintainer scripts for the restart", " handling.", "" ], "package": "pam", "version": "1.1.3-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 04 Jun 2011 03:10:50 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " bump the hard limit for number of file descriptors, to keep pace with", " the changes in the kernel.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - New patch, lib_security_multiarch_compat, which lets us reuse the", " upstream --enable-isadir functionality to support a true path for", " module lookups; this way we don't have to force a hard transition to", " multiarch, but can support resolving modules in both the multiarch and", " non-multiarch directories.", " - build for multiarch, splitting our executables out of libpam-modules", " into a new package, libpam-modules-bin, so that modules can be", " co-installable between architectures.", " - bumping the service restart version in libpam0g.postinst to ensure", " servers don't fail to find the pam modules in the new paths.", " * bump debhelper build-dep for final multiarch support.", "" ], "package": "pam", "version": "1.1.2-3ubuntu1", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 20 May 2011 12:53:24 -0700" }, { "cves": [], "log": [ "", " [ Kees Cook ]", " * 027_pam_limits_better_init_allow_explicit_root: load rlimit defaults", " from the kernel (via /proc/1/limits), instead of continuing to hardcode", " the settings internally. Fall back to internal defaults when the kernel", " rlimits are not found. Closes: #620302. (LP: #746655, #391761)", "", " * Updated debconf translations:", " - Vietnamese, thanks to Clytie Siddall ", " (closes: #601197)", " - Dutch, thanks to Eric Spreen (closes: #605592)", " - Danish, thanks to Joe Dalton (closes: #606739)", " - Catalan, thanks to Innocent De Marchi ", " (closes: #622786)", "" ], "package": "pam", "version": "1.1.2-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 746655, 391761 ], "author": "Steve Langasek ", "date": "Sun, 01 May 2011 01:49:11 -0700" }, { "cves": [], "log": [ "", " * Check if gdm is actually running before trying to reload it. (LP: #745532)", "" ], "package": "pam", "version": "1.1.2-2ubuntu8", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 745532 ], "author": "Stéphane Graber ", "date": "Mon, 11 Apr 2011 21:57:36 -0400" }, { "cves": [], "log": [ "", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " bump the hard limit for number of file descriptors, to keep pace with", " the changes in the kernel. Fortunately this shadowing should all go", " away next cycle when we can start to grab defaults directly from /proc.", " LP: #663090", "" ], "package": "pam", "version": "1.1.2-2ubuntu7", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 663090 ], "author": "Steve Langasek ", "date": "Tue, 05 Apr 2011 13:02:02 -0700" }, { "cves": [], "log": [ "", " * debian/libpam0g.postinst: according to Kubuntu developers, kdm no longer", " keeps libpam loaded persistently at runtime, so it's not necessary to", " force a kdm restart on ABI bump. Which is good, since restarting kdm", " now seems to also log users out of running sessions, which we rather", " want to avoid. LP: #744944.", "" ], "package": "pam", "version": "1.1.2-2ubuntu6", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 744944 ], "author": "Steve Langasek ", "date": "Tue, 29 Mar 2011 13:16:26 -0700" }, { "cves": [], "log": [ "", " * Force a service restart on upgrade to the new libpam0g, to ensure", " servers don't fail to find the pam modules in the new paths.", " * libpam-modules should also Pre-Depend: on the multiarch-aware libpam0g,", " for the same reason.", "" ], "package": "pam", "version": "1.1.2-2ubuntu5", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 22 Mar 2011 02:19:51 -0700" }, { "cves": [], "log": [ "", " * Build for multiarch; FFe LP: #733501.", " * Split our executables out of libpam-modules into a new package,", " libpam-modules-bin, so that modules can be co-installable between", " architectures.", " * New patch, lib_security_multiarch_compat, which lets us reuse the", " upstream --enable-isadir functionality to support a true path for module", " lookups; this way we don't have to force a hard transition to multiarch,", " but can support resolving modules in both the multiarch and", " non-multiarch directories.", " * Build-Depend on the multiarchified debhelper.", " * Add Pre-Depends: ${misc:Pre-Depends} for multiarch-support.", "" ], "package": "pam", "version": "1.1.2-2ubuntu4", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 733501 ], "author": "Steve Langasek ", "date": "Fri, 18 Mar 2011 00:12:26 -0700" }, { "cves": [], "log": [ "", " * Er, but let's get this patch applying cleanly.", "" ], "package": "pam", "version": "1.1.2-2ubuntu3", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 21 Feb 2011 16:10:11 -0800" }, { "cves": [], "log": [ "", " * debian/patches/update-motd-manpage-ref: patch the manpage too, not just", " the xml source.", "" ], "package": "pam", "version": "1.1.2-2ubuntu2", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 21 Feb 2011 15:47:27 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", "" ], "package": "pam", "version": "1.1.2-2ubuntu1", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 17 Feb 2011 16:15:47 -0800" }, { "cves": [], "log": [ "", " * debian/patches-applied/hurd_no_setfsuid: handle some new calls to", " setfsuid in pam_xauth that I overlooked, so that the build works again", " on non-Linux. Closes: #613630.", "" ], "package": "pam", "version": "1.1.2-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 16 Feb 2011 09:27:11 -0800" }, { "cves": [], "log": [ "", " * New upstream release.", " - Add support for NSS groups to pam_group. Closes: #589019,", " LP: #297408.", " - Support cross-building the package. Thanks to Neil Williams", " for the patch. Closes: #284854.", " * debian/rules: pass getconf LFS_CFLAGS so that we get a 64-bit rlimit", " interface. Closes: #579402.", " * Drop patches conditional_module,_conditional_man and", " mkhomedir_linking.patch, which are included upstream.", " * debian/patches/hurd_no_setfsuid: pam_env and pam_mail now also use", " setfsuid, so patch them to be likewise Hurd-safe.", " * Update debian/source.lintian-overrides to clean up some spurious", " warnings.", " * debian/libpam-modules.postinst: if any 'min=n' options are found in", " /etc/pam.d/common-password, convert them on upgrade to 'minlen=n' for", " compatibility with upstream.", " * debian/NEWS: document the disappearance of 'min=n', in case users have", " encoded this option elsewhere outside of /etc/pam.d/common-password.", " * debian/patches/007_modules_pam_unix: drop compatibility handling of", " 'max=' no-op; use of this option will now log an error, as warned three", " years ago.", " * Bump Standards-Version to 3.9.1.", " * Add lintian overrides for a few more spurious warnings.", " * debian/patches-applied/no_PATH_MAX_on_hurd: define PATH_MAX for", " compatibility when it's not already set. Closes: #552043.", " * debian/local/pam-auth-update: Don't try to pass embedded newlines to", " debconf; backslash-escape them instead and use CAPB escape.", " * debian/local/pam-auth-update: sort additional module options before", " writing them out, so that we don't wind up with a different config file", " on every invocation. Thanks to Jim Paris for the patch.", " Closes: #594123.", " * debian/libpam-runtime.{postinst,templates}: since 1.1.2-1 is targeted", " for post-squeeze, we don't need to support upgrades from 1.0.1-6 to", " 1.0.1-10 anymore. Drop the debconf error note about having configured", " your system with a lack of authentication, so that translators don't", " spend any more time on it.", " * Updated debconf translations:", " - Swedish, thanks to Martin Bagge (closes: #575875)", "" ], "package": "pam", "version": "1.1.2-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 297408 ], "author": "Steve Langasek ", "date": "Tue, 15 Feb 2011 23:21:41 -0800" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Italian, thanks to Nicole B. (closes: #602112)", "" ], "package": "pam", "version": "1.1.1-7", "urgency": "low", "distributions": "UNRELEASED", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 17 Nov 2010 16:53:46 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " * Dropped changes:", " - libpam-modules depend on base-files (>= 5.0.0ubuntu6): 5.0.0ubuntu20", " is in 10.04 LTS and this is an essential package, so no more need for", " the versioned dependency.", "" ], "package": "pam", "version": "1.1.1-6.1ubuntu1", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 15 Feb 2011 23:36:47 -0800" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Fix pending l10n issues. Debconf translations:", " - Czech (Miroslav Kure). Closes: #598329", " - Slovak (Ivan Masár). Closes: #600164", " - Japanese (Kenshi Muto). Closes: #600247", " - Finnish (Esko Arajärvi). Closes: #600641", "" ], "package": "pam", "version": "1.1.1-6.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Christian Perrier ", "date": "Tue, 19 Oct 2010 07:30:49 +0200" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Swedish, thanks to Martin Bagge (closes: #575875)", "" ], "package": "pam", "version": "1.1.1-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 05 Sep 2010 23:36:35 -0700" }, { "cves": [], "log": [ "", " * debian/rules: pass getconf LFS_CFLAGS so that we get a 64-bit rlimit", " interface. Closes: #579402.", " * Update debian/source.lintian-overrides to clean up some spurious", " warnings.", " * Bump Standards-Version to 3.9.1.", " * Add lintian overrides for a few more spurious warnings.", " * debian/patches-applied/no_PATH_MAX_on_hurd: define PATH_MAX for", " compatibility when it's not already set. Closes: #552043.", " * debian/local/pam-auth-update: Don't try to pass embedded newlines to", " debconf; backslash-escape them instead and use CAPB escape.", " * debian/local/pam-auth-update: sort additional module options before", " writing them out, so that we don't wind up with a different config file", " on every invocation. Thanks to Jim Paris for the patch.", " Closes: #594123.", "" ], "package": "pam", "version": "1.1.1-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 05 Sep 2010 12:42:34 -0700" }, { "cves": [ { "cve": "CVE-2010-0832", "url": "https://ubuntu.com/security/CVE-2010-0832", "cve_description": "pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to \"user file stamps\" and the motd.legal-notice file.", "cve_priority": "high", "cve_public_date": "2010-07-12 16:30:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: root privilege escalation via symlink following.", " - debian/patches-applied/pam_motd-legal-notice: drop privs for work.", " - CVE-2010-0832", "" ], "package": "pam", "version": "1.1.1-4ubuntu2", "urgency": "low", "distributions": "maverick-security", "launchpad_bugs_fixed": [], "author": "Kees Cook ", "date": "Mon, 25 Oct 2010 06:40:32 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", "" ], "package": "pam", "version": "1.1.1-4ubuntu1", "urgency": "low", "distributions": "maverick", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 16 Aug 2010 19:12:35 -0700" }, { "cves": [], "log": [ "", " * debian/patches/conditional_module,_conditional_man: if we don't have the", " libraries required for building pam_tty_audit, we shouldn't install the", " manpage either. LP: #588547.", " * Updated debconf translations:", " - Portuguese, thanks to Eder L. Marques ", " (closes: #581746)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #592172)", " - Galician, thanks to Jorge Barreiro ", " (closes: #592808)", " * Don't pass --version-script options when linking executables,", " only when linking libraries. Thanks to Julien Cristau", " for the fix. Closes: #582362.", "" ], "package": "pam", "version": "1.1.1-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 588547 ], "author": "Steve Langasek ", "date": "Sun, 15 Aug 2010 21:53:46 -0700" }, { "cves": [], "log": [ "", " * Trigger a rebuild, applying changes from 1.1.1-2ubuntu2 which", " were previously not committed to bzr", "" ], "package": "pam", "version": "1.1.1-3ubuntu2", "urgency": "low", "distributions": "maverick", "launchpad_bugs_fixed": [], "author": "Dustin Kirkland ", "date": "Thu, 13 May 2010 10:04:23 +0200" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " * Dropped changes:", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade - upgrades to maverick are", " only supported from lucid, so this delta can be dropped.", " - debian/patches-applied/ubuntu-no-error-if-missingok: 'missingok' option", " is obsoleted by 10.04 LTS and no longer needs to be supported for", " upgrades.", "" ], "package": "pam", "version": "1.1.1-3ubuntu1", "urgency": "low", "distributions": "maverick", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 13 May 2010 00:39:44 +0200" }, { "cves": [], "log": [ "", " * pam-auth-update: fix a bug in our handling of module options when the", " module name contains digits, caused by a buggy regexp. :/ Partially", " addresses LP #369575.", " * Install /sbin/pam_tally2 in the libpam-modules package; thanks to", " Olivier BONHOMME for reporting. Closes: #554010.", "" ], "package": "pam", "version": "1.1.1-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 25 Apr 2010 05:53:44 -0700" }, { "cves": [], "log": [ "", " * debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation,", " LP: #562566", " * debian/patches/update-motd-manpage-ref: add a reference in pam_mod(8)", " to update-motd(5), LP: #552175", "" ], "package": "pam", "version": "1.1.1-2ubuntu2", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [ 562566, 552175 ], "author": "Dustin Kirkland ", "date": "Tue, 13 Apr 2010 16:58:12 -0500" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.1.1-2ubuntu1", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Feb 2010 12:04:18 +0000" }, { "cves": [], "log": [ "", " * Document the new symbols added in 1.1.1 in debian/libpam0g.symbols, and", " raise the minimum version for the service restarting code.", " Closes: #568480.", "" ], "package": "pam", "version": "1.1.1-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 17 Feb 2010 23:21:23 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.1.1-1ubuntu1", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 01 Feb 2010 09:55:02 -0800" }, { "cves": [], "log": [ "", " * New upstream version.", " - restore proper netgroup handling in pam_access.", " Closes: #567385, LP: #513955.", " * Drop patches pam.d-manpage-section, namespace_with_awk_not_gawk, and", " pam_securetty_tty_check_before_user_check, which are included upstream.", " * debian/patches/026_pam_unix_passwd_unknown_user: don't return", " PAM_USER_UNKNOWN on password change of a user that has no shadow entry,", " upstream now implements auto-creating the shadow entry in this case.", " * Updated debconf translations:", " - French, thanks to Jean-Baka Domelevo Entfellner ", " (closes: #547039)", " - Bulgarian, thanks to Damyan Ivanov (closes: #562835)", " * debian/patches/sys-types-include.patch: fix pam_modutil.h so that it can", " be included directly, without having to include sys/types.h first.", " Closes: #556203.", " * Add postgresql-8.3 to the list of services in need of restart on upgrade.", " Closes: #563674.", " * And drop postgresql-{7.4,8.1} from the list, neither of which is present", " in stable.", " * debian/patches/007_modules_pam_unix: recognize that *all* of the password", " hashes other than traditional crypt handle passwords >8 chars in length.", " LP: #356766.", "" ], "package": "pam", "version": "1.1.1-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 513955, 356766 ], "author": "Steve Langasek ", "date": "Mon, 01 Feb 2010 02:04:33 -0800" }, { "cves": [], "log": [ "", " * Brown paper bag: remove the right patch from the series file.", "" ], "package": "pam", "version": "1.1.0-4ubuntu3", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 10 Dec 2009 23:09:03 -0800" }, { "cves": [], "log": [ "", " * \"Rebase\" Ubuntu patches to apply them last in the series.", " * Drop patch ubuntu-regression_fix_securetty, superseded by the more", " precise fix in pam_securetty_tty_check_before_user_check.", "" ], "package": "pam", "version": "1.1.0-4ubuntu2", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 10 Dec 2009 22:52:20 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.1.0-4ubuntu1", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 05 Nov 2009 21:33:15 -0800" }, { "cves": [], "log": [ "", " * debian/patches/pam_securetty_tty_check_before_user_check: new patch,", " to make pam_securetty always return success on a secure tty regardless", " of what username was passed. Thanks to Nicolas François", " for the patch. Closes: #537848", " * debian/local/pam-auth-update: only reset the seen flag on the template", " when there's new information; this avoids reprompting users for the same", " information on upgrade, regardless of the debconf priority used.", " Closes: #544805.", " * libpam0g no longer depends on libpam-runtime; packages that use", " /etc/pam.d/common-* must depend directly on libpam-runtime, and most do", " (including the Essential: yes ones), so let's break this circular", " dependency. Closes: #545086, LP: #424566.", "" ], "package": "pam", "version": "1.1.0-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 424566 ], "author": "Steve Langasek ", "date": "Mon, 14 Sep 2009 18:47:25 -0700" }, { "cves": [], "log": [ "", " * Bump debian/compat to 7, so we can use sane contents in debian/*.install", " * Switch all packages over to dh_install", " * Rename debian/*.lintian to debian/*.lintian-overrides and use dh_lintian", " * Move installation logic out of debian/rules into individual .install", " files", " * Drop superfluous options to dh_installchangelogs, dh_shlibdeps", " * Use debian/clean instead of rm -f'ing files in debian/rules clean target", " * Drop ./configure options that are no-ops", " * Drop the /lib/security/pam_unix_*.so symlinks, which have been deprecated", " now for 10 years and are not used at all if pam-auth-update is in play.", " * Drop the pam_rhosts_auth.so symlink as well, and document in NEWS.Debian", " that this is now obsolete.", " * Drop stale content from README.debian: some of this should have been in", " NEWS.Debian instead (but is so old it's not worth putting it there now),", " some of it is obsolete by the change in package VCS.", " * Convert debian/rules to debhelper 7 and add versioned build-dependencies", " on debhelper and quilt to suit.", " * Drop CFLAGS that we don't need anymore (-fPIC, -D_REENTRANT,", " -D_GNU_SOURCE).", " * Explicitly add -O0 to CFLAGS when noopt is set.", " * debian/patches/autoconf.patch: pull ltmain.sh in, to fix some spurious", " library linkage in the modules.", " * Move pam_cracklib manpage to the libpam-cracklib package, and add the", " requisite Replaces", " * Drop dh_makeshlibs -V; everything from lenny on should use the .symbols", " file instead, making the shlibs redundant so we don't need to care what", " version gets listed there.", "" ], "package": "pam", "version": "1.1.0-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Sep 2009 18:47:45 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", " * Changes merged in Debian:", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.1.0-2ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 04 Sep 2009 01:11:48 -0700" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * debian/patches/pam_unix_dont_trust_chkpwd_caller.patch: fix this patch", " to call setregid() instead of always returning an error on username", " mismatch in unix_chkpwd, needed in the SELinux case and in some corner", " cases with the broken_shadow option. Thanks to Michael Spang for the", " analysis. Closes: #543589.", " * fix the PAM mini-policy to not tell app maintainers that they don't need", " to depend on libpam-modules if they reference modules from there.", " * make libpam-runtime depend on libpam-modules (>= 1.0.1-6) - nothing else", " guarantees that we have pam_unix available for use by pam-auth-update.", " * Use /bin/sh instead of /bin/bash for libpam0g.postinst, since we've", " confirmed there are no longer any bashisms there. Closes: #519973.", " * Clean up the libpam0g postinst a bit; invoke-rc.d has been a guaranteed", " interface for two stable release cycles now", " * debian/patches/namespace_with_awk_not_gawk: fix the sample", " namespace.init script's dependency on non-POSIX features of gawk, since", " we don't use gawk by default. Closes: #518908.", " * Updated debconf translations:", " - German, thanks to Sven Joachim (closes: #544464)", "", " [ Kees Cook ]", " * debian/local/common-password, debian/pam-configs/unix: switch from \"md5\"", " to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.1.0-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 31 Aug 2009 14:21:27 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", " * Dropped changes, superseded upstream:", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf.", "" ], "package": "pam", "version": "1.1.0-1ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 26 Aug 2009 00:40:14 -0700" }, { "cves": [], "log": [ "", " * New upstream version.", " - pam_access no longer does DNS lookups when we know we're comparing", " with a tty name or a service name. Closes: #376209.", " - fixes for manpage spelling. Closes: #488690.", " - fix evaluation of or'ed list of users in time.conf and group.conf.", " Closes: #326407, #514423.", " * Drop patches pam_unix_thread-safe_save_old_password.patch,", " pam_env_ignore_garbage.patch, dont_freeze_password_chain,", " pam_1.0.4_mindays, pam_mail-fix-quiet, pam_unix-chkpwd-wait, and", " cve-2009-0887-libpam-pam_misc.patch, which are included upstream.", " * Trim pam.d-manpage-section patch, which was mostly but not completely", " applied upstream.", " * Update debian/libpam0g.symbols for new extension.", " * Bump the shlibs version as well, for our dpkg-shlibdeps fallback.", " * And bump the version checks in the libpam-modules {pre,post}inst, so that", " the necessary services get restarted for any modules that need the new", " symbols.", " * Add /sbin/mkhomedir_helper to libpam-modules.", " * Document that pam_cracklib no longer checks /etc/security/opasswd.", " Closes: #263767.", " * debian/patches/007_modules_pam_unix: drop divergence from upstream", " that treats \"0\" as a special value in various fields in /etc/shadow,", " and document this in debian/NEWS. Thanks to Nicolas François", " for the detailed analysis.", " Closes: #308229.", " * Updated debconf translations:", " - French, thanks to Jean-Baka Domelevo Entfellner ", " (closes: #521266)", " * Build with LDFLAGS=-Wl,-z,defs to guard against the possibility of", " any undefined symbols (due to typos or otherwise) at build time.", " Closes: #102311.", " * On upgrade from versions before 1.1.0-1, if", " /etc/pam.d/common-session-noninteractive has not been created (because", " the user declined use of pam-auth-update), create it by copying", " /etc/pam.d/common-session. Closes: #543401.", " * debian/patches/fix-man-crud: new patch, fix \"undefined macro\" errors in", " manpages caused by oddities of toolchain used when generating them", " upstream.", "" ], "package": "pam", "version": "1.1.0-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 25 Aug 2009 20:35:26 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " * debian/local/pam-auth-update: prune some more md5sums from intrepid", " pre-release versions, reducing the Ubuntu delta some", " * debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.0.1-11ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 23 Aug 2009 20:14:58 -0700" }, { "cves": [], "log": [ "", " * debian/libpam-runtime.postinst: bump the --force version check to", " 1.0.1-11, to allow for a new common-session-noninteractive config file;", " and include md5sum checking logic that will work the same with old", " unmanaged and new managed /etc/pam.d/common-* files.", " * debian/local/common-{auth,account,session,password}.md5sums: document", " the known md5sums for the new managed files.", " * debian/local/common-session-noninteractive{,.md5sums},", " debian/local/pam-auth-update: split out a session-noninteractive include", " file, so that we can at last distinguish between interactive and", " non-interactive PAM sessions at a policy level. Closes: #169930,", " LP: #287715.", " * debian/local/pam-auth-update: prune md5sums for unsupported upgrade", " paths (intrepid pre-release -> karmic/squeeze)", " * Clean up the PAM mini-policy, which hasn't been touched in a number of", " years and was looking a bit crufty", " * debian/libpam-runtime.templates: correctly tag the URL as a", " non-translatable string.", " * Updated debconf translations:", " - Swedish, thanks to Martin Bagge (closes: #541399)", " - Portuguese, thanks to Américo Monteiro ", " (closes: #541108)", " - Russian, thanks to Yuri Kozlov (closes: #541094)", "" ], "package": "pam", "version": "1.0.1-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 287715 ], "author": "Steve Langasek ", "date": "Sun, 23 Aug 2009 18:07:11 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", "" ], "package": "pam", "version": "1.0.1-10ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 07 Aug 2009 09:50:02 +0100" }, { "cves": [ { "cve": "CVE-2009-0887", "url": "https://ubuntu.com/security/CVE-2009-0887", "cve_description": "Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.", "cve_priority": "low", "cve_public_date": "2009-03-12 15:20:00 UTC" } ], "log": [ "", " [ Steve Langasek ]", " * Updated debconf translations:", " - Finnish, thanks to Esko Arajärvi (closes: #520785)", " - Russian, thanks to Yuri Kozlov (closes: #521874)", " - German, thanks to Sven Joachim (closes: #521530)", " - Basque, thanks to Piarres Beobide ", " (closes: #524285)", " * When no profiles are chosen in pam-auth-update, throw an error message", " and prompt again instead of letting the user end up with an insecure", " system. This introduces a new debconf template. Closes: #519927,", " LP: #410171.", "", " [ Kees Cook ]", " * Add debian/patches/pam_1.0.4_mindays: backport upstream 1.0.4 fixes", " for MINDAYS-Field regression (closes: #514437).", " * debian/control: add missing misc:Depends for packages that need it.", "", " [ Sam Hartman ]", " * Remove conflicts information for transitions prior to woody release", " * Fix lintian overrides for libpam-runtime", " * Overrides for lintian finding quilt patches", " * pam_mail-fix-quiet: patch from Andreas Henriksson", " applied upstream to fix quiet option of pam_mail, Closes: #439268", "", " [ Dustin Kirkland ]", " * debian/patches/update-motd: run the update-motd scripts in pam_motd;", " render update-motd obsolete, LP: #399071", "", " [ Sam Hartman ]", " * cve-2009-0887-libpam-pam_misc.patch: avoid integer signedness problem", " (CVE-2009-0887) (Closes: #520115)", "" ], "package": "pam", "version": "1.0.1-10", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [ 410171, 399071 ], "author": "Steve Langasek ", "date": "Thu, 06 Aug 2009 17:54:32 +0100" }, { "cves": [], "log": [ "", " * Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", "" ], "package": "pam", "version": "1.0.1-9ubuntu3", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 15 Jul 2009 23:55:50 -0700" }, { "cves": [], "log": [ "", " [ Dustin Kirkland ]", " * debian/patches/update-motd: run the update-motd scripts in pam_motd;", " render update-motd obsolete, LP: #399071", " * debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", "" ], "package": "pam", "version": "1.0.1-9ubuntu2", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [ 399071 ], "author": "Steve Langasek ", "date": "Wed, 15 Jul 2009 20:41:52 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.0.1-9ubuntu1", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 20 Mar 2009 19:12:10 -0700" }, { "cves": [], "log": [ "", " * Move the pam module packages to section 'admin'.", " * 027_pam_limits_better_init_allow_explicit_root: defaults need to be", " declared as LIMITS_DEF_DEFAULT instead of LIMITS_DEF_ALL, otherwise", " global limits will fail to be applied. LP: #314222.", "" ], "package": "pam", "version": "1.0.1-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 314222 ], "author": "Steve Langasek ", "date": "Fri, 20 Mar 2009 19:48:47 -0700" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Bulgarian, thanks to Damyan Ivanov (closes: #518121)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #518214)", " - Swedish, thanks to Martin Bagge (closes: #518324)", " - Vietnamese, thanks to Clytie Siddall ", " (closes: #518329)", " - Japanese, thanks to Kenshi Muto (closes: #518335)", " - Slovak, thanks to Ivan Masár (closes: #518341)", " - Czech, thanks to Miroslav Kure (closes: #518992)", " - Portuguese, thanks to Américo Monteiro ", " (closes: #519204)", " - Galician, thanks to Marce Villarino ", " (closes: #519447)", " - Romanian, thanks to Eddy Petrișor ", " (closes: #520552)", " * 027_pam_limits_better_init_allow_explicit_root: set the RLIMIT_MEMLOCK", " limit correctly to match the kernel default, which is not RLIM_INFINITY.", " Closes: #472629.", "" ], "package": "pam", "version": "1.0.1-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 20 Mar 2009 18:15:07 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " * Dropped changes, merged in Debian:", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " - New patch dont_freeze_password_chain, cherry-picked from upstream:", " don't always follow the same path through the password stack on", " the PAM_UPDATE_AUTHTOK pass as was used in the PAM_PRELIM_CHECK", " pass; this Linux-PAM deviation from the original PAM spec causes a", " number of problems, in particular causing wrong return values when", " using the refactored pam-auth-update stack. LP: #303515, #305882.", " - debian/patches/027_pam_limits_better_init_allow_explicit_root:", " Add documentation to the patch showing how to set limits for root.", " * Bump the libpam-cracklib dependency on libpam-runtime to 1.0.1-6,", " reducing the delta with Debian.", " * Drop upgrade handling code from libpam-runtime.postinst that's only", " needed when upgrading from 1.0.1-2ubuntu1, a superseded intrepid", " pre-release version of the package.", " * pam-auth-update: swap out known md5sums from intrepid pre-release versions", " with the md5sums from the released intrepid version", " * pam-auth-update: drop some md5sums that will only be seen on upgrade from", " pre-intrepid versions; skipping over the 8.10 final release is not", " supported, and upgrading via 8.10 means those config files will be", " replaced so the old md5sums will never be seen again.", "" ], "package": "pam", "version": "1.0.1-7ubuntu1", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [ 303515, 305882 ], "author": "Steve Langasek ", "date": "Tue, 03 Mar 2009 17:34:19 -0800" }, { "cves": [], "log": [ "", " * 027_pam_limits_better_init_allow_explicit_root:", " - fix the patch so that our limit resets are actually *applied*,", " which has apparently been broken for who knows how long!", " - shadow the finite kernel defaults for RLIMIT_SIGPENDING and", " RLIMIT_MSGQUEUE as well, so that the preceding change doesn't", " suddenly expose systems to DoS or other issues.", " - include documentation in the patch, giving examples of how to set", " limits for root. Thanks to Jonathan Marsden.", " * pam-auth-update: swap out known md5sums from intrepid pre-release", " versions with the md5sums from the released intrepid version", " * pam-auth-update: set the umask, so we don't accidentally mark", " /etc/pam.d/common-* unreadable. Thanks to Martin Krafft for catching.", " Closes: #518042.", "" ], "package": "pam", "version": "1.0.1-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 03 Mar 2009 17:18:42 -0800" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Vietnamese, thanks to Clytie Siddall ", " * New patch dont_freeze_password_chain, cherry-picked from upstream:", " don't always follow the same path through the password stack on", " the PAM_UPDATE_AUTHTOK pass as was used in the PAM_PRELIM_CHECK", " pass; this Linux-PAM deviation from the original PAM spec causes a", " number of problems, in particular causing wrong return values when", " using the refactored pam-auth-update stack. LP: #303515, #305882.", " * debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", "" ], "package": "pam", "version": "1.0.1-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 303515, 305882 ], "author": "Steve Langasek ", "date": "Sat, 28 Feb 2009 13:36:57 -0800" }, { "cves": [], "log": [ "", " * New patch dont_freeze_password_chain, cherry-picked from upstream:", " don't always follow the same path through the password stack on", " the PAM_UPDATE_AUTHTOK pass as was used in the PAM_PRELIM_CHECK", " pass; this Linux-PAM deviation from the original PAM spec causes a", " number of problems, in particular causing wrong return values when", " using the refactored pam-auth-update stack. LP: #303515, #305882.", "" ], "package": "pam", "version": "1.0.1-5ubuntu2", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [ 303515, 305882 ], "author": "Steve Langasek ", "date": "Fri, 27 Feb 2009 16:20:24 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " * Bump the version numbers referenced in the config files, again, as pam", " has revved in Debian and moved the bar.", " * pam-auth-update: If /var/lib/pam/seen is absent, treat this the same", " as a present but empty file; thanks to Greg Price for the patch.", " LP: #294513.", " * pam-auth-update: Ignore removed profiles when detecting an empty set", " of currently-enabled modules. Thanks to Greg Price for this as well.", " * debian/control: libpam-runtime needs a versioned dependency on", " debconf, because it uses the x_loadtemplatefile extension that's ", " not supported by debconf versions before hardy. LP: #295135.", " * pam-auth-update: trim leading whitespace from multiline fields when", " parsing PAM profiles. LP: #295441.", " * pam-auth-update: factor out the duplicate code used for returning", " the lines for a given module", "", " [ Jonathan Marsden ]", " * debian/patches/027_pam_limits_better_init_allow_explicit_root:", " Add to patch, documenting how to set limits for root user.", " Include an example. Alters limits.conf, limits.conf.5.xml,", " and limits.conf.5 . (LP: #65244)", "" ], "package": "pam", "version": "1.0.1-5ubuntu1", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [ 294513, 295135, 295441, 65244 ], "author": "Steve Langasek ", "date": "Thu, 08 Jan 2009 20:26:25 +0000" }, { "cves": [], "log": [ "", " * Build-conflict with libxcrypt-dev, which otherwise pulls libxcrypt in as", " a dependency of libpam-modules if it's installed during the build.", " Thanks to Larry Doolittle for catching.", " * Don't refer to gnome-screensaver in the debconf template; it isn't", " actually affected by the libpam symbol issue because it forks a separate", " process to display the screensaver dialog.", " * Have libpam-modules Pre-Depend on ${misc:Depends}, so that we can", " warn users about needing to disable xscreensaver and xlockmore", " before libpam-modules is unpacked. Closes: #502140, LP: #256238.", " * Updated debconf translations for the new template:", " - Italian, thanks to David Paleino ", " - Simplified Chinese, thanks to Deng Xiyue", " (closes: #510371)", " - Portuguese, thanks to Américo Monteiro ", " - Swedish, thanks to Martin Bagge (closes: #510379)", " - Japanese, thanks to Kenshi Muto (closes: #510380)", " - Finnish, thanks to Esko Arajärvi (closes: #510382)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #510389)", " - Galician, thanks to Marce Villarino ", " - Slovak, thanks to helix84 (closes: #510412)", " - Bulgarian, thanks to Damyan Ivanov ", " - Czech, thanks to Miroslav Kure <", " (closes: #510608)", " - French, thanks to Steve Petruzzello ", " - German, thanks to Sven Joachim (closes: #510617)", " - Basque, thanks to Piarres Beobide ", " (closes: #510699)", " - Russian, thanks to Yuri Kozlov (closes: #510701)", " - Turkish, thanks to Mert Dirik (closes: #510707)", "" ], "package": "pam", "version": "1.0.1-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 256238 ], "author": "Steve Langasek ", "date": "Tue, 06 Jan 2009 00:05:13 -0800" }, { "cves": [], "log": [ "", " * No-change upload to jaunty to fix publication on armel.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.4", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 18 Nov 2008 14:09:00 +0000" }, { "cves": [], "log": [ "", " * No-change upload of 1.0.1-4ubuntu5.1 to -updates. -proposed package was", " copied while some ports were not built yet.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.3", "urgency": "low", "distributions": "intrepid-updates", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Tue, 11 Nov 2008 14:50:12 +0100" }, { "cves": [], "log": [ "", " * No-change rebuild because the archive admin (me) copied the package", " to jaunty too soon.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.2", "urgency": "low", "distributions": "intrepid-proposed", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 05 Nov 2008 20:28:11 +0000" }, { "cves": [], "log": [ "", " * Allow passwords to change on expired accounts, by passing", " new_authtok_reqd return codes immediately (LP: #291091).", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.1", "urgency": "low", "distributions": "intrepid-proposed", "launchpad_bugs_fixed": [ 291091 ], "author": "Kees Cook ", "date": "Wed, 05 Nov 2008 09:31:45 -0800" }, { "cves": [], "log": [ "", " * debian/libpam0g.postinst: change 'cupsys' to 'cups' in the list of", " default desktop services that are ignored in deciding whether to prompt", " for service restarts on upgrade. Partially addresses LP #278117.", " * debian/libpam0g.postinst: also filter out samba, which may be installed", " on the desktop to enable filesharing.", " * debian/libpam-cracklib.prerm, debian/libpam-runtime.prerm: add the", " ubiquitous debhelper tokens (currently a no-op)", " * pam-auth-update: Use -Initial only for the first profile, even when", " there's no explicit -Initial config for that first profile", " * fix common-session/common-password to use the same overall stack", " structure as auth/account, so that we get the correct behavior when", " all password modules fail. LP: #272232.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 272232 ], "author": "Steve Langasek ", "date": "Wed, 15 Oct 2008 18:11:13 -0700" }, { "cves": [], "log": [ "", " * Fix a bug in the parser that caused spewing of errors when there", " were more lines in the config file following the managed block.", " LP: #270328.", "" ], "package": "pam", "version": "1.0.1-4ubuntu4", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 270328 ], "author": "Steve Langasek ", "date": "Tue, 23 Sep 2008 06:34:56 +0000" }, { "cves": [], "log": [ "", " * Fix up the code that saves state to /var/lib/pam, so that it matches", " what's expected by the code which later compares the saved and active", " profiles in the case that there are both primary and additional", " modules present.", "" ], "package": "pam", "version": "1.0.1-4ubuntu3", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 16 Sep 2008 06:49:56 +0000" }, { "cves": [], "log": [ "", " * Brown paper bag bug: fix a missing comma in pam-auth-update.", "" ], "package": "pam", "version": "1.0.1-4ubuntu2", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 13 Sep 2008 08:55:32 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " * Bump the version numbers referenced in the config files, again, as pam", " has revved in Debian and moved the bar.", " * debian/pam-config/*: refine the password profiles to use a 'primary'", " block, to better parallel the auth structure.", " * Drop '-Final' from the field names in /usr/share/pam-configs, supporting", " these field names for backwards compatibility only", " * Bump the dependency version requirement to 1.0.1-4ubuntu1 for the above", " change", "" ], "package": "pam", "version": "1.0.1-4ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 13 Sep 2008 08:55:19 +0000" }, { "cves": [], "log": [ "", " * High-urgency upload for RC bugfix.", "", " [ Julien Cristau ]", " * pam_unix-chkpwd-wait: don't assume that the unix_chkpwd process exits", " normally; if it was killed by a signal, we don't want to accept the", " password. Closes: #495879.", "", " [ Steve Langasek ]", " * 007_modules_pam_unix: update the manpage at the same time as the xml", " source (grr, autogenerated files in source packages). Closes: #495804.", " * 055_pam_unix_nullok_secure: also don't call the helper at all from", " _unix_blankpasswd when we can detect that null passwords are disallowed,", " to avoid causing spammy logs on successful authentications.", " Closes: #496620.", " * debian/rules: call chgrp *before* calling chmod, lest the sgid bit", " on unix_chkpwd be cleared during the build when using -rsudo.", " Closes: #496983.", "" ], "package": "pam", "version": "1.0.1-4", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 28 Aug 2008 22:59:23 -0700" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * Never remove the .pam-old files; just avoid creating them if --force isn't", " set.", " * Add a manpage for pam-auth-update.", " * Automatically upgrade the boilerplate for /etc/pam.d/common-* if we", " detect that they have not been locally modified.", "", " [ Kees Cook ]", " * debian/local/common-password, debian/pam-configs/unix: switch from \"md5\"", " to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.0.1-3ubuntu5", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 26 Aug 2008 06:33:07 +0000" }, { "cves": [], "log": [ "", " * If two profiles have the same Priority, sort by the profile name to", " ensure a complete sort so we can filter out all the duplicates from the", " list and not write out broken configs. LP: #260371.", "" ], "package": "pam", "version": "1.0.1-3ubuntu4", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 260371 ], "author": "Steve Langasek ", "date": "Fri, 22 Aug 2008 17:33:14 +0000" }, { "cves": [], "log": [ "", " * s/pam-auth-config/pam-auth-update/ in the source, I can't seem to get", " this name consistent to save my life - I'm starting to think I named it", " wrong...", " * Fix the regex used when suppressing jump counts when reading the saved", " config, so that we don't clobber module options with numbers in them.", " * If the target doesn't already exist, don't try to copy it.", " * Filter the config list to exclude configs that no longer exist.", " LP: #260122.", " * Avoid unnecessary sort/grep in the case where we already have a sorted", " list.", " * Implement pam-auth-update --remove, for use in package prerms when called", " with \"remove\".", "" ], "package": "pam", "version": "1.0.1-3ubuntu3", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 260122 ], "author": "Steve Langasek ", "date": "Thu, 21 Aug 2008 15:38:37 -0700" }, { "cves": [], "log": [ "", " * debian/local/common-session: the session stack needs to be handled the", " same way as the password stack, with the possibility of zero primary", " modules; required to fix build failures on the Ubuntu buildds due to", " su not being able to open sessions by default. LP: #259867.", " * debian/libpam-runtime.postinst: when upgrading from the broken", " 1.0.1-2ubuntu1 version, manually edit /etc/pam.d/common-session to", " recover.", "" ], "package": "pam", "version": "1.0.1-3ubuntu2", "urgency": "high", "distributions": "intrepid", "launchpad_bugs_fixed": [ 259867 ], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 13:27:10 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " * Remove spurious 'conflict' with a non-existent module, which was added", " just as an example", "" ], "package": "pam", "version": "1.0.1-3ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 11:58:35 -0700" }, { "cves": [], "log": [ "", " * 055_pam_unix_nullok_secure: don't call _pammodutil_tty_secure with a NULL", " tty argument, since this will cause our helper to segfault instead of", " returning a useful value. Thanks to Troy Davis for the report.", " Closes: #495806.", "" ], "package": "pam", "version": "1.0.1-3", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 11:55:47 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam-runtime.postinst,", " debian/local/common-{auth,password}{,.md5sums}:", " Use the new 'missingok' option by default for pam_smbpass in case", " libpam-smbpass is not installed (LP: #216990); must use \"requisite\"", " rather than \"required\" to prevent \"pam_smbpass migrate\" from firing in", " the event of an auth failure; md5sums updated accordingly.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " * debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", "" ], "package": "pam", "version": "1.0.1-2ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 216990 ], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 09:17:28 +0000" }, { "cves": [], "log": [ "", " * 007_modules_pam_unix: update the documentation to correctly document", " the default minimum password length is 6, not 1.", " * Look for cups instead of cupsys as an init script name when restarting", " services; thanks to Stephen Olander-Waters for pointing this out.", " Closes: #492977.", " * Update the Debian PAM mini-policy to remove references to the", " long-obsolete pam_pwdb, and clarify the relationship between pam_stack", " and @include.", " * Drop various bits of unused cruft from the debian/ directory.", " * Drop libpam-runtime.preinst, only used for upgrades from woody to sarge", " to deal with modified conffiles.", " * Build-Conflict with libdb4.2-dev, which satisfies the libdb-dev", " build-dependency but causes pam_userdb to be silently omitted.", " Closes: #493574.", " * 054_pam_security_abstract_securetty_handling: move the warning log about", " an insecure tty back to pam_securetty proper; we don't want to generate", " log messages every time pam_unix is called as non-root.", " Closes: #493283. As a side-effect, pam_unix no longer logs any warnings", " about NULL password + insecure tty, but I don't think this is critical.", "" ], "package": "pam", "version": "1.0.1-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 08 Aug 2008 10:47:26 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Dropped changes:", " - Linux-PAM/modules/pam_selinux/pam_selinux.8: Ubuntu pam_selinux manpage", " is 2 years newer than Debian's, contains a number of character escaping", " fixes plus content updates", " - debian/patches-applied/ubuntu-pam_selinux_seusers: patch pam_selinux to", " correctly support seusers (backported from changes in PAM 0.99.8). ", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Bound RLIMIT_NICE", " from below as well as from above. Fix off-by-one error when converting", " RLIMIT_NICE to the range of values used by the kernel.", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam-runtime.postinst,", " debian/local/common-{auth,password}{,.md5sums}:", " Use the new 'missingok' option by default for pam_smbpass in case", " libpam-smbpass is not installed (LP: #216990); must use \"requisite\"", " rather than \"required\" to prevent \"pam_smbpass migrate\" from firing in", " the event of an auth failure; md5sums updated accordingly.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " * Refresh patch ubuntu-no-error-if-missingok for the new upstream version.", " * Change Vcs-Bzr to point at the new Ubuntu branch.", "" ], "package": "pam", "version": "1.0.1-1ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 216990 ], "author": "Steve Langasek ", "date": "Mon, 28 Jul 2008 20:58:26 +0000" }, { "cves": [], "log": [ "", " * New upstream version.", " - pam_limits: bound RLIMIT_NICE from below. Closes: #403718.", " - pam_mail: set the MAIL variable even when .hushlogin is set.", " Closes: #421010.", " - new minclass option introduced for pam_cracklib. Closes: #454237.", " - fix a failure to check the string length when matching usernames in", " pam_group. Closes: #444427.", " - fix setting shell security context in pam_selinux. Closes: #451722.", " - use --disable-audit, to avoid libaudit being linked in", " accidentally", " - pam_unix now supports SHA-256 and SHA-512 password hashes.", " Closes: #484249, LP: #245786.", " - pam_rhosts_auth is dropped upstream (closes: #382987); add a compat", " symlink to pam_rhosts to support upgrades for a release, and give a", " warning in NEWS.Debian.", " - new symbol in libpam.so.0, pam_modutil_audit_write; shlibs bump, and", " do another round of service restarts on upgrade.", " - pam_unix helper is now called whenever an unprivileged process", " tries and fails to query a user's account status. Closes: #367834.", " * Drop patches 006_docs_cleanup, 015_hurd_portability,", " 019_pam_listfile_quiet, 024_debian_cracklib_dict_path, 038_support_hurd,", " 043_pam_unix_unknown_user_not_alert, 046_pam_group_example,", " no_pthread_mutexes, limits_wrong_strncpy, misc_conv_allow_sigint.patch,", " pam_tally_audit.patch, 057_pam_unix_passwd_OOM_check, and", " 065_pam_unix_cracklib_disable which have been merged upstream.", " * Patch 022_pam_unix_group_time_miscfixes: partially merged upstream;", " now is really just \"pam_group_miscfixes\".", " * Patch 007_modules_pam_unix partially superseded upstream; stripping", " hpux-style expiry information off of password fields is now supported.", " * New patch pam_unix_thread-safe_save_old_password.patch, to make sure all", " our getpwnam() use in pam_unix is thread-safe (fixes an upstream", " regression)", " * New patch pam_unix_fix_sgid_shadow_auth.patch, fixing an upstream", " regression which prevents sgid shadow apps from being able to authenticate", " any more because the module forces use of the helper and the helper won't", " allow authentication of arbitrary users. This change does mean we're", " going to be noisier for the time being in an SELinux environment, which", " should be addressed but is not a regression on Debian.", " * New patch pam_unix_dont_trust_chkpwd_caller.patch, rolling back an", " upstream change that causes unix_chkpwd to assume that setuid(getuid())", " is sufficient to drop permissions and attempt any authentication on", " behalf of the user.", " * The password-changing helper functionality for SELinux systems has been", " split out into a separate unix_update binary, so at long last we can", " change unix_chkpwd to be sgid shadow instead of suid root.", " Closes: #155583.", " - Update the lintian override to match.", " * Install the new unix_update helper into libpam-modules.", " * Use a pristine upstream tarball instead of repacking; requires various", " changes to debian/rules and debhelper files.", " * Replace the Vcs-Svn field with a Vcs-Bzr field; jumping ship from svn,", " and how!", " * Debconf translations:", " - Romanian, thanks to Igor Stirbu ", " (closes: #491821)", " * Add libpam0g.symbols, for finer-grained package dependencies with", " dpkg-gensymbols.", " * Fix debian/copyright to list the known copyright holders", " * Fix up the doc-base sections for the libpam-doc documentation, \"Apps\"", " should not be part of the section name", " * Also fix up whitespace issues in the doc-base abstracts", " * Fix a typo in the libpam0g-dev description.", " * 027_pam_limits_better_init_allow_explicit_root: RLIM_INFINITY is also", " invalid for RLIMIT_NOFILE, so when resetting the limits for a new session,", " use the kernel default of 1024 instead. Closes: #404836.", " * Create /etc/environment on initial install of libpam-modules (or on", " upgrade from an old version), to quell warnings in the logs about it", " being missing. Closes: #442049.", " * 026_pam_unix_passwd_unknown_user: drop a redundant, and broken, check for", " the NSS source of our user; this was preventing password changes for NIS", " users, which otherwise should have worked. Closes: #203222, LP: #9224.", " * New patch do_not_check_nis_accidentally: respect the 'nis' option", " (set or unset) when looking up the user's password entry for password", " changes. Thanks to Quentin Godfroy for the", " patch. Closes: #469635.", " * Drop patch 049_pam_unix_sane_locking, which upon review is not needed;", " it reduces the length of time we hold the lock, but at the expense of", " being able to enforce minimum times between password changes.", " * debian/watch: upstream has hit 1.0, so we're no longer in a \"pre\"", " directory. Fix up the regex for uscan.", " * Fix the libpam0g-dev examples directory to not include a gratuitous", " .cvsignore file.", " * New patch, pam.d-manpage-section, to fix the manpage references to", " point to section 5 instead of section 8.", " * Update patch PAM-manpage-section to fix the references to pam(7) from", " other manpages. Closes: #470137.", " * Add debian/README.source documenting that this package uses quilt.", " * Bump Standards-Version to 3.8.0.", " * Fix a bug in the uid-restoring code in the hurd_no_setfsuid patch; thanks", " to Tomas Mraz for indirectly bringing this to my", " attention", "" ], "package": "pam", "version": "1.0.1-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 245786, 9224 ], "author": "Steve Langasek ", "date": "Mon, 28 Jul 2008 13:56:26 -0700" }, { "cves": [], "log": [ "", " * Medium-urgency upload for RC bugfix", " * Debconf translations:", " - Italian, thanks to David Paleino (closes: #483913)", " - Slovak, thanks to Ivan Masár (closes: #488908)", " - Turkish, thanks to Mert Dirik (closes: #490880)", " - Basque, thanks to Piarres Beobide ", " (closes: #473975)", " * Drop the 'XS' from Vcs-Svn/Vcs-Browser, since these are now officially", " recognized fields.", " * Add a Homepage field. Closes: #473338.", " * Drop -DCRACKLIB_DICTS from CFLAGS, since the referenced define is no", " longer provided by cracklib2-dev 2.8 and above. This requires a", " build-dependency on the corresponding version of libcrack2-dev.", " Closes: #490236.", "" ], "package": "pam", "version": "0.99.7.1-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 21 Jul 2008 11:49:59 -0700" }, { "cves": [], "log": [ "", " * debian/libpam-modules.postinst: revert addition of ~/bin to the end of the", " default PATH set in /etc/environment as it was pointed out by Colin", " Watson that getenv() does not properly expand '~'", "" ], "package": "pam", "version": "0.99.7.1-6ubuntu2", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Jamie Strandboge ", "date": "Tue, 24 Jun 2008 06:29:40 -0400" }, { "cves": [], "log": [ "", " * Merge from debian unstable", " * Dropped changes:", " - Linux-PAM/modules/pam_limits/README,", " Linux-PAM/modules/pam_selinux/README: Ubuntu versions had some", " insignificant character differences, dropping in favor of Debian", " versions; pam_selinux documentation has dropped \"multiple\", and added", " \"select_context\", and \"use_current_range\" as options.", " - debian/control, debian/local/common-session{,md5sums}: use", " libpam-foreground for session management.", " - Build using db4.5 instead of db4.6.", " * Remaining changes:", " - Linux-PAM/modules/pam_selinux/pam_selinux.8: Ubuntu pam_selinux manpage", " is 2 years newer than Debian's, contains a number of character escaping", " fixes plus content updates; (should send to Debian).", " - debian/control: Maintainer updated.", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf; add ~/bin to PATH", " (LP: #64064); (should send to Debian).", " - debian/libpam-runtime.postinst,", " debian/local/common-{auth,password}{,.md5sums}:", " Use the new 'missingok' option by default for pam_smbpass in case", " libpam-smbpass is not installed (LP: #216990); must use \"requisite\"", " rather than \"required\" to prevent \"pam_smbpass migrate\" from firing in", " the event of an auth failure; md5sums updated accordingly.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running (LP: #141309).", " - debian/applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-pam_selinux_seusers: patch pam_selinux to", " correctly support seusers (backported from changes in PAM 0.99.8). ", " Without this patch login will not get correct security context when ", " using libselinux >= 1.27.2 (LP: #187822).", " - debian/patches-applied/ubuntu-regression_fix_securetty: securetty's", " earlier behavior would correctly prompt for password on bad usernames", " (LP: #139075).", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits. Bound", " RLIMIT_NICE from below as well as from above. Fix off-by-one error when", " converting RLIMIT_NICE to the range of values used by the kernel.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " * Alphabetized this merge changelog entry by filename (easier reading", " against Ubuntu patch).", "" ], "package": "pam", "version": "0.99.7.1-6ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 64064, 216990, 141309, 187822, 139075 ], "author": "Dustin Kirkland ", "date": "Fri, 20 Jun 2008 10:32:00 -0500" }, { "cves": [], "log": [ "", " * Debconf translations:", " - Updated Vietnamese, thanks to Clytie Siddall ", " (closes: #444437)", " - Updated Spanish, thanks to Javier Fernández-Sanguino Peña", " (closes: #444479)", " - Updated German, thanks to Sven Joachim ", " (closes: #444566)", " - Galician, thanks to Jacobo Tarrio (closes: #444758)", " - Updated Czech, thanks to Miroslav Kure ", " (closes: #445022)", " - French, thanks to Cyril Brulebois ", " (closes: #445869)", " - Japanese, thanks to Kenshi Muto (closes: #446584)", " - Dutch, thanks to Bart Cornelis (closes: #448930)", " - Basque, thanks to Piarres Beobide (closes: #457042)", " - Updated Finnish, thanks to Esko Arajärvi (closes: #458264)", " - Swedish, thanks to Christer Andersson ", " (closes: #457674)", " * Make sure the \"audit\" option is specified in octal instead of in decimal,", " so that it doesn't randomly set other options. Thanks to Corey Wright", " for the catch. Closes: #446327.", "" ], "package": "pam", "version": "0.99.7.1-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 16 Mar 2008 02:06:28 -0700" }, { "cves": [], "log": [ "", " * debian/libpam-modules.postinst: Add ~/bin to the end of the default PATH", " set in /etc/environment (LP: #64064).", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu8", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 64064 ], "author": "Dustin Kirkland ", "date": "Thu, 19 Jun 2008 12:52:48 -0500" }, { "cves": [], "log": [ "", " * debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " * debian/local/common-{auth,password}, debian/libpam-runtime.postinst:", " Use the new 'missingok' option by default for pam_smbpass, to", " correct the problem of very loud logging introduced in the previous", " upload when libpam-smbpass is not installed. LP: #216990.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu7", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 216990 ], "author": "Steve Langasek ", "date": "Tue, 22 Apr 2008 18:53:37 +0000" }, { "cves": [], "log": [ "", " * debian/local/common-{auth,password}, debian/libpam-runtime.postinst:", " Add pam_smbpass as an optional module in the stack, to keep NTLM", " passwords (for filesharing) in sync with the main system passwords on a", " best-effort basis. LP: #208419.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu6", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [ 208419 ], "author": "Steve Langasek ", "date": "Tue, 08 Apr 2008 18:21:40 +0000" }, { "cves": [], "log": [ "", " * debian/local/common-session: Drop libpam-foreground. It's gone for good,", " and we do not want this in the PAM config for new installations, since it", " just spams syslog with error messages. (LP: #198714)", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu5", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [ 198714 ], "author": "Martin Pitt ", "date": "Tue, 11 Mar 2008 11:22:11 +0100" }, { "cves": [], "log": [ "", " * ubuntu-pam_selinux_seusers: patch pam_selinux to correctly support", " seusers (backported from changes in PAM 0.99.8). Without this patch", " login will not get correct security context when using libselinux", " >= 1.27.2 (LP: #187822).", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu4", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [ 187822 ], "author": "Caleb Case ", "date": "Wed, 30 Jan 2008 06:39:48 -0500" }, { "cves": [], "log": [ "", " * Temporarily reenable libpam-foreground in common-session again, until", " dbus' at_console policy works with ConsoleKit.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu3", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Thu, 29 Nov 2007 15:17:54 +0100" }, { "cves": [], "log": [ "", " * debian/local/common-session{,.md5sums}, debian/control: Drop", " libpam-foreground, superseded by ConsoleKit integration into hal.", " * debian/control: Build against libdb4.6 again. This drops this Debian delta", " and 4.6 is our target version in Hardy.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu2", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Thu, 22 Nov 2007 18:56:47 +0100" }, { "cves": [], "log": [ "", " * Resynchronise with Debian. Remaining changes:", " - debian/control, debian/local/common-session{,md5sums}: use", " libpam-foreground for session management.", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf.", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits. Bound", " RLIMIT_NICE from below as well as from above. Fix off-by-one error when", " converting RLIMIT_NICE to the range of values used by the kernel.", " (Originally patch 101; converted to quilt.)", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - debian/patches-applied/ubuntu-regression_fix_securetty: securetty's", " earlier behavior would correctly prompt for password on bad usernames", " (LP: #139075).", " - Build using db4.5 instead of db4.6.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running (LP: #141309).", " * debian/libpam0g.postinst: don't display a debconf warning about display", " managers that need restarting when update-manager is running, instead", " signal to update-notifier if a reboot is required.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu1", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 139075, 141309 ], "author": "Steve Langasek ", "date": "Fri, 28 Sep 2007 23:45:24 -0700" }, { "cves": [], "log": [ "", " * More lintian overrides, related to debconf prompting in the postinst", " * Debconf translations:", " - Brazilian Portuguese, thanks to Eder L. Marques ", " (closes: #440385)", " - Russian, thanks to Yuri Kozlov ", " (closes: #440390, #440953, #444039)", " - Bulgarian, thanks to Damyan Ivanov ", " (closes: #441863)", " - Finnish, thanks to Esko Arajärvi (closes: #443720)", " - Simplified Chinese, thanks to Ming Hua", " (closes: #443924)", " - Updated Portuguese, thanks to Américo Monteiro ", " - Updated Vietnamese, thanks to Clytie Siddall ", " (closes: #440800)", " - Updated German, thanks to Sven Joachim ", " - Updated Spanish, thanks to Javier Fernández-Sanguino Peña", " ", " - Updated Czech, thanks to Miroslav Kure ", " (closes: #441325)", " * Further cleanups of 007_modules_pam_unix -- don't use a global variable", " for pass_min_len, don't gratuitously move the length checking into the", " \"obscure\" checks, and internationalize the error strings.", " * Stop overriding the built-in default minimum password length in", " /etc/pam.d/common-password, and also drop the \"max\" option which has now", " been obsoleted.", " * Fix up the comments in /etc/pam.d/common-password to make it clear that", " the options are specific to pam_unix. Closes: #414559.", " * Patch 038: fix another thinko in the getline handling. Closes: #442276.", " * If there are active X logins, don't restart kdm, wdm, and xdm by default;", " instead, display a debconf error if they haven't been restarted.", " Closes: #441843.", " * Drop the local patch for Linux capabilities in pam_limits; Linux", " capabilities are not generally useful in a PAM context, and the PAM", " capabilities patch has been broken through much of its life.", " Closes: #440130.", " * -Wl,-z,defs was never enabled correctly, drop it since upstream is", " already using -no-undefined", " * Pass --build and --host args to ./configure as necessary, for", " cross-building support.", "" ], "package": "pam", "version": "0.99.7.1-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 28 Sep 2007 00:17:00 -0700" }, { "cves": [], "log": [ "", " * debian/libpam0g.postinst: call \"reload\" for all display managers", " (LP: #139065).", " * debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running (LP: #141309).", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu4", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 139065, 141309 ], "author": "Kees Cook ", "date": "Mon, 24 Sep 2007 15:01:29 -0700" }, { "cves": [], "log": [ "", " * ubuntu-regression_fix_securetty: securetty's earlier behavior would", " correctly prompt for password on bad usernames (LP: #139075).", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu3", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 139075 ], "author": "Kees Cook ", "date": "Wed, 12 Sep 2007 15:20:09 -0700" }, { "cves": [], "log": [ "", " * Build using db4.5 (instead of db4.6). One db4.x version less on the CD.", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu2", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Wed, 12 Sep 2007 17:44:25 +0200" }, { "cves": [], "log": [ "", " * Resynchronise with Debian (LP: #43169, #14505, #80431). Remaining changes:", " - debian/control, debian/local/common-session{,md5sums}: use", " libpam-foreground for session management.", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf.", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits. Bound", " RLIMIT_NICE from below as well as from above. Fix off-by-one error when", " converting RLIMIT_NICE to the range of values used by the kernel.", " (Originally patch 101; converted to quilt.)", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " * Dropped:", " - debian/rules: bashism fixes (merged upstream).", " - debian/control: Conflict on ancient nis (expired with Breezy).", " - debian/libpam-runtime.postinst: check for ancient pam (expired with", " Breezy).", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu1", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 43169, 14505, 80431 ], "author": "Kees Cook ", "date": "Wed, 05 Sep 2007 15:18:36 -0700" }, { "cves": [], "log": [ "", " * libpam0g.postinst, libpam0g.templates: gdm doesn't need to be restarted", " to fix the library skew, only reloaded; special-case this daemon in the", " postinst and remove the mention of it from the debconf template, also", " tightening the language of the debconf template in the process.", " Closes: #440074.", " * Add courier-authdaemon to the list of services that need to be", " restarted; thanks to Micah Anderson for reporting.", " * New patch pam_env_ignore_garbage.patch: fix pam_env to really skip over", " garbage lines in /etc/environment and log an error, instead of failing", " with an obscure error; and ignore any PAM_BAD_ITEM values returned", " by pam_putenv(), since this is the expected error return when trying", " to delete a non-existent var. Closes: #439984.", " * Yet another thinko in hurd_no_setfsuid and in", " 029_pam_limits_capabilities; this code should really be Hurd-safe at", " last...", " * getline() returns -1 on EOF, not 0; check this appropriately, to fix", " an infinite loop in pam_rhosts_auth. Thanks to Stephan Springl", " for the fix. Closes: #440019.", " * Use ${misc:Depends} for libpam0g, so we get a proper dependency on", " debconf.", " * 019_pam_listfile_quiet: per discussion with upstream, don't suppress", " errors about missing files or files with wrong permissions; these are", " real errors that should not be buried.", " * Drop the remainder of 061_pam_issue_double_free, not required for the", " original bugfix.", " * Drop patch 064_pam_unix_cracklib_dictpath, which is not needed now that", " we define CRACKLIB_DICTS in debian/rules.", " * Drop patch 063_paswd_segv, superseded by a different upstream fix", " * Split 047_pam_limits_chroot_string_value up between", " 008_modules_pam_limits_chroot and 029_pam_limits_capabilites", " * Updates to patch 007_modules_pam_unix: restore the same built-in min", " password len of 6 that upstream uses; fix a typo panlindrome ->", " palindrome.", " * The 'max=' option was never intended to be used to limit maximum password", " length for users, only to declare what the number of significant", " characters /is/ for a password. But we don't need a config option to", " tell us that, we know the answer based on which crypt type we're using,", " so drop this as a config file option. Closes: #389197.", " * Debconf translations:", " - Spanish, thanks to Javier Fernández-Sanguino Peña ", " - Vietnamese, thanks to Clytie Siddall ", " - German, thanks to Sven Joachim (closes: #440355)", " - Czech, thanks to Miroslav Kure ", " (closes: #440362)", " - Portuguese, thanks to Américo Monteiro ", " (closes: #440368)", "" ], "package": "pam", "version": "0.99.7.1-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 31 Aug 2007 17:11:05 -0700" }, { "cves": [], "log": [ "", " * New patch limits_wrong_strncpy: fix unnecessary manipulations of string", " buffers, including an illegal use of strncpy(). Thanks to Paul Hampson", " for reporting. Closes: #331278.", " * New patch misc_conv_allow_sigint.patch: allow SIGINT to be handled by the", " application, instead of blocking it when misc_conv is in use and", " preventing users from being able to ^C at any PAM prompt. Closes: #1708.", " * 024_debian_cracklib_dict_path: default to NULL instead of a specific", " dictionary path when none is defined for consistency with the new upstream", " version of cracklib, and define our path in debian/rules.", " * 055_pam_unix_nullok_secure: document the pam_unix \"nullok_secure\" option,", " a prereq for forwarding this patch upstream. Closes: #325974.", " * Create /etc/security/opasswd on new installs or on upgrades from", " 0.99.7.1-2 or below, so that users that enable the remember= option to", " pam_unix aren't left unable to change passwords. Closes: #95324.", " * Fix a couple of thinkos in hurd_no_setfsuid, that were preventing the code", " from compiling on the Hurd still. Thanks to Michael Banck for the catch.", " * Fix a memory leak in the pam_limits capabilities patch: always", " cap_free() the cap_t before returning from pam_sm_open_session().", " Closes: #153157.", " * libpam0g.postinst, libpam0g.templates: on upgrades from versions", " prior to 0.99.7.1-3, restart known PAM-using services so that they", " get the new libpam symbols, since otherwise the newer PAM modules", " will fail to load. Postinst taken from libssl0.9.8; thanks to", " Christoph Martin for the fine example! Closes: #439835.", " * Build-depend on po-debconf to support l10n of the debconf questions", " from the above.", "" ], "package": "pam", "version": "0.99.7.1-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 28 Aug 2007 06:33:33 -0700" }, { "cves": [ { "cve": "CVE-2005-2977", "url": "https://ubuntu.com/security/CVE-2005-2977", "cve_description": "The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unix_chkpwd, which does not log failed guesses or delay its responses.", "cve_priority": "medium", "cve_public_date": "2005-11-01 12:47:00 UTC" } ], "log": [ "", " * New upstream release; thanks to Roger Leigh and Jan Christoph Nordholz", " for their extensive work in helping to prepare for this update in Debian.", " Closes: #360460.", " - now uses autoconf for library detection, so SELinux should not be", " unconditionally enabled on non-Linux archs. Closes: #333141.", " - pam_mail notice handling has been completely reworked, so there should", " no longer be missing spaces in the messages. Closes: #119689.", " - with libtool and autoconf, now behaves \"sensibly\" on unknown", " platforms. Closes: #165067.", " - the source now builds without warnings. Closes: #212165.", " - uses automake instead of hand-rolled makefiles with indentation", " bugs. Closes: #241661, #328084.", " - pam_mkhomedir now creates directories recursively as needed.", " Closes: #178225.", " - pam_listfile now supports being used as a session module too.", " Closes: #416665.", " - misspelled pam_userdb log message has been corrected. Closes: #305058.", " - the current pam_strerror manpage no longer mentions \"Unknown", " Linux-PAM error\". Closes: #220157.", " - the text documentation no longer uses ANSI bold sequences.", " Closes: #181451.", " - pam_localuser now supports being used as a session module.", " Closes: #412484.", " - package no longer fails to build with dash as /bin/sh.", " Closes: #331208.", " - All modules should now be documented in the system administrator", " guide. Closes: #350620.", " - pam_userdb now logs an error instead of segfaulting when no db=", " option is provided. Closes: #436005.", " - pam_time now warns on a missing tty instead of erroring out,", " making it possible to use the module with non-console services.", " Closes: #127931.", " - upstream changelog is now 'ChangeLog' instead of 'CHANGELOG'; install", " accordingly", " - bump the shlibs", " - the 'test.c' example no longer exists", " - add /usr/share/locale to libpam-runtime.", " - CVE-2005-2977: only uid=0 is allowed to invoke unix_chkpwd with an", " arbitrary username, and then only when SELinux is active.", " Closes: #336344.", " * Mark myself as primary maintainer as previously discussed with Sam, and", " add Roger as an uploader.", " * Refactor to use quilt.", " * Update to Standards-Version 3.7.2.", " * Drop unnecessary build-dependency on patch, which is", " build-essential (and no longer invoked directly).", " * Drop patches 002_debian_no_ldconfig_call, 010_pam_cplusplus,", " 018_man_fixes, 030_makefile_link_against_libpam,", " 037_pam_issue_ttyname_can_be_null, 044_configure_supports_bsd,", " 050_configure_in_gnu and 052_pam_unix_no_openlog, which have been", " superseded upstream.", " * Drop patches 005_pam_limits_099_6,", " 012_pam_group_less_restrictive_charset, 023_pam_env_limits_miscfixes,", " 048_pam_group_colon_valid_char, 058_pam_env_enable, 059_pam_userdb_segv,", " 060_pam_tally_segv and 062_c++_safe_headers, which have been integrated", " upstream.", " * Patch 057: SELinux support is merged upstream, leaving only an", " unrelated OOM check for pam_unix_passwd. Rename as", " 057_pam_unix_passwd_OOM_check.", " * Patches 006, 008, 036: update for the switch from SGML to XML.", " * Patch 007: update for the switch from SGML to XML; drop some log", " messages that were already added upstream; update for the pam_modutil", " changes; tighten the flag handling of the 'obscure' option; drop bogus", " check in unix_chkpwd for null passwords. Also fix a grammar error", " along the way. Closes: #362855.", " * Patch 024: CRACKLIB_DICTPATH is no longer set in configure.in, so patch", " pam_cracklib.c instead to use the default dictpath already available", " from crack.h; and patch configure.in to use AC_CHECK_HEADERS instead", " of AC_CHECK_HEADER, so crack.h is actually included. Also remove", " unnecessary string copies, which break on the Hurd due to PATH_MAX.", " * Patch 038: partially merged/superseded upstream; also add new Hurd", " fix for pam_xauth.", " * Patch 061: partially merged upstream", " * Use ${binary:Version} instead of ${Source-Version} in", " debian/control.", " * Remove empty maintainer scripts debian/libpam0g-dev.{postinst,prerm},", " debian/libpam0g.{postinst,prerm}, and", " debian/libpam-modules.{postinst,prerm}; debhelper can autogenerate these", " just fine without our help.", " * Build-Depend on xsltproc, libxml2-utils, docbook-xml, docbook-xsl", " and w3m instead of on linuxdoc-tools, linuxdoc-tools-latex, tetex-extra,", " groff, and opensp.", " * Also build-depend on flex for libfl.a.", " * Updates for documentation handling:", " - move debian/local/pam-*-guide to debian/libpam-doc.doc-base.foo-guide,", " and invoke dh_installdocs instead of installing these by hand.", " - drop libpam-doc.{postinst,prerm}, which are no longer needed.", " - add an install target to debian/rules, and have binary-indep depend on", " it instead of trying to install doc files individually from the source", " tree", " - consequently, drop libpam-doc.dirs as well which is no longer needed", " and no longer accurate", " - add debian/libpam-doc.install for moving the docs to the right place,", " and also replace libpam-runtime.files with libpam-runtime.install;", " for the moment this means we're using both dh_movefiles and", " dh_install...", " - libpam0g.docs: install the Debian-PAM-MiniPolicy from here, further", " cleaning up debian/rules", " * Drop debian/libpam0g.links, no longer needed because upstream now has a", " working install target which creates the library symlinks", " * Add libpam-modules.links: create pam_unix_{acct,auth,passwd,session}.so", " symlinks by hand, no longer provided upstream.", " * debian/patches-applied/PAM-manpage-section: \"PAM\" is not a daemon, manpage", " belongs in section 7, not in section 8.", " * Actually ship the pam, pam.conf, and pam.d manpages in libpam-runtime.", " * debian/patches-applied/autoconf.patch: move all changes to autotools", " generated files into a single patch at the end of the stack.", " - don't touch configure in debian/rules, the quilt patch takes care", " of this for us.", " * New patch 064_pam_unix_cracklib_dictpath: correctly define", " CRACKLIB_DICTS, since this is not defined by configure. Thanks to Jan", " Christoph Nordholz.", " * New patch 065_pam_unix_cracklib_disable: Debian-specific patch to disable", " cracklib support in pam_unix. Thanks to Christoph Nordholz.", " * debian/rules:", " - Rename OS_CFLAGS to CFLAGS.", " - kill off references to unused variables", " - make binary-arch also depend on the install target, and streamline the", " rules", " - fix up the clean target to not ignore errors; thanks to Roger Leigh", " - drop the local module_check target in favor of using -Wl,-z,defs", " in LDFLAGS to enforce correct linkage of all objects at build time", " * Drop debian/local/unix_chkpwd.8 in favor of the upstream manpage.", " * libpam-modules.files: /usr/sbin/pam_tally has moved to /sbin/pam_tally", " for consistency.", " * Update to debhelper V5.", " * Don't ship Makefiles as part of the libpam0g-dev examples.", " * libpam-modules.manpages, libpam-runtime.manpages, libpam0g-dev.manpages:", " put all the manpages in the correct packages. Closes: #411812,", " #62193, #313486, #300773, #330545, #184270.", " * Drop libpam{0g,0g-dev,-modules,-runtime}.dirs, not needed for anything", " because we aren't trying to ship empty directories in the packages", " * Build-Conflict with fop, to avoid unreproducible builds of pdf", " documentation from a tool in contrib.", " * libpam-cracklib should depend on a real wordlist package, per policy;", " use wamerican as the default.", " * Drop local/pam-undocumented.7 from the package, since we no longer have", " a reason to ship it", " * Add lintian overrides for known false-positives", " * Conflicts/Replaces/Provides libpam-umask, now included upstream.", " Closes: #436222.", " * Upstream no longer marks unix_chkpwd suid-root for us, so set the perms", " by hand in debian/rules. In the process, unix_chkpwd is now writable", " by the owner, as expected by policy. Closes: #368100.", " * Migrate from db4.3 to db4.6; once again, no administrator action should", " be needed for upgrading on-disk database formats. Closes: #354309.", " * Add XS-Vcs-Svn and XS-Vcs-Browser fields to debian/control; thanks to", " Laurent Bigonville for the hint. Closes: #439038.", " * Add a watch file for use with uscan; thanks to Laurent Bigonville for", " this patch as well. Closes: #439040.", " * Rewrite of 031_pam_include, fixing a memory leak and letting us drop", " patch 056_no_label_at_end; thanks to Jan Christoph Nordholz", " for this much-improved version!", " * New patch no_pthread_mutexes: don't use pthread mutexes in", " pam_modutil functions, they're not needed because pam handles", " themselves should not be used concurrently by multiple threads and", " using pthreads causes problems for portable linking.", " * New patch hurd_no_setfsuid: if we don't have sys/fsuid.h, work around", " using setreuid instead.", "" ], "package": "pam", "version": "0.99.7.1-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 26 Aug 2007 19:15:09 -0700" }, { "cves": [], "log": [ "", " * Remove /usr/bin/X11 from default PATH (new installs only).", "" ], "package": "pam", "version": "0.79-4ubuntu2", "urgency": "low", "distributions": "feisty", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Wed, 20 Dec 2006 16:14:37 +0000" }, { "cves": [], "log": [ "", " * Resynchronise with Debian. Remaining changes:", " - Patch 100 (renumbered from 060): Look at ~/.pam_environment too, with", " the same format as /etc/security/pam_env.conf.", " - Patch 101 (renumbered from 061): Explicitly initialise RLIMIT_NICE", " rather than relying on the kernel limits. Bound RLIMIT_NICE from below", " as well as from above. Fix off-by-one error when converting", " RLIMIT_NICE to the range of values used by the kernel.", " - Add PATH to /etc/environment if it's not present there or in", " /etc/security/pam_env.conf.", " - debian/rules: Fix a bashism.", " - Install unix_chkpwd setgid shadow instead of setuid root. The nis", " package handles overriding this as necessary.", " - Use pam_foreground in the default session.", " - Linux-PAM/libpamc/test/regress/test.libpamc.c: Use standard u_int8_t", " type rather than __u8.", "" ], "package": "pam", "version": "0.79-4ubuntu1", "urgency": "low", "distributions": "feisty", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 19 Dec 2006 10:32:47 +0000" }, { "cves": [], "log": [ "", " * Medium-urgency upload; at least one RC bugfix, but also a", " significant number of changes, hence not urgency=high.", " * Move libpam-modules and libpam0g to Section: libs and libpam-runtime", " to section: admin, to match the overrides in the archive.", " * Move old changelog entries (well, entry) that don't follow the current", " format to debian/changelog.old, since there's no way to figure out a", " timestamp for an 8-year-old upload, and this is the most effective", " way to clear a glut of lintian warnings.", " * Fix the formatting of the libpam-cracklib package description.", " * Patch 010: remove parts of the patch that aren't necessary for C++", " compatibility.", " * Patch 060: fix a segfault in pam_tally caused by misuse of", " pam_get_data(); already fixed upstream. Closes: #335273.", " * Patch 061: fix a double free in pam_issue, caused by overuse (and misuse)", " of strdup (similar to patch 059). Already fixed upstream.", " Closes: #327272.", " * Don't build-depend on libselinux1-dev and libcap-dev on kfreebsd archs.", " Closes: #352329.", " * Patch 005: sync pam_limits with upstream:", " - support \"-\" (unlimited) for all limit types except process priority.", " - support the additional aliases \"-1\", \"unlimited\", and \"infinity\" for", " clearing the limits; closes: #122400, #149027.", " - restrict the range of process priority, login count, and system login", " count settings to (INT_MIN,INT_MAX) (heh).", " - special-case RLIM_INFINITY when applying multipliers to values from", " the config.", " - document maxsyslogins in the default limits.conf; closes: #149883.", " - use the current process priority as a default instead of resetting to", " 0; closes: #241663.", " - add support for (and document) new RLIMIT_NICE and RLIMIT_RTPRIO", " settings in Linux 2.6.12 and above; closes: #313542, #313588.", " - allow imposing limits on uid=0.", " * Patch 027: only set RLIM_INFINITY as the default for the limits where", " we know this is sensible, so that recompiling in an environment with new", " limits doesn't create a security hole -- as happened with RLIMIT_NICE and", " RLIMIT_RTPRIO! Thanks to Ville Hallik for the initial patch.", " Closes: #388431.", " * Patch 029, 047: Fix up the broken pam_limits capabilities patch so it", " actually works -- which may well be a first... Closes: #318452.", "" ], "package": "pam", "version": "0.79-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 23 Oct 2006 05:36:08 -0700" }, { "cves": [], "log": [ "", " * Non-maintainer upload to fix important bug, that makes passwd segfault", " when CTRL-D is pressed at the password prompt. Applied the patch", " provided by Dann Frazier. (Closes: #360657)", "" ], "package": "pam", "version": "0.79-3.2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Margarita Manterola ", "date": "Sat, 5 Aug 2006 02:11:22 -0300" }, { "cves": [], "log": [ "", " * Resynchronise with Debian.", "" ], "package": "pam", "version": "0.79-3.1ubuntu1", "urgency": "low", "distributions": "edgy", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 29 Jun 2006 17:27:34 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Linux-PAM/libpamc/include/security/pam_client.h,", " Linux-PAM/libpamc/pamc_converse.c: Apply patch from", " latest upstream version to remove redefinition of internal", " glibc/libstdc++ types. Closes: #344447.", "" ], "package": "pam", "version": "0.79-3.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Roger Leigh ", "date": "Sun, 5 Feb 2006 21:46:59 +0000" }, { "cves": [], "log": [ "", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: Protect use of", " RLIMIT_NICE in init_limits() with an #ifdef.", "" ], "package": "pam", "version": "0.79-3ubuntu14", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Fri, 12 May 2006 17:42:40 +0100" }, { "cves": [], "log": [ "", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: Set soft and hard", " nice limits to 20 (= userland nice value 0) rather than unlimited by", " default. Correct off-by-one error (the same error as in Linux 2.6.12,", " but fixed in 2.6.13) in user<->kernel translation of nice limit.", "" ], "package": "pam", "version": "0.79-3ubuntu13", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 11 May 2006 11:29:58 +0100" }, { "cves": [], "log": [ "", " * debian/control: Add libpam-foreground dependency to libpam-runtime, since", " the default /etc/pam.d/common-session refers to it. Closes: LP#35142", "" ], "package": "pam", "version": "0.79-3ubuntu12", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Mon, 10 Apr 2006 14:42:40 +0200" }, { "cves": [], "log": [ "", " [ Dana Olson ]", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: removed glibc", " workaround now that glibc is aware of rlimits.", "", " [ Martin Pitt ]", " * debian/rules: Fix bashisms.", "" ], "package": "pam", "version": "0.79-3ubuntu11", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Thu, 6 Apr 2006 15:03:37 +0200" }, { "cves": [], "log": [ "", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: Support \"nice\" and", " \"rtprio\" rlimits, new in Linux 2.6.12. Backported from upstream thanks", " to Dana Olson and others (closes: Malone #17348).", "" ], "package": "pam", "version": "0.79-3ubuntu10", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 23 Feb 2006 16:22:12 +0000" }, { "cves": [], "log": [ "", " * Fix operator precedence in libpam-modules.postinst.", "" ], "package": "pam", "version": "0.79-3ubuntu9", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 16 Feb 2006 15:23:04 +0000" }, { "cves": [], "log": [ "", " * Make pam_env be quiet if it can't find the user's configuration file,", " since it's optional.", "" ], "package": "pam", "version": "0.79-3ubuntu8", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Sat, 4 Feb 2006 16:44:12 +0100" }, { "cves": [], "log": [ "", " * Add the PATH on initial install for real this time.", "" ], "package": "pam", "version": "0.79-3ubuntu7", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Thu, 2 Feb 2006 20:33:42 +0100" }, { "cves": [], "log": [ "", " * Changes from Roger Leigh:", "", " * Linux-PAM/libpamc/include/security/pam_client.h,", " Linux-PAM/libpamc/pamc_converse.c: Apply patch from", " latest upstream version to remove redefinition of internal", " glibc/libstdc++ types. Closes: #344447.", " * Linux-PAM/libpamc/test/regress/test.libpamc.c: Also switch to standard", " types; not taken from upstream.", " " ], "package": "pam", "version": "0.79-3ubuntu6", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Reinhard Tartler ", "date": "Wed, 1 Feb 2006 13:14:24 +0000" }, { "cves": [], "log": [ "", " * Add pam_foreground to /etc/pam.d/common-session", "" ], "package": "pam", "version": "0.79-3ubuntu5", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Matthew Garrett ", "date": "Tue, 24 Jan 2006 02:26:19 +0000" }, { "cves": [], "log": [ "", " * Add PATH on initial install, too.", "" ], "package": "pam", "version": "0.79-3ubuntu4", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Mon, 23 Jan 2006 15:55:40 +0100" }, { "cves": [], "log": [ "", " * Add PATH to /etc/environment if it's not present there or in", " /etc/security/pam_env.conf and we are upgrading from a version which", " didn't add it.", "" ], "package": "pam", "version": "0.79-3ubuntu3", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Tue, 17 Jan 2006 15:54:01 +0100" }, { "cves": [], "log": [ "", " * Look at ~/.pam_environment too. Same format as", " /etc/security/pam_env.conf. The patch is recorded as", " patches-applied/060_pam_env_per_user", "" ], "package": "pam", "version": "0.79-3ubuntu2", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Tue, 17 Jan 2006 15:32:55 +0100" }, { "cves": [], "log": [ "", " * Resynchronise with Debian.", "" ], "package": "pam", "version": "0.79-3ubuntu1", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Mon, 21 Nov 2005 12:15:44 +0000" }, { "cves": [], "log": [ "", " * Patch 059", " - Fix a segfault in pam_userdb when the new \"crypt=\" option", " is unset, as will be the case for all existing users; already fixed", " upstream. Closes: #330829.", " - Fix a memory leak in the same code due to gratuitous strdup()s.", " * Further regression in pam_env: don't treat a missing /etc/environment", " as a fatal error, either. Amend patch 058 accordingly. Closes: #330852.", "" ], "package": "pam", "version": "0.79-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 30 Sep 2005 01:17:53 -0700" }, { "cves": [], "log": [ "", " The \".c.o: rm -rf $@\" release", " * Fix debian/rules so that make clean doesn't remove ./configure when the", " timestamp on configure.in is newer (!).", " * Switch pam_userdb from db3 to db4.3, which according to the libdb", " maintainers should require no manual intervention for upgrading on-disk", " database formats. Closes: #165068.", " * Patch 058: yes, of course we want to read /etc/environment by", " default. Grr! Revert upstream change which disables this for no", " apparent reason (closes: #330458).", " * Tweak selinux rootok code to use the version of the function call that", " doesn't pollute namespace", "" ], "package": "pam", "version": "0.79-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 27 Sep 2005 02:44:36 -0700" }, { "cves": [], "log": [ "", " * New upstream version (closes: #284954, #300775).", " - includes some fixes for typos (closes: #319026).", " - pam_unix should now be LSB 3.0-compliant (closes: #323982).", " - fixes segfaults in libpam on config file syntax errors", " (closes: #330097).", " * Drop patches 000_bootstrap, 004_libpam_makefile_static_works,", " 011_pam_access, 013_pam_filter_termio_to_termios, 017_misc_fixes,", " 025_pam_group_conffile_name, 028_pam_mail_delete_only_when_set,", " 033_use_gcc_not_ld, 034_pam_dispatch_ignore_PAM_IGNORE,", " 035_pam_unix_security, 039_pam_mkhomedir_no_maxpathlen_required,", " 041_call_bootstrap, 042_pam_mkhomedir_dest_not_source_for_errors,", " 051_32_bit_pam_lastlog_ll_time, and", " 053_pam_unix_user_known_returns_user_unknown which have been", " integrated upstream.", " * Merge one last bit of patch 053 into patch 043, where it should have", " been in the first place", " * Patch 057: SELinux support:", " - add support to pam_unix for copying SELinux security contexts when", " writing out new passwd/shadow files and creating lockfiles", " - support calling unix_chkpwd if opening /etc/shadow fails due to", " SELinux permissions", " - allow unix_chkpwd to authenticate for any user when in an SELinux", " context (hurray!); we depend on SELinux policies to prevent the", " helper's use as a brute force tool", " - also support querying user expiration info via unix_chkpwd", " - misc cleanup: clean up file descriptors when invoking unix_chkpwd", " (closes: #248310)", " - make pam_rootok check the SELinux passwd class permissions, not just", " the uid", " - add new pam_selinux module (closes: #249499)", " * Build-depend on libselinux1-dev.", " * Fix pam_getenv, so that it can read the actual format of /etc/environment", " instead of trying to read it using the syntax of", " /etc/security/pam_env.conf; thanks to Colin Watson for the patch.", " Closes: #327876.", " * Set LC_COLLATE=C when using alphabetic range expressions in", " debian/rules; bah, so *that's* what kept happening to my README file", " when trying to build out of svn! Closes: #295296.", " * Add a reference to the text of the GPL to debian/copyright.", "" ], "package": "pam", "version": "0.79-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 25 Sep 2005 22:08:20 -0700" }, { "cves": [], "log": [ "", " * Fix Gcc 3.4 compilation, Closes: #259634", " * Note that pam.conf is not read if /etc/pam.d exists, Closes: #248928", " * Fix typo in pam_env.conf, Closes: #277633", "" ], "package": "pam", "version": "0.76-23", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 10 Jul 2005 16:42:25 -0400" }, { "cves": [], "log": [ "", " * Fix pam_getenv, which never worked:", " - Parse /etc/security/pam_env.conf using its own syntax, and then", " /etc/environment using its own syntax rather than the syntax of", " /etc/security/pam_env.conf.", " - 'my $val' was used in an incorrect scope; fixed.", " - Exit non-zero if the requested environment variable is not found.", "" ], "package": "pam", "version": "0.76-22ubuntu3", "urgency": "low", "distributions": "breezy", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Mon, 12 Sep 2005 18:32:54 +0100" }, { "cves": [], "log": [ "", " * debian/rules: Install unix_chkpwd setgid shadow instead of setuid root.", " This only breaks when using NIS lookups, therefore the new nis package", " dpkg-statoverrides it back to setuid root while being installed.", " (Debian #155583, http://udu.wiki.ubuntu.com/ProactiveSecurityRoadmap)", " * debian/control: Added conflict to nis (<< 3.13-3ubuntu1): This is the", " version that corrects the permissions for usage with NIS.", "" ], "package": "pam", "version": "0.76-22ubuntu2", "urgency": "low", "distributions": "breezy", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Fri, 17 Jun 2005 12:34:23 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS with gcc-3.4 (closes: #259634). Ubuntu 9037.", "" ], "package": "pam", "version": "0.76-22ubuntu1", "urgency": "low", "distributions": "breezy", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Wed, 4 May 2005 18:14:51 +0200" }, { "cves": [], "log": [ "", " * Add uploaders", " * Document location of repository", " * Fix options containing arguments in pam_unix, Closes: #254904", "" ], "package": "pam", "version": "0.76-22", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 28 Jun 2004 14:28:08 -0400" }, { "cves": [], "log": [ "", " * Fix patch 055 again because -20 was broken and didn't actually fix the", " problem.", "" ], "package": "pam", "version": "0.76-21", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 4 May 2004 21:37:38 -0400" }, { "cves": [], "log": [ "", " * Update to patch 55 to only check securetty when we are sure the", " password is null, Closes: #243698", " * Medium urgency because the version now in testing has confusing and", " verbose log messages.", " * Include pam_getenv script which hopefully will be used by some people", " somewhere for some purpose", "" ], "package": "pam", "version": "0.76-20", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 28 Apr 2004 22:51:18 -0400" }, { "cves": [], "log": [ "", " * Oops, too busy testing the upgrade from woody to make sure the upgrade", " from -16 to -18 worked. Thanks to all those who reported,", " Closes: #243413", "" ], "package": "pam", "version": "0.76-19", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 13 Apr 2004 16:08:54 -0400" }, { "cves": [], "log": [ "", " * Manipulate conffiles to avoid unnecessary prompt in woody to sarge", " upgrade, Closes: #218318", "" ], "package": "pam", "version": "0.76-18", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 10 Apr 2004 18:10:35 -0400" }, { "cves": [], "log": [ "", " * common-password now includes length restrictions and cracklib", " examples, Closes: #227681, #237537", " * Patch 054: abstract out the logic from pam_securetty to determine if a", " tty is in /etc/securetty into a library function", " * Patch 55: Add nullok_secure option to pam_unix. If set, then null", " passwords are accepted from terminals in /etc/securetty.", " * common-auth now includes nullok_secure, Closes: #228114", "", "" ], "package": "pam", "version": "0.76-17", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 4 Apr 2004 23:10:11 -0400" }, { "cves": [], "log": [ "", " * Patch 51 from the x86-64 folks to support 32-bit ll_time in", " pam_lastlog even if time_t is 64-bits", " * Don't call openlog in pam_unix (patch 52), Closes: #213566", " * Return PAM_USER_UNKNOWN for unknown users in pam_unix (patch 53), Closes: #204506", "" ], "package": "pam", "version": "0.76-16", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 23 Mar 2004 22:26:04 -0500" }, { "cves": [], "log": [ "", " * Fix description of libpam-runtime, Closes: #209755", " * Fix description of libpam-cracklib, Closes: #210014", " * Depend on libc6-dev|libc-dev not libc6-dev, Closes: #212354", " * Clean up binaries, Thanks Russell, Closes: #212158", " * Depend on sufficiently new cracklib2-dev, Closes: #214092", " * Treate GNU/* as GNU for OS variable to make pam_limits compile,", " (patch 050) Closes: #220980", " * No longer build-depend on latex2html, Closes: #221318", " * Allow : in tty specification for pam_group, (patch 048) Closes: #220439", " * Pull in locking patch from Linux-PAM CVS; this ended up causing", " 021_pam_nis_locking to be reworked and that patch now no longer", " contains locking fixes, but just NIS cleanup in general. See", " 049_pam_unix_sane_locking for the locking changes, Closes: #220158", "" ], "package": "pam", "version": "0.76-15", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 12 Jan 2004 02:23:59 -0500" }, { "cves": [], "log": [ "", " * Pull in NMU diff from 13.1, Closes: #186011", " * Split out common-password into its own file, Closes: #207497", " * Make other a conffile again and update to @include stuff", " * Add missing symlink, Closes: #196605", " * Remove undocumented manpages", " * Update PAM mini-policy", "" ], "package": "pam", "version": "0.76-14", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 1 Sep 2003 18:08:54 -0400" }, { "cves": [], "log": [ "", " * NMU with maintainer's permission.", " * Add three new config files (/etc/pam.d/common-{auth,account,session})", " to libpam-runtime. Other packages which depend on libpam-runtime", " can now @include these files from their own PAM configs.", " * Convert /etc/pam.d/other from a conffile to a non-conffile config", " file. Closes: #186011.", " * Remove empty libpam-runtime.prerm script (debhelper will autocreate if needed)", "" ], "package": "pam", "version": "0.76-13.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 19 Aug 2003 19:41:03 -0500" }, { "cves": [], "log": [ "", " * Nope, that dependency didn't work, so let's remove it. If we run into other module versioning issues, I now have an arm build environment to debug with. Closes: #198618", "" ], "package": "pam", "version": "0.76-13", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 7 Jul 2003 00:22:34 -0400" }, { "cves": [], "log": [ "", " * Fix group.conf example, (patch 046) Closes: #197080", " * Ignore module return value in jumps, (patch 045) Closes: #176693", " * Accept string value for chroot limit, thanks Andrei Pelinescu-Onciul,", " Patch (047), Closes: #196903", " * Depend on libpam-modules instead of conflicting with older versions.", " This creates a circular dependency between libpam0g and", " libpam-modules. James says this works fine; we hope he's right.", " Closes: #196949" ], "package": "pam", "version": "0.76-12", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 21 Jun 2003 17:19:29 -0400" }, { "cves": [], "log": [ "", " * Don't allow db4 to satisfy build-depends because it doesn't actually", " work, and sometimes building with it would be wrong.", " * Don't depend on libpcap-dev on Debian BSD", " * Conflict with old libpam-modules, Closes: #191906", " * Incorrect username should not be logged at alert (patch 43),", " Closes: #175900", " * Patch to support FreeBSD (patch 44, thanks Robert), Closes: #191906", "" ], "package": "pam", "version": "0.76-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 31 May 2003 19:55:26 -0400" }, { "cves": [], "log": [ "", " * Don't double list conffiles, Closes: #190954", " * Only install example sources not executables, Closes: #185286", " * Display correct directory in error message for pam_mkhomedir, patch", " 042 thanks to Akira TAGOH, Closes: #165240", " * Don't log EPERM when setting NOFILE limit as Linux doesn't let you", " set that to -1, Closes: #180310", " * Add newline to end of distributed time.conf, Closes: #172229", " * Up our standards version and support noopt in DEB_BUILD_OPTIONS", "" ], "package": "pam", "version": "0.76-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 3 May 2003 22:28:37 -0400" }, { "cves": [], "log": [ "", " * Fix pam_rhosts hurd patch so it actually works, Closes: #172914", " * Fix patch 040 not to clobber errno when logging the error fails,", " Closes: #172186", " * Fix dependency for linuxdoc-tools, Closes: #173097", "" ], "package": "pam", "version": "0.76-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 15 Dec 2002 17:10:58 -0500" }, { "cves": [], "log": [ "", " * Have makefile appropriately depend on bootstrap-libpam", " * Install pam minipolicy, Closes: #167798", " * Don't segfault if ttyname is null; this avoids the segfault but does", " not actually make pam_issue useful for ssh. I believe the way", " pam_issue works is fundamentally incompatible with what sshd expects", " from PAM (patch 037), Closes: #153152", " * We actually fixed passwords containing , in 0.76-6, but failed to", " document it. They do work, Closes: #164713", " * Note that /etc/pam.d/other is a fall back for each service", " * Patches from Michal 'hramrach' Suchanek\" to", " make HURD work, Closes: #165066 (patch 038 and 039)", " * Don't depend on gs and other doc prep tools for build-depends, just", " build-depends-indep, Closes: #165065", " * Patch from Eric Anderson to log failures of", " setrlimit (patch 040), Closes: #169836", " * Build pam_limits on hurd, Closes: #165190", "" ], "package": "pam", "version": "0.76-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 24 Nov 2002 22:04:28 -0500" }, { "cves": [], "log": [ "", " * Fix handling of pam_ignore in case where we're skipping modules;", " update to patch 034", "" ], "package": "pam", "version": "0.76-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 20 Oct 2002 21:49:22 -0400" }, { "cves": [], "log": [ "", " * The \"No, I don't think I actually want any of what upstream is", " smoking\" release", " * If this were already in testing, this would be an severity emergency", " upload", " * pam_unix currently treats * in shadow file as no password not", " disabled; major security issue; fixed in upstream CVS, (patch 035) Closes: #164659", " * OK, I think this actually fixes the rest of the manpage symlinks,", " Closes: #163839, #164298", " * You don't want to use getlogin for pam_wheel because utmp may be wrong or for xterm have no entry, pull forward patch from the 0.72 packages (patch 036), Closes: #163787", "" ], "package": "pam", "version": "0.76-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 15 Oct 2002 10:44:56 -0400" }, { "cves": [], "log": [ "", " * Fix library links from 0.75 to 0.76", " * Ignore PAM_IGNORE in _pam_dispatch_aux (patch 34), Closes: #163841", " * Fix man page symlinks, Closes: #163839", "" ], "package": "pam", "version": "0.76-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 11 Oct 2002 01:08:06 -0400" }, { "cves": [], "log": [ "", " * Upstream correctly states that one should use gcc not ld when", " linking and then hapilly proceeds to actually use ld, fixed, Closes: #163711", "", " * Remove experimental warning from readme, Closes: 163742", "" ], "package": "pam", "version": "0.76-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 7 Oct 2002 23:45:53 -0400" }, { "cves": [], "log": [ "", " * Oops, let's try building -fpic. This currently builds everything", " -fpic which is somewhat wrong, but doing more than that requires", " significant build system hacking (touch every makefile for dynamic", " objects), so it will wait, Closes: #163600", "" ], "package": "pam", "version": "0.76-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 6 Oct 2002 23:33:12 -0400" }, { "cves": [], "log": [ "", " * Link against appropriate libraries so we find the symbols we need,", " Closes: #162175", " * The if everyone's going to complain when I upload broken software to", " experimental release, I might as well upload to unstable and give them", " something worth actually complaining about release.", " * Also the remove the scourge of dbs release", " * Include patch 034 from the 0.72 packages, meaning that we've included", " all the patches we need before release", " * Reject the patch to pam_wheel as I cannot find out what reasonable", " thing it was trying to do and it seemed broken", " * libpam-cracklib should depend on wordlist so it actually works;", " thanks Olaf Meeuwissen,", " Closes: #112965", " * Merge build-depends and build-depends-indep because I'm a bad person", " and was too lazy to make docs build in a separate pass. I'll deal in", " a few versions.", "" ], "package": "pam", "version": "0.76-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 6 Oct 2002 18:52:13 -0400" }, { "cves": [], "log": [ "", " * New upstream version", " * Upstream includes fix to not break cron, Closes: 160566", " * New Upstream correctly handles priority < 0 for pam_limits, Closes: #126251", " * .cvsignores removed, Closes: #159961", "" ], "package": "pam", "version": "0.76-1", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 22 Sep 2002 16:11:35 -0400" }, { "cves": [], "log": [ "", " * Apply patch 027 pam_limits so that we initialize to wide open not", " current limits.", " * In pam_mail, don't complain about deleting environment variable if", " we never set it, Closes: #58429", " * Don't set default max procs limit in pam_limits, Closes: #116874", " * libpam-runtime now arch all since it has no arch-specific files,", " Closes: #132545", " * Update mini policy to reflect confusion on debian-devel", "" ], "package": "pam", "version": "0.75-3", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 16 Jul 2002 09:30:50 -0400" }, { "cves": [], "log": [ "", " * Fix pam_userdb to build and to build against db3, fixes patch 020", " * Fix upstream makefile so pam_group has valid configuration, closes: #148657", " * time.conf reference to logoutd removed, closes: #143801", " * The static library contains all the appropriate symbols in this", " version. You may find the complete lack of PAM modules somewhat", " frustrating; currently the static pam library is only useful if you", " register your own modules. Fixing this would require annoying hacking", " on the upstream build system, closes: #103495", " * unix_chkpwd.8 typo fixes thanks to dancer@anthill.echidna.id.au,", " Closes: #139949", " * Since we're working on the new upstream version, we also have the new docs, closes: #147763", " * Patch from Martin Schwenke to only change", " passwords in pam_unix when they exist in the password file; hopefully", " does not break NIS, closes: #135990", " * Another patch from Martin to return PAM_USER_UNKNOWN if we ever", " actually do get into the password changing routine only to find that", " we have no password to change, closes: #135604", " * .cvsignore no longer installed, closes: #120795", " * We're using debhelper 3, just in time to be obselete, Closes: #93414", "" ], "package": "pam", "version": "0.75-2", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 8 Jun 2002 18:04:40 -0400" }, { "cves": [], "log": [ "", " * Preliminary test packages", " * New upstream version", " * Hopefully works mostly the same as 0.72 except for upstream bug", " fixes and for the fact that pam_limits is fairly broken right now.", " * If it breaks you are lucky if you get to keep both pieces release.", "" ], "package": "pam", "version": "0.75-1", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 25 May 2002 22:57:57 -0400" }, { "cves": [], "log": [ "", " * Fix like_auth to make libpam-krb5 and libpam-heimdal actually useful,", " patch from RISKO Gergely , closes: #126251", "" ], "package": "pam", "version": "0.72-35", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 21 Jan 2002 15:20:22 -0500" }, { "cves": [], "log": [ "", " * Note that HOME may not be useful in pam_environment, closes: #109281", " * Don't smash case domains (groups/users) in pam_limits, closes: #119893", " * Remove double the from description, closes: #107705", " * Fix typo on mail message, closes: #119689", " * Medium since these are small fixes that should go into woody", "" ], "package": "pam", "version": "0.72-34", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 23 Nov 2001 21:24:20 -0500" }, { "cves": [], "log": [ "", " * Fix pam_mail to look in /var/mail not /var/spool/mail, thanks mjb.", "" ], "package": "pam", "version": "0.72-33", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 11 Oct 2001 15:44:32 -0400" }, { "cves": [], "log": [ "", " * This should probably get into testing before freeze; medium.", " * Patch from Volker Stolz to fix bug in previous pam_group patch,", " closes: #111854", "" ], "package": "pam", "version": "0.72-32", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 22 Sep 2001 06:32:29 -0400" }, { "cves": [], "log": [ "", " * Add support for credential reinitialization in pam_group, closes: #108697", "" ], "package": "pam", "version": "0.72-31", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 31 Aug 2001 13:16:39 -0400" }, { "cves": [], "log": [ "", " * Include patch from robbe@orcus.priv.at to build pam_limits on hurd,", " closes: #103556", " * Start installing limits.conf for hurd (may not work quite right)", "" ], "package": "pam", "version": "0.72-30", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 16 Jul 2001 09:35:51 -0400" }, { "cves": [], "log": [ "", " * Correctly declare uint32 type for ia64, closes: #104584", "" ], "package": "pam", "version": "0.72-29", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 14 Jul 2001 01:30:39 -0400" }, { "cves": [], "log": [ "", " * Fix scanf string so pam_limits chroot works, closes: #100812", " * Only log unknown user at warning, not alert, closes: #95220", " * By default do complete matches not substring matches for pam_time.", " You can include explicit wildcard for substring, closes: #66152", "" ], "package": "pam", "version": "0.72-28", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 3 Jul 2001 17:31:45 -0400" }, { "cves": [], "log": [ "", " * Fix typo in last patch", "" ], "package": "pam", "version": "0.72-27", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 25 Jun 2001 18:27:42 -0400" }, { "cves": [], "log": [ "", " * Block SIGCHLD when calling unix password verification program, patch from mdz@debian.org, fixes pam part of #97977", "" ], "package": "pam", "version": "0.72-26", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 25 Jun 2001 08:47:12 -0400" }, { "cves": [], "log": [ "", " * Depend on opensp, working around #89063, closes: #100125", " * This is urgency medium to get docs back into testing.", "" ], "package": "pam", "version": "0.72-25", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 8 Jun 2001 11:44:12 -0400" }, { "cves": [], "log": [ "", " * New NIS double locking and root password patch from Philippe Troin", " , fixes bug in unreleased patch submitted for", " 0.72-23. Also improves changing root password so it does something;", " ongoing discussion on whether this is right.", "" ], "package": "pam", "version": "0.72-24", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 21 May 2001 08:06:05 -0400" }, { "cves": [], "log": [ "", " * Patch from Benoit Gaussen , Don't trim from , to end", " of string in user input, only trim from salt", " grabbed from passwd file, closes: #96779", " * Fix NIS double locking, closes: #96736", "" ], "package": "pam", "version": "0.72-23", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 16 May 2001 15:46:34 -0400" }, { "cves": [], "log": [ "", " * Fix pam.8 to be pam.7, closes: #92874", "" ], "package": "pam", "version": "0.72-22", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 17 Apr 2001 23:04:04 -0400" }, { "cves": [], "log": [ "", " * Don't depend on libcap for hurd, closes: #91998", " * Don't list scurity/limits.conf as a conffile for hurd", "" ], "package": "pam", "version": "0.72-21", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 9 Apr 2001 12:30:18 -0400" }, { "cves": [], "log": [ "", " * Install pam-undocumented in -runtime not -dev, closes: #93063", " * Mark pam-runtime as replacing files from -dev in case you installed", " -19 and have pam-undocumented in the wrong place", "" ], "package": "pam", "version": "0.72-20", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 6 Apr 2001 06:38:15 -0400" }, { "cves": [], "log": [ "", " * New maintainer, closes: #92353", " * Install pam-undocumented; somehow it was not installed in -18", "" ], "package": "pam", "version": "0.72-19", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 4 Apr 2001 21:32:17 -0400" }, { "cves": [], "log": [ "", " * pam_securetty: log failed tty checks. Normally this was only done if", " the \"debug\" option was on...do it regardless now, closes: #89390", " * Get rid of log message for when \"root\" is not applied to group checks.", " closes: #88825", " * Add quiet option to pam_listfile, closes: #84428", " * pam(8) should be pam(7), pam.conf(8) should be pam.conf(5), closes:", " #89322", " * Added groff to Build-Depends-Indep, closes: #88794", "" ], "package": "pam", "version": "0.72-18", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 25 Mar 2001 21:40:32 -0500" }, { "cves": [], "log": [ "", " * Fixed login in pam_limits where the max logins could be ignored.", "" ], "package": "pam", "version": "0.72-17", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 9 Mar 2001 09:14:48 -0500" }, { "cves": [], "log": [ "", " * New pam limits cap patch from Topi Miettinen", " , closes: #88401, #88406, #88525, #88399,", " #86197", " * pwdb no longer used, closes: #59917", " * fix patch 023 for gethostbyname build failure, closes: #86156", " * Make sure unix_chkpwd gets installed as suid root, closes: #88519", " * Fix whatis parse of manpages, closes: #86203", " * pam_listfile, fix arg parsing when arg does not contain '=', closes:", " #86070", "" ], "package": "pam", "version": "0.72-16", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 4 Mar 2001 22:45:58 -0500" }, { "cves": [], "log": [ "", " * Doh, added build-depends for libcap, closes: #85352", " * Change section of libpam-cracklib from admin to libs to match", " overrides.", "" ], "package": "pam", "version": "0.72-15", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 9 Feb 2001 09:06:40 -0500" }, { "cves": [], "log": [ "", " * Added fix to pam_access for gethostname decleration. closes: #82100", " * Just name the lib/security directory instead of all the modules", " seperately for dh_movefiles. closes: #76119", " * Fix pam_env corruption, closes: #66849, #77229", " * Add patch to allow recursive /etc/skel copy in pam_mkhomedir, closes:", " #67211", " * remove dh_suidregister call, added conflict for old suidregister", " package", " * Applied patch for Linux capabilities in pam_limits, closes: #74176", " * pam_issue.so works for me, without segv, and even with escapes. This", " is with login. Note, things like pam_issue do not work with ssh simply", " because ssh is not able to work in that way (does not support", " arbiitrary conversations). So if you want it to work there, file a bug", " on ssh, not on libpam-modules. closes: #77228", " * unix_chkpwd: check for NULL password, closes: #69960", "" ], "package": "pam", "version": "0.72-14", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 8 Feb 2001 11:06:03 -0500" }, { "cves": [], "log": [ "", " * Fix grammar in pam_source.sgml, closes: #78959", " * pam_undocumented.7: Fix escaped 's, closes: #75987", " * Fix build ordering, closes: #71442, #80397, #77017", " * Applied Hurd patch, closes: #76119", " * Use gcc for linking, not ld. closes: #71941", " * Pretty sure this was fixed, closes: #67172", " * Applied spealang fixes to Debian-mini-policy. closes: #80249", " * Applied patch to allow devfs style terminal devices with pam_group,", " closes: #77661", " * Could not reproduce, even using md5 passwords. User, if you still have", " * this problem, you need to tell me with what service (login, which I", " tested, sshd, telnet, etc...) and also send me the entire pam.d file", " for that service. closes: #76087", " * Fixed awhile back, closes: #72858", " * Closing this since I am not going to include any modules in this", " package that aren't in upstream. If someone else wants to package", " these modules seperately, they can do so. closes: #69550", " * For correct usage, pam_wheel.so should be used with \"sufficient\" and", " not \"required\". This is documented. If you use \"required\", then you", " must also use the \"trust\" option, but that doesn't give you the", " results you want. closes: #76236", "" ], "package": "pam", "version": "0.72-13", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 31 Dec 2000 05:38:23 -0500" }, { "cves": [], "log": [ "", " * Recompile against db2 for glibc change", " * Add db2 to build-deps", "" ], "package": "pam", "version": "0.72-12", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 27 Sep 2000 12:08:11 -0400" }, { "cves": [], "log": [ "", " * Removed all traces of pwdb in packages. libpwdb has been removed from", " the archive. This means that the pam_pwdb and pam_radius modules are", " no longer available (from the libpam-pwdb package).", " * doc/modules/pam_wheel.sgml: Really spell out that being a member of a", " group meands the user is listed in /etc/group, closes: #69242", " * doc/*: s/PAM_AUTHOK_RECOVERY_ERR/PAM_AUTHOK_RECOVER_ERR/g,", " closes: #64473", " * pam_wheel: PAM does not distinguish it, the libc calls make the", " distinction. The users gid is returned in their passwd info, while", " getgrent() returns only the members of the group listed in /etc/group.", " This is ok, because if it's really that important, you can actually", " have it in both places. The fact that it's documented should suffice", " in making this clear, closes: #69236", " * Sorry, but seperate modules generally need to be packaged seperately.", " I don't want to overload this package with everyone's pet module, so I", " have to put my foot down, closes: #61759", " * Actually, I'm going to move in Woody to make packages depend more on", " the defaults in /etc/pam.d/other, so that admins have less to", " maintain. For one, all packages should not have a password service", " listed, closes: #70000 (YAY! I got the 70k rollover bug number!)", " * Sorry, I can't include this. \",\" is a legitimate char in a password", " salt/hash. If you can code up something that is super intelligent", " about lenghts of the field, I can go for it, maybe, closes: #59459", " * modules/pam_limits: Added chroot feature patch, closes: #61090", " * modules/pam_access: Allow last field to contain ':', closes: #67291", " * modules/pam_limits: Allow explicit limits for root, closes: #62448", " * modules/pam_unix: Do not zero old/new password fields, libpam does", " this itself, and doing so in the module breaks stacking,", " closes: #66270", " * modules/pam_group: Allow alpha *and* numeric in tty field (duh),", " closes: #63752", " * modules/pam_access: Enable NIS, closes: #64854", " * libpam0g-dbg: removed, useless anyway", "" ], "package": "pam", "version": "0.72-11", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 30 Aug 2000 18:39:32 -0400" }, { "cves": [], "log": [ "", " * Update build depends", " * Fixed logic for showing non-existent user names when auth failed in", " pam_unix.so, closes: #67786 (thanks to Jim Breton for being patient in", " helping track this down). It would sometimes show them, even if we", " didn't want to.", "" ], "package": "pam", "version": "0.72-10", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 27 Jul 2000 09:17:08 -0400" }, { "cves": [], "log": [ "", " * pam_unix: do not call obscure_msg() of pass_old is NULL,", " closes: #65321", " * pam_access: check for from[0] == '\\0' so that tty logic is actually", " used, closes: #65401", "" ], "package": "pam", "version": "0.72-9", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 14 Jun 2000 11:38:35 -0400" }, { "cves": [], "log": [ "", " * Build depends added in previous version, closes: #60817, #61439", " * Allow use of \":0\" in group.conf, closes: #61966", " * Added syslog entry to notify that a user succesfully changed their", " password, closes: #61724", " * Make pam_unix compatible with HP-UX style NIS+ password information,", " patch from ldaffner@rsn.hp.com, closes: #61942", " * If \"audit\" is not enabled, don't let pam_unix print the names of", " unknown users for auth attempts, closes: #61942", " * Fixed ttyname() parsing in pam_access to match that of the old shadow", " access.conf s,/dev/,, closes: #61644", " * Set some sane defaults for pam_limits.so instead of carrying over", " potentially bad defaults, patch from Peter Paluch", " closes: #63230", " * Allow explicit (e.g. specified specifically for) limits for root,", " patch from Topi Miettinen , closes: #62448", " * Added information to time.conf about logoutd, which is now enabled via", " this file.", " * cracklib maintainer claims this isn't a bug, closes: #54180", " * fixed control syntax handling which was causing segfaults, closes: #62237", "" ], "package": "pam", "version": "0.72-8", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 29 Apr 2000 11:39:59 -0400" }, { "cves": [], "log": [ "", " * pam_limits: fix parsing of users which explicitly removes limits,", " closes: #59911, #60287", " * Added build-depends", "" ], "package": "pam", "version": "0.72-7", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 20 Mar 2000 16:06:28 -0500" }, { "cves": [], "log": [ "", " * Remove conflict for libpam0g-util from libpam0g and put it in", " libpam-runtime. This should fix a problem with upgrades that apt", " experiences, closes: #58677", "" ], "package": "pam", "version": "0.72-6", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 28 Feb 2000 14:05:28 -0500" }, { "cves": [], "log": [ "", " * Added obscure password checks to pam_unix. Required for shadow to be", " able to emulate the pre-PAM setup (referenced in a bug on passwd).", " * Applied patch from #57800 to fix NIS/NIS+ shadow accounting checks,", " closes: #57800, #58164", " * Fixed two typos in the PAM System Administrators Guide,", " closes: #56578, #56587", "" ], "package": "pam", "version": "0.72-5", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 28 Feb 2000 10:58:09 -0500" }, { "cves": [], "log": [ "", " * unix_chkpwd: check for NULL on stdin aswell as 0 reads, closes: #56375", " * pam_unix/Makefile: removed bashism, closes: #56370", " * fixed in shadow upload, closes: #49832", "" ], "package": "pam", "version": "0.72-4", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 29 Jan 2000 00:27:28 -0500" }, { "cves": [], "log": [ "", " * Added cpluplus wraps in all the headers, closes: #53653", "" ], "package": "pam", "version": "0.72-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 2 Jan 2000 15:15:40 -0500" }, { "cves": [], "log": [ "", " * Well, this is an odd one. A recompile fixes it. So it must have been a", " problem from linking with 0.71 when this is version 0.72. All of this", " build daemons seem to have compiled the latest 0.72, so this should be", " resolved after this gets recompiled on all of them, closes: #51619, #49584", " * This is from a very old version (0.56) of libpam0. It is not relevant", " to the latest version, closes: #47162", "" ], "package": "pam", "version": "0.72-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 26 Dec 1999 09:10:13 -0500" }, { "cves": [], "log": [ "", " * New upstream source release, lots of patches merged upstream (thanks", " Andrew).", " * libpam-doc: now provides pam-doc, closes: #45631", " * cleanups to the build system", " * shlibs.local: bumped shlib deps", "" ], "package": "pam", "version": "0.72-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 14 Dec 1999 11:17:36 -0500" }, { "cves": [], "log": [ "", " * Debian-PAM-MiniPolicy: new document describing how PAM is implemented", " in Debian", "" ], "package": "pam", "version": "0.71-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 26 Nov 1999 17:26:40 -0500" }, { "cves": [], "log": [ "", " * pam_listfile: lstat -> stat, closes: #49833", " * pam_tally: install the pam_tally program, closes: #50314", " * debian/control: libpam-modules, replaces libpam0g-util, closes: #50716", "" ], "package": "pam", "version": "0.71-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 25 Nov 1999 21:02:23 -0500" }, { "cves": [], "log": [ "", " * New upstream release, merges lots of patches from the Debian source,", " also merges the pam_{motd,mkhomedir,issue} modules into the main", " source. Lots of minor bugs fixed, and compiler warnings", " * pam_mail: Reimplemented the authentication handlers, so now this works", " as both (changes nothing in Debian, but was required to get the patch", " accepted upstream)", " * general: Lots of small edits to fix compiler warnings", " * pam_userdb: fixed potential usage of an unitialized value as", " PAM_AUTHTOK, doesn't look particularly exploitable, but better safe", " than sorry", "" ], "package": "pam", "version": "0.71-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 8 Nov 1999 19:21:52 -0500" }, { "cves": [], "log": [ "", " * pam_wheel/pam_wheel.c: change to use getpwuid(getuid()) by default, so", " avoid the problems associated with getlogin()", "" ], "package": "pam", "version": "0.70-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 1 Nov 1999 13:33:10 -0500" }, { "cves": [], "log": [ "", " * Applied patch from Herbert Xu to enable PAM_CONV_AGAIN support in", " pam_ftp, closes: #47288", "" ], "package": "pam", "version": "0.70-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 13 Oct 1999 13:25:21 -0400" }, { "cves": [], "log": [ "", " * 100_pam_pwdb_security_fix: new patch fixes security problem with", " regard to NIS accounts", "" ], "package": "pam", "version": "0.70-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 13 Oct 1999 11:42:41 -0400" }, { "cves": [], "log": [ "", " * New upstream release", " * Seems there were a lot of fixes merged/matches upstream, looks good,", " (maybe it's time I start sending my patches in, since the maintainer", " is active again).", " * libpamc: new library (libpam client library), this actually used to be", " in the Debian packages for a few versions, but it was removed upstream.", " Guess what, it's back :)", "" ], "package": "pam", "version": "0.70-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 10 Oct 1999 01:07:43 -0400" }, { "cves": [], "log": [ "", " * {pwdb,unix}_chkpwd.8: fixed format to get rid of \"no whatis\" warnings", " from mandb, closes: #47004", " * pam_unix.sgml: new file, documents the pam_unix.so module,", " closes: #46511", "" ], "package": "pam", "version": "0.69-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 9 Oct 1999 12:41:58 -0400" }, { "cves": [], "log": [ "", " * libpam/pam_item.c: fixed debug message being in wrong place", " * 013_pam_issue: new patch, provides issue file parsing for PAM", " applications (helps to replace lost functionality in login).", "" ], "package": "pam", "version": "0.69-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 6 Oct 1999 20:30:17 -0400" }, { "cves": [], "log": [ "", " * Fix typo in pam_mail.so module's \"no\" return", "" ], "package": "pam", "version": "0.69-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 3 Oct 1999 15:08:56 -0400" }, { "cves": [], "log": [ "", " * docs/modules/pam_mkhomedir.sgml: Fixed module name", " * changed build system structure", " * libpam/Makefile: add -lcrypt to the linked libs, closes: #46104", " * increase shlib deps to 0.69-7, closes: #45801", " * pam_motd.c: close motd file after reading, closes: #46122", " * pam_motd.c: fix setting \\0 in the wrong place when motd file is", " zero length, closes: #45686, #45632", " * pam_unix_acct.c: allow '0' to denote disabled for some expiry fields", " since chage(1) documents it this way, closes: #45446", " * pam_mail.c|modules/pam_mail.sgml: added 2 options, one \"standard\" to", " give the old style \"You have ...\" response and \"quiet\" which only", " reports new mail for both formats, documented both options,", " closes: #45670", " * with the new pam_unix module, this bug is fixed, closes: #42230", " * pam_limits.c: make sure that we not only ignore limits on root, we", " also remove them just in case we are su'ing from a limited user to", " the root account (since as root they can remove the limits anyway),", " closes: #35302", "" ], "package": "pam", "version": "0.69-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 3 Oct 1999 12:07:28 -0400" }, { "cves": [], "log": [ "", " * debian/rules: fixed module_check", " * pam_env/pam_env.c: fixed env parsing to include values wrapped in ''", " and also allow continued lines with a trailing '\\'.", " * pam_motd,pam_mail: converted to session modules, so that they could", " be ordered with the lastlog module", " * updated default pam.d/login to reflect above change (now login looks", " the same as the non-PAM version, lastlog, then motd, and then mail", " check)", " * pam_motd: removed extraneous \\n from output", " * modules/pam_limits/pam_limits.c: Fixed parsing of lines with only", " \"domain -\", which was documented as being able to get rid of limits", " for that user or group.", " * debian/control: (libpam-cracklib) Added depends for cracklib-runtime,", " closes: #45488", " * modules/pam_env.c: Fixed /etc/environment parsing causing segfaults on", " long lines, closes: #45408", "" ], "package": "pam", "version": "0.69-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 19 Sep 1999 13:50:40 -0400" }, { "cves": [], "log": [ "", " * Install unix_chkpwd suid root, it's needed for NIS to work without", " modification to the binary.", " * modules/pam_limits/pam_limits.c: hmm, some how I got a strange broken", " patch left over from the source upgrade...removed all but the pwdb", " purging, closes: #45088", " * modules/pam_env/pam_env.c: Changed to a debug message, instead of a", " syslog message when /etc/environment does not exist.", "" ], "package": "pam", "version": "0.69-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 15 Sep 1999 04:25:21 -0400" }, { "cves": [], "log": [ "", " * Removed libpam0g's preinst check for full paths in the pam.d files,", " this should really be a lintian check at build (i think the old libpam", " could not work like this, but hey...things change for the better some", " times. This PAM works fine like that). closes: #45001", " +NOTE: Debian packages should not reference modules by the full path", " so they don't break if I ever decide to move the modules to a different", " default directory. Only the admin should reference full paths and only", " for locally installed modules. I have submitted a request to check for", " this in lintian along with a few other devious things.", " * debian/patches/008_pam_mkhomedir: Fix title of sgml doc", " * modules/pam_userdb/Makefile: added patch for building against glibc 2.0", " (request from Roman Hodek), closes: #45064", "" ], "package": "pam", "version": "0.69-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 14 Sep 1999 06:12:34 -0400" }, { "cves": [], "log": [ "", " * Link all dynamic modules with libpam. For some reason, alpha doesn't", " like it when we don't", "" ], "package": "pam", "version": "0.69-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 13 Sep 1999 06:01:40 -0400" }, { "cves": [], "log": [ "", " * doc/modules/pam_cracklib.sgml: changed to correct path for", " cracklib_dict reference.", " * modules/pam_env/pam_env.c: now groks bash style env's from", " /etc/environment to be compatible with other programs that use it.", " * modules/pam_securetty/pam_securetty.c: don't just plain fail when", " root isn't allowed to login, fake a password request just like any", " good auth module would. Keeps us from letting them know that they", " are doing something bad :)", " * modules/pam_{motd,mkhomedir}: merged these two modules into this", " source, also wrote corresponding sgml files for libpam-doc,", " closes: #40754", " * debian/control: Moved libpam0g, libpam-modules and libpam-runtime", " to base with required priority since login depends on them and", " policy will require this", "" ], "package": "pam", "version": "0.69-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 11 Sep 1999 08:06:02 -0400" }, { "cves": [], "log": [ "", " * Modified build so that it uses libs and headers in the build tree", " rather than on the local system. This involved changint the build", " order slightly and should make it easier to compile on new archs.", " * Modified pam_limits so that it was invoked during pam_sm_setcred()", " instead of during pam_sm_session_open() so that it will work with", " shadow's su.", " * Fixed missing symbols in libpam.so, they were caused by it thinking", " it was supposed to have static modules built in.", " * Fixed problem where libpam was getting built with -DDEBUG", " * pam_unix_passwd.c: Changed the perms on shadow to be 0.42 and 0640", " instead of 0.0 and 0600", " * unix_chkpwd: fix it not being sgid shadow", "" ], "package": "pam", "version": "0.69-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 9 Sep 1999 13:52:01 -0400" }, { "cves": [], "log": [ "", " * New upstream source", " - Now with a new and improved pam_unix module, closes: #38631", " - Lot's of documentation cleanups", " * Converted build system to dbs (doogie's build system, aka Adam Heath)", " * Fixed libpam.so compilation so that it did not link with any of the", " modules (this was causing lot's of problems, closes; #43913, #40739", " * modules/pam_ftp/pam_ftp.c: Fixed sizeof, to use strlen,", " closes: #44054, #41845, #44142, #39129, #39871, #44412", " * Postscript pages are now generated correctly, closes: #41608", " * Moved to FHS compliance (including use of debhelper 2.0.40),", " this also raises the policy version to 3.0.1.1", " * Don't check the paths in /etc/pam.d files anymore. This is old", " and causes nothing but complaints, closes: #39747", " * Build libpam0g-dbg with debuggable static and shared libraries, also", " enabled the internal DEBUG_REL compile flag for these so that the", " debugging messages will also be output", "" ], "package": "pam", "version": "0.69-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 7 Sep 1999 17:45:20 -0400" }, { "cves": [], "log": [ "", " * Added ability for pam_env to parse /etc/environment and updated", " docs to reflect it", " * Applied patch for pwdb_chkpwd man page, closes: #38976", " * Merged pam_unix_*.so modules into one pam_unix.so with symlinks", " for backward compatibility. This helps centralize this module the", " same way the pam_pwdb.so is and the way pam_unix.so is on other", " operating systems (commercial ones specifically).", " * Closed by pam-apps upload, closes: #38632", " * Fixed `sgml2latex' syntax, closes: #39119", " * Added doc-base support, closes: #37627", "" ], "package": "pam", "version": "0.66-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 16 Jun 1999 01:20:23 -0400" }, { "cves": [], "log": [ "", " * SPARC NMU to fix chown symbols when compiling with glibc 2.1.1", "" ], "package": "pam", "version": "0.66-9.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 11 May 1999 13:33:33 +0000" }, { "cves": [], "log": [ "", " * Changed the debian/rules to not mess with the library symlinks (ie", " running ldconfig in the lib dir) and all is well, closes: #36169", "" ], "package": "pam", "version": "0.66-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 18 Apr 1999 09:09:51 -0400" }, { "cves": [], "log": [ "", " * Compiled with libpam_client.so now (seperate lib in libpam0g)", " * Made regex for libpam0g postinst a little more specific so it", " didn't flag false problems. closes: #34626", " * Applied patch to fix pam_ftp, closes: #35388", " * Modified pam_mail and pam_lastlog to honor PAM_SILENT in order to", " enable apps to use hushlogin/PAM_SILENT", " * Fixed problem with libpam_client.so being static", "" ], "package": "pam", "version": "0.66-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 15 Mar 1999 20:54:23 -0500" }, { "cves": [], "log": [ "", " * Fixed XCASE in pam_filter.c (not really in glibc 2.1 by default)", "" ], "package": "pam", "version": "0.66-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 6 Mar 1999 18:46:56 -0500" }, { "cves": [], "log": [ "", " * Removed empty /lib/security/ from libpam0g (is created in", " libpam-runtime)", " * Added a depends for libpam-runtime to libpam0g (was supposed to be", " there, must have deleted it)", " * Removed empty /usr/bin from libpam-runtime (old directory where", " upperLOWER was)", "" ], "package": "pam", "version": "0.66-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 24 Feb 1999 13:14:25 -0500" }, { "cves": [], "log": [ "", " * Removed harcoded libc6 dependency from libpam0g-dev and changed it to", " libc6-dev. closes: #33615", " * Added md5 flag for pam_unix_passwd.so", " * Removed upperLOWER program since it is just an example. Moved it's", " source to the examples directory in libpam-modules", " * Fixed documentation of pam_strerror() and examples. closes #31142", " * Made pam_unix_passwd.so leave /etc/shadow mode 640 and root.shadow", " after changes", " * Fixed problem in pam_unix_auth that didn't let you su from a normal", " user to another normal user (ie. neither one was root)", " * Closing misc fixed bugs. closes #32809, #32274 (have been fixed,", " just need closing)", " * Tested lockvc with pam support, works for normal users (pam_pwdb)", " closes: #31150", " * Changed /var/log/wtmp in pam_lastlog docs to reflect correct", " /var/log/lastlog file. closes: #26544", " * Added -ldl to libpam.so, so apps don't have to", "" ], "package": "pam", "version": "0.66-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 19 Feb 1999 18:47:30 -0500" }, { "cves": [], "log": [ "", " * Changed pwdb_chkpwd to sgid shadow instead of suid root since it only", " needs read permissions to /etc/shadow and not write.", " * Moved a lot of files arouns to get rid of libpam-runtime dependencies", " * Put libpam-pwdb into it's own package", " * Removed -lpwdb links for modules since libpwdb is somewhat buggy (or", " alteast it's interaction with libpam is)", " * Fixed bug in pam_unix_passwd.so that caused it to never authenticate", " the correct passwd, making it so you couldn't change the passwd", "" ], "package": "pam", "version": "0.66-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 16 Feb 1999 15:50:28 -0500" }, { "cves": [], "log": [ "", " * Fixed defaults in /etc/pam.d/other to be pam_unix_*.so modules instead", " of the accidental pam_pwdb.so module", " * Fixed suid of pwdb_chkpwd (had to move dh_fixperms after", " dh_suidregister)", " * Added Replaces: libpam0g-util in order to help dpkg upgrade from", " older packages", " * Applied glibc 2.1 patch from Christian Meder. closes: #32809", " * Moved libpam-doc to Section doc. closes: #32274", "" ], "package": "pam", "version": "0.66-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 12 Feb 1999 02:01:43 -0500" }, { "cves": [], "log": [ "", " * Removed all of the versioned module stuff. Modules are now in", " /lib/security and stay there. Seems after discussion, that modules may", " not change as often as thought", " * Fixed suidregister for pwdb_chkpwd", " * Fixed incomplete descriptions in control file", " * This is a kludge to close some bugs since the last upload was yanked", " before being installed in the archive, closes: #16882, #30862, #7725,", " #10234, #10406, #12210, #14291, #15528, #15529, #20660, #25330,", " #29868, #31088, #31128, #9131, #9919, #19383, #5132, #14533, #25915,", " #28075, #31548, #31191", "" ], "package": "pam", "version": "0.66-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 2 Feb 1999 12:47:25 -0500" }, { "cves": [], "log": [ "", " * New maintainer", " * New upstream release. closes: #16882, #30862, #7725", " * Created a better split of the main lib and the runtime to kill the", " circular dependencies and make it possible to have two .so version of", " the library installed for upgrades. closes: #10234, #10406, #12210,", " bug #14291, #15528, #15529, #20660, #25330, #29868, #31088, #31128,", " bug #9131, #9919.", " * Harcoded modules directory prefixed with the .so version, and", " used alternatives to create the symlink to the 'default' modules", " directory. libpam will use the full path when specified, but use the", " versioned modules directory for relative names.", " * Put libpam0g-cracklib modules back in (own package). This means that", " cracklib support is _not_ in the static libpam.a, also cracklib", " support is _not_ in pam_unix_passwd.o, but only in pam_cracklib.so", " by itself.", " * Fixed a few typos in the source causing compile errors", " * Fixed source #include's so that pam _didn't_ have to be installed", " in order to compile the source ( changed from <> to \"\" )", " * Removed empty directories from built packages", " * Opted not to build examples, only going to put *.c files in examples", " directory for libpam0g-dev", " * Moved *.sgml files for modules into their own directory (looks like", " that is what the original maintainer wanted to do, but it didn't go)", " * Moved doc build to arch-indep build in rules so that it doesn't get", " built when specifying -B with debuild/dpkg-buildpackage.", " * Moved `touch .quiet...' to build-stamp in order to have -B builds not", " ask about pam.conf", " * Split out non-standard modules to their own package, so as to make the", " base install smaller (planning for base inclusion here)", " * Created small manpage for pwdb_chkpwd. closes: #10941", " * The Copright file in /usr/doc/*/ was already named copright and not", " compressed. closes: #14533", " * Package is now lintian clean. closes #19383, #5132", " * There is a maintainer now and the patch for #25915 is still included", " so.... closes: #25915", " * Added check for editor backup files in /etc/pam.d (*~). closes: #28075", " * Applied patch for md5.h in pam_pwdb module. closes: #31548", " * Added support for dhelp in libpam-doc. closes: #31191", "" ], "package": "pam", "version": "0.66-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 20 Jan 1999 07:09:15 -0500" }, { "cves": [], "log": [ "", " * Marked PAM as orphaned, given that there has been no maintainer upload", " in almost two years.", " * [defs/debian.defs] Removed superflous cracklib2 dependency.", " (Urgent as cracklib still has release-critical bugs).", " (Fixes #30862).", "" ], "package": "pam", "version": "0.65-0.8", "urgency": "high", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Wed, 20 Jan 1999 09:34:35 +0100" }, { "cves": [], "log": [ "", " * Fixed security vulnerability in the pam_unix and pam_tally modules", " (reported by Michal Zalewski on bugtraq; patch", " A000-SECURITY-PATCH-0.65-and-below.gz by Andrey V. Savochkin).", "" ], "package": "pam", "version": "0.65-0.7", "urgency": "high", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Tue, 29 Dec 1998 16:20:18 +0100" }, { "cves": [], "log": [ "", " * Fixed distribution of files over the various packages, which was", " severely messed up.", " * Added appropriate Replaces: to ensure upgrading from both the hamm", " version and previous slink versions.", " * Fixed debug libraries, PAM module loading.", " * Added examples.", " * Added a \"pam-undocumented\" manpage pointing to libpam-doc, and", " made links for functions without a manpage to that.", "" ], "package": "pam", "version": "0.65-0.6", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Sun, 11 Oct 1998 19:29:40 +0200" }, { "cves": [], "log": [ "", " * Rewritten the preinst warning text (it still mentioned the search path).", "" ], "package": "pam", "version": "0.65-0.5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Fri, 9 Oct 1998 14:23:18 +0200" }, { "cves": [], "log": [ "", " * It looks like I misunderstood DEFAULT_MODULE_PATH: Linux-PAM does not", " currently seem to be easily configured to look for modules in more than", " one directory. With this version, it's configured to look only in", " /lib/security .", "" ], "package": "pam", "version": "0.65-0.4", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Fri, 9 Oct 1998 11:43:34 +0200" }, { "cves": [], "log": [ "", " * Moving the PAM modules to /lib/security broke netatalk.", " Added a preinst script to detect /etc/pam.d files with explicit paths to", " PAM modules, give a warning about them, and offer to abort the install", " (Fixes #27514).", "" ], "package": "pam", "version": "0.65-0.3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Tue, 6 Oct 1998 20:10:43 +0200" }, { "cves": [], "log": [ "", " * Argh. The tools didn't recognise -0.1 as a new upstream release, so", " my previous upload was rejected due to a missing .orig.tar.gz .", "" ], "package": "pam", "version": "0.65-0.2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Sun, 4 Oct 1998 17:15:09 +0200" }, { "cves": [], "log": [ "", " * New upstream version.", " * Non-maintainer upload.", " * Major package overhaul; now uses debhelper.", " * In experimental for now. *Please* provide feedback; if the feedback is", " positive, we can put this in slink.", " * Dropped libc5 support.", " * [libpam/pam_static.c] Fixed compilation: \"pamh\" was undefined; use \"NULL\".", " is this the correct fix?", " * [defs/debian.defs] New.", " * [Makefile]", " * Exit when a make in a subdirectory fails.", " * Compile statically too.", " * New variables: LC, LP, LPLIBS, DEFAULT_MODULE_PATH .", " * [libpam/Makefile]", " * Use DEFAULT_MODULE_PATH if nonempty.", " * Link libpam against LPLIBS.", " * [modules/*/Makefile]", " * Link the dynamic security objects against libpam and libc", " (LP and LC).", " * [modules/pam_pwdb/Makefile]", " * Link dynamic security objects against libcrypt and libnsl.", " * [conf/install_conf] Allow for non-interactive install (as the other", " install_conf scripts already did).", " * Automatically determine the list of /etc/security/* conffiles.", " * Moved libpam to /lib, and PAM modules to /lib/security as they will", " become part of the base system in the future.", " * Built without cracklib support, to keep the base system smaller.", " * /sbin/pwdb_chkpwd is undocumented, as is upperLOWER.", "" ], "package": "pam", "version": "0.65-0.1", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Fri, 2 Oct 1998 20:23:27 +0200" }, { "cves": [], "log": [ "", " * Non maintainer upload", " My previous upload had removed the libc5 stuff from the controlfile", " messing up things. Change 'Architecture: any' to 'i386 m68k' for those", " .deb's instead.", "" ], "package": "pam", "version": "0.57b-0.4", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Turbo Fredriksson ", "date": "Thu, 20 Aug 1998 20:06:50 -0400" }, { "cves": [], "log": [ "", " * Non maintainer upload", " On a glibc2.1 system, XCASE is only defined in the ", " _IF_ '__USE_MISC' or '__USE_UNIX98' is defined.", "" ], "package": "pam", "version": "0.57b-0.3", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Turbo Fredriksson ", "date": "Sun, 16 Aug 1998 22:13:45 -0400" }, { "cves": [], "log": [ "", " * Yet another non-maintainer release.", " * Zero changes; simply a re-upload due to a rm-trigger happy release", " ``manager''.", "" ], "package": "pam", "version": "0.57b-0.2", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "James Troup ", "date": "Tue, 17 Mar 1998 19:55:16 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer release.", " * debian/control (Standards-Version): Updated to 2.4.0.0.", " * debian/control (libpam0g-dev): Also conflict with libpam-dbg.", " * debian/postinst: use case statement instead of if.", " * debian/rules (COMPAT_ARCHES): removed sparc.", " * debian/rules (binary-libc6-dev, binary-libc5-altdev): strip static libraries with", " --strip-debug, not --strip-unneeded.", " * debian/rules: each package now has it's own doc directory under", " /usr/doc/, containing at least the copyright file (Policy 5.6).", " * debian/rules: install files with `install -m 644' not `cp -p' to avoid", " read-only files.", " * debian/rules (binary-libc6-util): strip /usr/lib/*/security/*.so with", " --strip-unneeded.", " * debian/rules (binary-libc5-util): ditto.", " * debian/rules (binary-libc5): don't depend on binary-libc5.", "" ], "package": "pam", "version": "0.57b-0.1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "James Troup ", "date": "Sat, 7 Mar 1998 18:04:19 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer release.", " * New upstream version.", " * Doesn't use pristine upstream source as the upstream tar ball is broken.", " * Added libc6 libraries libpam0g, libpam0g-dev, libpam0g-dbg and", " libpam0g-util. [#11697]", " * libpam-dev becomes libpam0-altdev, libpam-util -> libpam0-altutil and", " libpam-dbg is removed.", " * libpam0 depends on libpam0g because libpam0g contains the pam conffile.", " * libpam0-util depends on libpam0g-util because libpam0g contains the binary.", " * Compiled with -D_REENTRANT and link with -lc.", " * Fixed permissions on shared libraries.", " * Corrected syntax of /etc/pam.d/other. [#10497, #10758, #12030]", " * Fixed typos in postinst. [#10474, #11365]", " * Made /etc/pam.conf a conffile.", " * Updated URL in copyright file.", " * Removed over-zelaously installed README* files from libpam-doc.", "" ], "package": "pam", "version": "0.57b-0", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "James Troup ", "date": "Sat, 22 Nov 1997 17:54:30 +0100" }, { "cves": [], "log": [ "", " * Added /etc/pam.d/other with policy 'deny'.", " * Add manual pages for PAM security modules.", "" ], "package": "pam", "version": "0.56-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Klee Dienes ", "date": "Sat, 15 Mar 1997 22:33:22 -0500" }, { "cves": [], "log": [ "", " * New upstream release.", " * Converted to new packaging format.", " * Reorganization of package structure (-dev, -dbg, etc).", "" ], "package": "pam", "version": "0.56-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Klee Dienes ", "date": "Sat, 8 Mar 1997 01:21:17 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-modules-bin", "from_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.6", "version": "1.5.3-5ubuntu5.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.7", "version": "1.5.3-5ubuntu5.7" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" }, { "cve": "CVE-2024-10963", "url": "https://ubuntu.com/security/CVE-2024-10963", "cve_description": "A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.", "cve_priority": "medium", "cve_public_date": "2024-11-07 16:15:00 UTC" }, { "cve": "CVE-2025-6020", "url": "https://ubuntu.com/security/CVE-2025-6020", "cve_description": "A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.", "cve_priority": "medium", "cve_public_date": "2025-06-17 13:15:00 UTC" }, { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" }, { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" }, { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" }, { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" }, { "cve": "CVE-2015-3238", "url": "https://ubuntu.com/security/CVE-2015-3238", "cve_description": "The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.", "cve_priority": "low", "cve_public_date": "2015-08-24 14:59:00 UTC" }, { "cve": "CVE-2013-7041", "url": "https://ubuntu.com/security/CVE-2013-7041", "cve_description": "The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack.", "cve_priority": "low", "cve_public_date": "2014-05-08 14:29:00 UTC" }, { "cve": "CVE-2014-2583", "url": "https://ubuntu.com/security/CVE-2014-2583", "cve_description": "Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.", "cve_priority": "low", "cve_public_date": "2014-04-10 20:29:00 UTC" }, { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2010-3853", "url": "https://ubuntu.com/security/CVE-2010-3853", "cve_description": "pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3316", "url": "https://ubuntu.com/security/CVE-2010-3316", "cve_description": "The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pam_xauth PAM check.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3430", "url": "https://ubuntu.com/security/CVE-2010-3430", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3431", "url": "https://ubuntu.com/security/CVE-2010-3431", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3435", "url": "https://ubuntu.com/security/CVE-2010-3435", "cve_description": "The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-0832", "url": "https://ubuntu.com/security/CVE-2010-0832", "cve_description": "pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to \"user file stamps\" and the motd.legal-notice file.", "cve_priority": "high", "cve_public_date": "2010-07-12 16:30:00 UTC" }, { "cve": "CVE-2009-0887", "url": "https://ubuntu.com/security/CVE-2009-0887", "cve_description": "Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.", "cve_priority": "low", "cve_public_date": "2009-03-12 15:20:00 UTC" }, { "cve": "CVE-2005-2977", "url": "https://ubuntu.com/security/CVE-2005-2977", "cve_description": "The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unix_chkpwd, which does not log failed guesses or delay its responses.", "cve_priority": "medium", "cve_public_date": "2005-11-01 12:47:00 UTC" } ], "launchpad_bugs_fixed": [ 2164901, 2087827, 2064360, 2064350, 2059859, 2055453, 1953201, 1953201, 1916509, 1860826, 772121, 1860826, 1935972, 1927796, 1659719, 1856703, 1855092, 1192719, 1192719, 1538284, 1081323, 1571864, 1487103, 1558114, 557013, 1160288, 1126404, 110287, 955032, 1095887, 937005, 110287, 871083, 744944, 871943, 805423, 745004, 882794, 871943, 805423, 874469, 874565, 794531, 253096, 746655, 391761, 745532, 663090, 744944, 733501, 297408, 588547, 562566, 552175, 513955, 356766, 424566, 287715, 410171, 399071, 399071, 314222, 303515, 305882, 303515, 305882, 303515, 305882, 294513, 295135, 295441, 65244, 256238, 291091, 272232, 270328, 260371, 260122, 259867, 216990, 216990, 245786, 9224, 64064, 216990, 141309, 187822, 139075, 64064, 216990, 208419, 198714, 187822, 139075, 141309, 139065, 141309, 139075, 43169, 14505, 80431 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:35 -0400" }, { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411-pre1.patch: libpam: add helper to compare", " strings in constant time in libpam/include/pam_inline.h.", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 09:44:01 -0400" }, { "cves": [ { "cve": "CVE-2024-10963", "url": "https://ubuntu.com/security/CVE-2024-10963", "cve_description": "A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.", "cve_priority": "medium", "cve_public_date": "2024-11-07 16:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: pam_access hostname confusion", " - debian/patches/CVE-2024-10963.patch: add \"nodns\" option to disallow", " resolving of tokens as hostname in", " modules/pam_access/access.conf.5.xml,", " modules/pam_access/pam_access.8.xml,", " modules/pam_access/pam_access.c.", " - CVE-2024-10963", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.5", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 15 Sep 2025 08:37:15 -0400" }, { "cves": [ { "cve": "CVE-2025-6020", "url": "https://ubuntu.com/security/CVE-2025-6020", "cve_description": "A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.", "cve_priority": "medium", "cve_public_date": "2025-06-17 13:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: privilege escalation via pam_namespace", " - debian/patches/pam_namespace_170.patch: sync pam_namespace module to", " version 1.7.0.", " - debian/patches/pam_namespace_post170-*.patch: add post-1.7.0 changes", " from upstream git tree.", " - debian/patches/pam_namespace_revert_abi.patch: revert ABI change to", " prevent unintended issues in running daemons.", " - debian/patches/CVE-2025-6020-1.patch: fix potential privilege", " escalation.", " - debian/patches/CVE-2025-6020-2.patch: add flags to indicate path", " safety.", " - debian/patches/CVE-2025-6020-3.patch: secure_opendir: do not look at", " the group ownership.", " - debian/patches/pam_namespace_o_directory.patch: removed, included in", " patch cluster above.", " - CVE-2025-6020", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.4", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 12 Jun 2025 10:45:28 -0400" }, { "cves": [], "log": [ "", " * d/p/031_pam_include: fix loading from /usr/lib/pam.d (LP: #2087827)", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2087827 ], "author": "Simon Chopin ", "date": "Mon, 26 May 2025 16:34:46 +0200" }, { "cves": [], "log": [ "", " [ Sam Hartman ]", " * Correct Build depends for docbook5 (LP: #2064360)", " * Depend on libdb-dev again, bringing back pam_userdb (LP: #2064350)", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2064360, 2064350 ], "author": "Dan Bungert ", "date": "Thu, 02 May 2024 16:20:13 -0600" }, { "cves": [], "log": [ "", " * d/p/pam_env-remove-deprecation-notice-for-user_readenv.patch: drop", " deprecation warning about user_readenv from pam_env (LP: #2059859)", "" ], "package": "pam", "version": "1.5.3-5ubuntu5", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2059859 ], "author": "Andreas Hasenack ", "date": "Wed, 10 Apr 2024 16:19:22 -0300" }, { "cves": [ { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" } ], "log": [ "", " * No-change rebuild for CVE-2024-3094", "" ], "package": "pam", "version": "1.5.3-5ubuntu4", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 31 Mar 2024 00:03:23 +0000" }, { "cves": [], "log": [ "", " * No-change rebuild against libdb5.3t64", "" ], "package": "pam", "version": "1.5.3-5ubuntu3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 02 Mar 2024 20:36:06 +0000" }, { "cves": [], "log": [ "", " * Fix FTBFS when built with -Werror=implicit-function-declaration", " (LP: #2055453)", "" ], "package": "pam", "version": "1.5.3-5ubuntu2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2055453 ], "author": "Dan Bungert ", "date": "Thu, 29 Feb 2024 11:53:08 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager", " when there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", "" ], "package": "pam", "version": "1.5.3-5ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Dan Bungert ", "date": "Thu, 29 Feb 2024 10:25:41 -0700" }, { "cves": [], "log": [ "", " * Revert renaming libpam0g to libpam0t64 for time_t transition: apt", " sometimes removes libpam0g rather than simply letting libpam0t64", " replace libpam0g (and deconfiguring libpam0g), leaving a system where", " essential packages are broken, Closes: #1065017", " * Since libpam0t64 is going away, we do not need dpkg-diversions for it.", " * As a consequence libpam_misc has an ABI break without a package name", " change. We believe nothing in the archive depends on this ABI, and at", " least until we come up with a better solution this is the least bad option.", " * For now remove libdb-dev so that libdb-dev can undergo time_t", " transition. That means this version of pam does not include", " pam_userdb, which makes pam unsuitable for release. ", " * Replace/break libpam0t64", "" ], "package": "pam", "version": "1.5.3-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 29 Feb 2024 09:46:54 -0700" }, { "cves": [ { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" } ], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0t64.postinst: only ask questions during update-manager", " when there are non-default services running.", " - debian/libpam0t64.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " * Dropped changes, included in Debian:", " - SECURITY UPDATE: pam_namespace local denial of service", " - debian/patches/CVE-2024-22365.patch: use O_DIRECTORY to", " prevent local DoS situations in modules/pam_namespace/pam_namespace.c.", " - CVE-2024-22365", " - Install into /usr/{lib,sbin} instead of /{lib,sbin}. Assumes", " usrmerge aliasing symlinks are in place since bookworm to keep", " compatibility with PAM modules still installing into /lib.", " (DEP17 M2) (Closes: #1060160).", " - Mitigate /usr-move file loss. (Closes: #1062802)", " - Update lintian override for setgid binary.", "" ], "package": "pam", "version": "1.5.3-4ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Dan Bungert ", "date": "Wed, 28 Feb 2024 21:07:18 -0700" }, { "cves": [], "log": [ "", " * Upload to unstable", " * Revert 1.5.2-9.1 changes to debian/rules now that we use", " debian/patches properly.", "" ], "package": "pam", "version": "1.5.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 27 Feb 2024 21:30:52 -0700" }, { "cves": [], "log": [ "", " [ Helmut Grohne ]", " * Mitigate /usr-move file loss. (Closes: #1062802)", "" ], "package": "pam", "version": "1.5.3-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Helmut Grohne ", "date": "Sat, 03 Feb 2024 12:18:52 +0100" }, { "cves": [ { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" } ], "log": [ "", " * Rename libpam0g to libpamt64 for time_t transition", " * New Swedish Translations, Thanks Martin Bagge / brother, Closes: #1057775", " * pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS", " situations (CVE-2024-22365) (Closes: #1061097)", "" ], "package": "pam", "version": "1.5.3-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 02 Feb 2024 11:27:45 -0700" }, { "cves": [], "log": [ "", " [ Sam Hartman ]", " * New upstream version", " * Since we no longer build with NIS support, drop Debian patches related", " to NIS", " [ Debian Janitor]", " * Update lintian override info to new format:", " + debian/libpam-runtime.lintian-overrides: line 5, 7, 9-13", " + debian/libpam-modules.lintian-overrides: line 5-10, 14", " * Trim trailing whitespace.", " * Move source package lintian overrides to debian/source.", " * Update renamed lintian tag names in lintian overrides.", " * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository-Browse.", " * Drop unnecessary dependency on dh-autoreconf.", " * Update standards version to 4.6.2, no changes needed.", "", " [ Andreas Henriksson ]", " * debian/rules: use --enable-usergroups configure flag (Closes: #583958)", " * Use pam_umask.so in common-session{-noninteractive} (Closes: #711104)", "", " [ Debian Janitor ]", " * Apply multi-arch hints. + libpam-doc: Add Multi-Arch: foreign.", "", " [ Sam Hartman ]", " * Drop NIS patches and rearrange other patches.", " * Update patch to move pam manpage to section 7: docbook tools now take", " the man page output name from the xml so we need to update the", " Makefile. ", " * Now PAM.7 is actually installed as pam.7 so update packaging", " * pam-auth-update: Session-Interactive-Only set to anything other than", " yes counts as undefined/no, thanks Lucas Nussbaum, Closes: #982309", " * Use logind instead of utmp in pam_issue and pam_timestamp; utmp is not", " y2038-safe.", "", " [ Sam Hartman ]", " * Add new common-session-* templates to pam-auth-update.", "", " [ Chris Hofstaedtler ]", " * Install into /usr/{lib,sbin} instead of /{lib,sbin}. Assumes", " usrmerge aliasing symlinks are in place since bookworm to keep", " compatibility with PAM modules still installing into /lib.", " (DEP17 M2) (Closes: #1060160).", " * Update lintian override for setgid binary.", " " ], "package": "pam", "version": "1.5.3-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 15 Jan 2024 15:45:50 -0700" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Install into /usr/{lib,sbin} instead of /{lib,sbin}. Assumes", " usrmerge aliasing symlinks are in place since bookworm to keep", " compatibility with PAM modules still installing into /lib.", " (DEP17 M2) (Closes: #1060160).", " * Update lintian override for setgid binary.", "", " [ Helmut Grohne ]", " * Mitigate /usr-move file loss. (Closes: #1062802)", "" ], "package": "pam", "version": "1.5.2-9.1ubuntu3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Thu, 22 Feb 2024 13:24:31 +0100" }, { "cves": [ { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: pam_namespace local denial of service", " - debian/patches-applied/CVE-2024-22365.patch: use O_DIRECTORY to", " prevent local DoS situations in modules/pam_namespace/pam_namespace.c.", " - CVE-2024-22365", "" ], "package": "pam", "version": "1.5.2-9.1ubuntu2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 17 Jan 2024 12:28:44 -0500" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " * debian/update-motd.5: fix a typo; thanks to David", " Collantes .", "" ], "package": "pam", "version": "1.5.2-9.1ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 20 Nov 2023 06:39:20 -0800" }, { "cves": [], "log": [ "", " * Non-maintainer upload acked by Sam Hartman.", " * Really fix quilt-related FTBFS: (Closes: #1054505)", " pam is a 3.0 (quilt) source package and has a .pc directory after unpack", " despite having no debian/patches. Even when setting QUILT_PATCH_DIR or", " QUILT_PATCHES, quilt is now mislead to using the non-existent", " debian/patches and this makes dh_quilt_unpatch fail, so we delete that", " directory unless it corresponds to the real debian/patches-applied that we", " want to be used.", "" ], "package": "pam", "version": "1.5.2-9.1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Helmut Grohne ", "date": "Tue, 24 Oct 2023 19:38:53 +0200" }, { "cves": [], "log": [ "", " * Revert 1.5.2-8 upload; as far as I can tell the change is incorrect,", " Closes: #1054493", " " ], "package": "pam", "version": "1.5.2-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 24 Oct 2023 09:19:43 -0600" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * Drop reference to stale package version in libpam-modules.postinst;", " thanks, Gioele Barabucci .", "", " [ Sam Hartman ]", " * Fix pam-auth-update --disable logic error, Closes: #1039873", " * Set myself as maintainer; thanks Steve for past and future work.", " * Fix watch file, thanks Daniel Lewart, Closes: #1040310", " * Install upstream NEWS file as main upstream changelog; detailed", " CHANGELOG only in libpam-doc, Closes: #1040315", " * Updated Turkish Debconf translations, Thanks Atila KOÇ, Closes: #1029002", "" ], "package": "pam", "version": "1.5.2-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 16 Aug 2023 17:22:53 -0600" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", "" ], "package": "pam", "version": "1.5.2-6ubuntu1", "urgency": "medium", "distributions": "mantic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 15 May 2023 15:17:53 -0700" }, { "cves": [], "log": [ "", " * Update debian/copyright, Thanks Bastian Germann, Closes: #460232", " * When pam-auth-update is called with --root, use", " /usr/share/pam-configs from the root not from the host system, Thanks", " Johannes Schauer Marin Rodrigues, Closes: #1022952", " * Build-depend on libcrypt-dev, Closes: #1024645", " * Add pam-auth-udpate --disable, Closes: #1004000", " * Add autopkgtests", "" ], "package": "pam", "version": "1.5.2-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 03 Jan 2023 13:15:23 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable; remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", "" ], "package": "pam", "version": "1.5.2-5ubuntu1", "urgency": "medium", "distributions": "lunar", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Nov 2022 12:53:39 -0800" }, { "cves": [], "log": [ "", " * pam_namespace_helper manpage *wasn't* missing, it was just being", " wrongly shipped in libpam-modules instead - so complete the moving", " of the manpage to the libpam-modules-bin where it belongs with the", " binary. Really Closes: #1021336.", "" ], "package": "pam", "version": "1.5.2-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 06 Oct 2022 18:56:06 +0000" }, { "cves": [], "log": [ "", " * pam_namespace_helper manpage was missing, but namespace.conf.5 was", " already shipped in libpam-modules. Leave it there. Closes: #1021336.", "" ], "package": "pam", "version": "1.5.2-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 06 Oct 2022 17:28:36 +0000" }, { "cves": [], "log": [ "", " * Add missing manpages for pam_namespace which for some reason don't get", " installed by the upstream rules", " * Drop obsolete upgrade code from maintainer scripts which is no longer", " used", " * Drop manual multiarch file handling in favor of dh-exec.", " * No special-case needed for pam_modutil_sanitize_helper_fds in symbols", " file, it's covered by the existing globs.", " * debian/local/Debian-PAM-MiniPolicy: drop references to ancient", " package versions. Thanks, Marc Haber.", " * Support DPKG_ROOT in the postinst scripts. Closes: #993161.", " Thanks, Johannes Schauer Marin Rodrigues.", " * Further proof libpam-runtime postinst for DPKG_ROOT just in case.", "" ], "package": "pam", "version": "1.5.2-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 06 Oct 2022 04:05:02 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " * Dropped changes, no longer needed:", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", " * Refresh patches.", " * debian/patches-applied/extrausers.patch: update for upstream changes.", "" ], "package": "pam", "version": "1.5.2-2ubuntu1", "urgency": "medium", "distributions": "kinetic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Aug 2022 18:16:30 +0000" }, { "cves": [], "log": [ "", " * Pass --with-systemdunitdir=/usr/lib/systemd/system for consistent", " builds whether we are or aren't building in an environment with systemd", " present.", " * Install the pam_namespace.service unit in the libpam-modules-bin", " package.", "" ], "package": "pam", "version": "1.5.2-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Aug 2022 16:47:57 +0000" }, { "cves": [], "log": [ "", " * New upstream release.", " - fixes compatibility with libpam-systemd. Closes: #1017467.", " - fixes bashisms in configure.ac. Closes: #998361.", " * Refresh patches.", " * Drop patches included or obsoleted upstream:", " - debian/patches-applied/pam_unix_fix_sgid_shadow_auth.patch", " - debian/patches-applied/pam_unix_initialize_daysleft", " - debian/patches-applied/pam_faillock_create_directory", " - debian/patches-applied/pam_unix_avoid_checksalt", " - debian/patches-applied/pam_env-allow-environment-files-without-EOL-at-EOF.patch", " * Drop libpam-cracklib which has been obsoleted upstream.", " * Add pkgconfig .pc files to libpam0g-dev. Closes: #1012688.", " * Update .symbols file.", " * Updated Romanian debconf translation, thanks Andrei Popescu, Closes:", " #986416", " * Drop versioning of quilt build-dependency to quiet lintian, since the", " version is satisfied by oldoldoldstable.", " * Drop unused build-build-dependency on bzip2.", " * Adjust lintian overrides for latest lintian syntax.", " * Update Standards-Version.", " * Bump debhelper compat to 13.", " * debian/not-installed: document upstream files that aren't used.", " * Override incorrect lintian warning about use of dpkg database.", " * Override lintian warning for PAM module manpages being in section 8", " * Override lintian warning for unused debconf templates", " * Install additional upstream manpages: faillock(8), environment(5),", " pwhistory_helper(8)", " * Install additional helpers in libpam-modules-bin: pam_namespace_helper,", " pwhistory_helper", " * Fix wrong syntax in symbols file", "" ], "package": "pam", "version": "1.5.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Aug 2022 07:27:16 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", "" ], "package": "pam", "version": "1.4.0-13ubuntu1", "urgency": "medium", "distributions": "kinetic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 26 Apr 2022 11:10:38 -0700" }, { "cves": [], "log": [ "", " * Don't build with NIS support. This is only used for password changes on", " NIS systems, and is pulling a large dependency chain into the Essential", " package set which is not justifiable.", "" ], "package": "pam", "version": "1.4.0-13", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 25 Apr 2022 16:12:04 -0700" }, { "cves": [], "log": [ "", " * Drop Recommends on update-motd which is no longer used and is not being", " maintained.", "" ], "package": "pam", "version": "1.4.0-11ubuntu2", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 23 Mar 2022 18:43:24 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", " * Dropped changes, included in Debian:", " - d/p/pam_env-allow-environment-files-without-EOL-at-EOF.patch:", " Allow /etc/environment files without EOL at EOF.", "" ], "package": "pam", "version": "1.4.0-11ubuntu1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Feb 2022 08:51:50 -0800" }, { "cves": [], "log": [ "", " * Whitespace fixes in debconf templates.", "", " [ Sergio Durigan Junior ]", " * d/p/pam_env-allow-environment-files-without-EOL-at-EOF.patch:", " Allow /etc/environment files without EOL at EOF. In other words,", " allow files without a newline at the end. (LP: #1953201)", "" ], "package": "pam", "version": "1.4.0-11", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 1953201 ], "author": "Steve Langasek ", "date": "Mon, 06 Dec 2021 11:11:31 -0800" }, { "cves": [], "log": [ "", " [ Sergio Durigan Junior ]", " * d/p/pam_env-allow-environment-files-without-EOL-at-EOF.patch:", " Allow /etc/environment files without EOL at EOF. In other words,", " allow files without a newline at the end. (LP: #1953201)", "" ], "package": "pam", "version": "1.4.0-10ubuntu2", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1953201 ], "author": "Steve Langasek ", "date": "Mon, 06 Dec 2021 11:05:28 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable (LP: #1916509). Remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", " * Dropped changes, obsoleted:", " - pam_motd: Export MOTD_SHOWN=pam after showing MOTD", " - Return only PAM_IGNORE or error from pam_motd", " - Fix patches to fix FTBFS", " - Backport pam_faillock module from pam 1.4.0", " - debian/patches-applied/nullok_secure-compat.patch: Support", " nullok_secure as a deprecated alias for nullok.", " - debian/pam-configs/unix: use nullok, not nullok_secure.", " * Patches:", " - d/p/pam_motd-legal-notice: refreshed", " - Refreshed d/p/pam_umask_usergroups_from_login.defs.patch to use", " pam_modutil_search_key instead of our own hand-rolled version", " - d/p/extrausers.patch: Refreshed the patch and fixed the", " HAVE_LIBSELINUX conditional removed upstream.", " * d/local/pam-auth-update: refreshed the md5sum for debian/local/common-session", "" ], "package": "pam", "version": "1.4.0-10ubuntu1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1916509 ], "author": "Simon Chopin ", "date": "Tue, 26 Oct 2021 10:49:14 +0200" }, { "cves": [], "log": [ "", " * Fix syntax error in libpam0g.postinst when a systemd unit fails,", " Closes: #992538", " * Include upstream patch not to use crypt_checksalt; without this", " passwords set prior to bullseye were considered expired, Closes:", " #992848", " * Support DPKG_ROOT for pam-auth-update, thanks Johannes 'josch' Schauer", " Closes: #983427", "", "" ], "package": "pam", "version": "1.4.0-10", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 26 Aug 2021 13:43:23 -0600" }, { "cves": [], "log": [ "", " * Revert prefer the multiarch path from 1.4.0-8: It turns out that", " Debian uses DEFAULT_MODULE_PATH and _PAM_ISA in the opposite meaning", " of upstream. If I had read the patch header of", " patches-applied/lib_security_multiarch_compat more closely I would", " have noticed this. The effect of 1.4.0-9 is what is stated in the", " 1.4.0-8 changelog: we prefer multiarch paths, but the original patch", " did that.", " * I did test this in 1.4.0-8, but my test design was flawed. I placed a", " invalid shared object in /lib/security and confirmed it did not shadow", " an object in /lib/x86_64-linux-gnu/security. However I realized", " shortly after releasing 1.4.0-8 that a valid shared object in", " /lib/security will shadow one in the multiarch path.", "" ], "package": "pam", "version": "1.4.0-9", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 09 Jul 2021 10:55:02 -0600" }, { "cves": [], "log": [ "", " [ Hideki Yamane ]", " * debian/patches-applied/lib_security_multiarch_compat", " - Fix regression introduced in 1.4.0-1: search both /lib/security and", " /lib/[multiarch_tripple]/security/, Closes: #990790", "", " [ Sam Hartman ]", " * Reword changelog", " * Prefer the multiarch path (_PAM_ISA) to the non-multiarch path.", " That's different than buster, but guarantees everything already", " working in bullseye will continue to work and also guarantees that", " when multiarch modules are available we use them.", "" ], "package": "pam", "version": "1.4.0-8", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Hideki Yamane ", "date": "Tue, 06 Jul 2021 22:09:15 +0900" }, { "cves": [], "log": [ "", " * Updated portuguese debconf translation, thanks Pedro Ribeiro, Closes:", " #983594", " * Updated Simplified Chinese Translations, thanks Boyuan Yang", " * Updated Bulgarian Translation, Thanks Damyan Ivanov", " * Updated translation from the Slovak team, thanks Ladislav Michnovič,", " Closes: #984891", " * Updated Catalan translation, thanks Alex Muntada, Closes: #984568", " * Updated Brazilian Portuguese translation, Thanks Adriano Rafael Gomes,", " Closes: #984656", " * French Debconf translations, thanks Jean-Pierre Giraud , Closes:", " #984910", " * Updated russian Debconf translations, thanks Алексей Шилин, Closes:", " #984878", " * Updated Dutch debconf templates, Thanks Frans Spiesschaert, Closes:", " #984823", " * Updated German Debconf translations, Thanks Sven Joachim", " * Code review fixes for the fix to #982295, thanks Mark Hindley", " - Actually set service to $1 rather than happening to use a variable", " of the same name in enclosing scope", " - Remove dead code setting idl when not used", " * Code review fixes to the fix for #982530, thanks Martin Schurz", " - Include '-' in the file matching regexp so we search", " /etc/pam.d/common-* for uses of pam_tally. The profile check will", " catch this unless the user has overwridden the configuration", " - Fix capitalization of pam_Tally in debconf description", "", "" ], "package": "pam", "version": "1.4.0-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 15 Mar 2021 15:01:55 -0400" }, { "cves": [], "log": [ "", " * Clearly it's been too long since I've done debconf; run", " debconf-updatepo so the translations will show up as needing", " translating.", "" ], "package": "pam", "version": "1.4.0-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 26 Feb 2021 10:48:23 -0500" }, { "cves": [], "log": [ "", " * Remove profiles containing pam_tally or pam_tally2 since we no longer", " build them.", " * Also, fail to permit profiles to be selected that include pam_tally", " once the new pam-auth-update is installed", " * Check for any user-added references to pam_tally and halt the upgrade,", " Closes: #982530", " * Handle services with systemd units but no init scripts, Closes: #982295", " * Register md5sum for new common-password template, Closes: #982898", " * After reading pam-auth-update source, I agree with Lucas Nussbaum", " that common-session is intended only for interactive sessions.", " Otherwise pam-auth-update should not duplicate module configurations", " between common-session-noninteractive and common-session, so update", " the documentation, Closes: #982297", "" ], "package": "pam", "version": "1.4.0-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 25 Feb 2021 15:48:22 -0500" }, { "cves": [], "log": [ "", " * Document in README.source how to avoid multi-arch problems with documentation, Closes: #851650", " * Update header to common-password talking about sha512", " * The fix for #977648 incorrectly assumed how prerm scripts are called; update.", "" ], "package": "pam", "version": "1.4.0-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 03 Feb 2021 12:35:12 -0500" }, { "cves": [], "log": [ "", " [ Josh Triplett ]", " * libpam-runtime.postrm: Remove session-noninteractive files on purge,", " Closes: #978601", "", " [ Sam Hartman ]", " * patches-applied/pam_mkhomedir_stat_before_opendir: Stat the skeleton", " directory before opendir, Closes: #834589", " * libpam-modules.install: Install pam_faillock binaries, Closes: #981092", " * debian/patches-applied/pam_unix_initialize_daysleft : Initialize days before password expire, Closes: #980285", " * pam-configs/unix: Default to yescript rather than sha512. From a theoretical security standpoint, it looks like yescript has similar security properties, assuming (as we typically do in the crypto protocol community) that sha256 is still reasonable. However, in terms of practical resistant to password cracking, particularly in terms of valuing space complexity as well as time complexity, yescript is superior, Closes: #978553", " * No infinite loop on purge of libpam-runtime, Closes: #977648", " * patches-applied/pam_faillock_create_directory: create /run/faillock when needed.", "", "" ], "package": "pam", "version": "1.4.0-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 01 Feb 2021 15:27:08 -0500" }, { "cves": [], "log": [ "", " * Restart services on upgrade to 1.4.0. Closes: #978555.", "" ], "package": "pam", "version": "1.4.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 28 Dec 2020 19:20:38 -0800" }, { "cves": [], "log": [ "", " * New upstream release. Closes: #948188.", " - Stop using obsoleted selinux headers. Closes: #956355.", " - Continue building pam_cracklib, which is deprecated upstream;", " the replacement, pam_passwdqc, is packaged separately.", " - Update symbols file for new symbols.", " - Refresh lintian overrides for changes to available pam modules.", " * Drop patches to implement \"nullok_secure\" option for pam_unix.", " Closes: #674857, #936071, LP: #1860826.", " * debian/patches-applied/cve-2010-4708.patch: drop, applied upstream.", " * debian/patches-applied/nullok_secure-compat.patch: Support", " nullok_secure as a deprecated alias for nullok.", " * debian/pam-configs/unix: use nullok, not nullok_secure.", " * Drop pam_tally and pam_tally2 modules, which have been deprecated", " upstream in favor of pam_faillock. Closes: #569746, LP: #772121.", " * Add hardening+=bindnow to build options, per lintian.", "" ], "package": "pam", "version": "1.4.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 1860826, 772121 ], "author": "Steve Langasek ", "date": "Mon, 28 Dec 2020 06:05:13 +0000" }, { "cves": [], "log": [ "", " * extrausers.patch: update for compatibility with the removal of", " nullok_secure.", "" ], "package": "pam", "version": "1.3.1-5ubuntu11", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 15 Sep 2021 22:39:58 -0700" }, { "cves": [], "log": [ "", " * Fix up the nullok_secure-compat.patch to apply properly on 1.3.1.", "" ], "package": "pam", "version": "1.3.1-5ubuntu10", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 15 Sep 2021 18:28:12 -0700" }, { "cves": [], "log": [ "", " * Correctly document current VCS in debian/control.", " * Drop patches to implement \"nullok_secure\" option for pam_unix.", " Closes: #674857, #936071, LP: #1860826.", " * debian/patches-applied/nullok_secure-compat.patch: Support", " nullok_secure as a deprecated alias for nullok.", " * debian/pam-configs/unix: use nullok, not nullok_secure.", "" ], "package": "pam", "version": "1.3.1-5ubuntu9", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1860826 ], "author": "Steve Langasek ", "date": "Wed, 15 Sep 2021 18:18:19 -0700" }, { "cves": [], "log": [ "", " * Disable custom daemon restart detection code if needrestart is available", " (LP: #1935972)", "" ], "package": "pam", "version": "1.3.1-5ubuntu8", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1935972 ], "author": "Simon Chopin ", "date": "Tue, 13 Jul 2021 10:28:04 +0200" }, { "cves": [], "log": [ "", " * Backport pam_faillock module from pam 1.4.0 (LP: #1927796)", " - debian/patches-applied/add_pam_faillock.patch: add module.", " - debian/patches-applied/pam_faillock_create_directory: create dir", " before creating file in modules/pam_faillock/faillock.c.", " - debian/rules: set execute permissions on pam_faillock test.", " - debian/libpam-modules-bin.install: install faillock binary and man", " page.", "" ], "package": "pam", "version": "1.3.1-5ubuntu7", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1927796 ], "author": "Richard Maciel Costa ", "date": "Thu, 08 Apr 2021 07:06:27 -0400" }, { "cves": [], "log": [ "", " * Fix FTBFS with selinux/flask.h", " - debian/patches-applied/selinux_flask_ftbfs.patch: Fix FTBFS due to", " deprecated selinux/flask.h", "" ], "package": "pam", "version": "1.3.1-5ubuntu6", "urgency": "medium", "distributions": "groovy", "launchpad_bugs_fixed": [], "author": "Mike Salvatore ", "date": "Wed, 05 Aug 2020 21:10:51 -0400" }, { "cves": [], "log": [ "", " * debian/libpam-modules.postinst: Add /snap/bin to $PATH in", " /etc/environment. (LP: #1659719)", "" ], "package": "pam", "version": "1.3.1-5ubuntu5", "urgency": "medium", "distributions": "groovy", "launchpad_bugs_fixed": [ 1659719 ], "author": "Michael Hudson-Doyle ", "date": "Fri, 10 Jul 2020 08:35:49 +1200" }, { "cves": [], "log": [ "", " * Return only PAM_IGNORE or error from pam_motd (LP: #1856703)", "" ], "package": "pam", "version": "1.3.1-5ubuntu4", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [ 1856703 ], "author": "Balint Reczey ", "date": "Tue, 17 Dec 2019 17:41:40 +0100" }, { "cves": [], "log": [ "", " * Fix patches to fix FTBFS", "" ], "package": "pam", "version": "1.3.1-5ubuntu3", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [], "author": "Balint Reczey ", "date": "Thu, 05 Dec 2019 13:18:35 +0100" }, { "cves": [], "log": [ "", " * pam_motd: Export MOTD_SHOWN=pam after showing MOTD (LP: #1855092)", "" ], "package": "pam", "version": "1.3.1-5ubuntu2", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [ 1855092 ], "author": "Balint Reczey ", "date": "Wed, 04 Dec 2019 12:23:57 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", "" ], "package": "pam", "version": "1.3.1-5ubuntu1", "urgency": "medium", "distributions": "disco", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 23:16:59 -0800" }, { "cves": [], "log": [ "", " * xdm restart check was inverted in the prior upload; turn it the right", " way around", " * Correctly display the notification when a manual DM restart is needed.", "" ], "package": "pam", "version": "1.3.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 14 Feb 2019 07:08:47 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " * Dropped changes, included in Debian:", " - Fix the name of the samba service being restarted", " - Fix debian/patches-applied/update-motd to apply the correct changes", " to the README", "" ], "package": "pam", "version": "1.3.1-4ubuntu1", "urgency": "medium", "distributions": "disco", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 15:43:33 -0800" }, { "cves": [], "log": [ "", " * Fix the name of the samba services to be restarted on upgrade.", "" ], "package": "pam", "version": "1.3.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 23:39:03 +0000" }, { "cves": [], "log": [ "", " * Fix debian/patches-applied/update-motd to apply the correct changes", " to the README (should be forwarded to Debian)", " * debian/libpam-modules.lintian-overrides: update for the current lintian", " warning given for DSOs with no dependencies.", " * debian/rules: set $DEB_HOST_MULTIARCH only if unset.", " * debian/source.lintian-overrides: update for the current quilt warnings.", " * debian/control: drop redundant priority fields.", " * Standards-Version 4.3.0.", " * Restore lintian overrides for hardening false-positives.", " * debian/libpam0g.postinst: update the xdm restart handling to cope with", " changes to what xdm writes to utmp. Closes: #922239.", "" ], "package": "pam", "version": "1.3.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 20:41:46 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " * Dropped changes, included in Debian:", " - pam-configs/mkhomedir: Added a config for pam_mkhomedir, disabled", " by default.", " * Dropped changes, obsoleted:", " - debian/patches-applied/cve-2015-3238.patch: removed manpage changes", " so they don't get regenerated during build and cause a multiarch", " installation issue.", " * Fix the name of the samba service being restarted, which was now", " differently wrong in each of Debian and Ubuntu.", " * Update extrausers.patch for changes in the upstream build system.", " * Fix debian/patches-applied/update-motd to apply the correct changes", " to the README (should be forwarded to Debian)", " * debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include changes to the README.", " * Add lintian override for pam_extrausers_chkpwd", "" ], "package": "pam", "version": "1.3.1-2ubuntu1", "urgency": "medium", "distributions": "disco", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 06:07:03 +0000" }, { "cves": [], "log": [ "", " * Bump the version check for service restarts to 1.3.1-2.", " Closes: #922178.", " * Drop hard-coded pre-dep on libpam0g, now superseded by shlibdeps.", "" ], "package": "pam", "version": "1.3.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2019 23:52:04 +0000" }, { "cves": [], "log": [ "", " * New upstream release. Closes: #821408.", " - Don't try to close an excessive number of fds when we have a high", " ulimit. Closes: #890524.", " - Clarify pam_access docs regarding handling of daemons and X sessions.", " Closes: #762110.", " - Fix handling of rhost and tty fields in pam_succeed_if.", " Closes: #889910.", " - Fix wrong documentation of pam_umask module behavior.", " Closes: #825782.", " * Refresh patches.", " * Drop patches included or obsoleted upstream:", " - debian/patches-applied/README-rebuild", " - debian/patches-applied/pam-loginuid-in-containers", " - debian/patches-applied/cve-2013-7041.patch", " - debian/patches-applied/cve-2014-2583.patch", " - debian/patches-applied/cve-2015-3238.patch", " - debian/patches-applied/pam_namespace_fix_bashism.patch", " * Drop unused lintian overrides.", " * Fix lintian warnings; thanks to Andreas Henriksson ", " and Florian Vessaz ", " * Switch source package to 3.0 (quilt) to consume upstream .tar.xz.", " * Update debian/watch.", "", " [ Andreas Henriksson ]", " * Update debian/libpam0g.symbols", " * debian/patches-applied/fix-autoreconf.patch: Do not override user", " variables in Makefile.am", "" ], "package": "pam", "version": "1.3.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2019 07:38:11 +0000" }, { "cves": [], "log": [ "", " * Acknowledge various NMUs; thanks to the various folks who have helped", " keep this package in good condition.", " * debian/control: update VCS headers to point to git (temporarily under", " my personal salsa namespace, until I get around to restoring team", " setup).", " * Actually remove Roger Leigh from uploaders (change not included in", " previous upload). Thanks Roger for your contributions to Debian!", " * Use DEB_BUILD_PROFILES instead of the obsolete DEB_BUILD_PROFILE.", " Closes: #907492.", " * Don't include changes to autogenerated files in patches.", " * Use LC_ALL=C.UTF-8, not LC_ALL=C, when generating documentation.", " * Consistently include documentation changes in patches, for clean source", " package.", " * debian/patches-applied/README-rebuild: rebuild README files with", " current docs toolchain.", "" ], "package": "pam", "version": "1.1.8-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 09 Jan 2019 00:29:55 +0000" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Set Rules-Requires-Root to binary-targets as pam relies on", " chgrp in debian/rules.", " * Update pam-auth-update to detect write errors and properly", " fail when that happens. (Closes: #880501)", " * Remove Roger Leigh from uploaders as he has restired from", " Debian. (Closes: #869348)", " * Reduce priority of libpam0g to optional.", " * Rebuild with a recent version of dpkg-source, which ensures", " that the Build-Depends are correct in the .dsc file.", " (Closes: #890602)", " * Apply patch from Felix Lechner to make pam-auth-update ignore", " editor backup files. (Closes: #519361)", " * Apply update to Brazilian Portuguese translations of the", " debconf templates. Thanks to Adriano Rafael Gomes.", " (Closes: #799417)", "" ], "package": "pam", "version": "1.1.8-3.8", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Niels Thykier ", "date": "Sat, 11 Aug 2018 15:31:24 +0000" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * libpam-modules: Added a config for pam_mkhomedir, disabled by default.", " (Closes: #568577)", " * pam-auth-update: Add support for --enable option which is useful for", " enabling non-default configs without prompting the admin. (LP: #1192719)", "" ], "package": "pam", "version": "1.1.8-3.7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 1192719 ], "author": "Timo Aaltonen ", "date": "Fri, 02 Feb 2018 16:57:43 +0200" }, { "cves": [], "log": [ "", " * pam-auth-update: Add support for --enable option which is useful for", " enabling non-default configs without asking the admin. (LP:", " #1192719)", "" ], "package": "pam", "version": "1.1.8-3.6ubuntu2", "urgency": "medium", "distributions": "bionic", "launchpad_bugs_fixed": [ 1192719 ], "author": "Timo Aaltonen ", "date": "Thu, 05 Apr 2018 15:27:42 +0300" }, { "cves": [], "log": [ "", " * Merge with Debian unstable.", " - Fixes unescaped brace in pam_getenv regex. LP: #1538284.", " - Fixes pam_namespace defaults for compatibility with dash. LP: #1081323.", " * Remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - pam-configs/mkhomedir: Added a config for pam_mkhomedir, disabled", " by default.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/cve-2015-3238.patch: removed manpage changes", " so they don't get regenerated during build and cause a multiarch", " installation issue.", " * Dropped changes, included in Debian:", " - Build-depend on libfl-dev.", " - debian/patches-applied/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE.", " * Fix references to /var/run in update-motd.5. LP: #1571864", " * Fix service restart handling to integrate with systemd instead of", " upstart.", "" ], "package": "pam", "version": "1.1.8-3.6ubuntu1", "urgency": "medium", "distributions": "bionic", "launchpad_bugs_fixed": [ 1538284, 1081323, 1571864 ], "author": "Steve Langasek ", "date": "Thu, 26 Oct 2017 23:23:18 -0700" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * cve-2015-3238.patch: Add the changes in the generated pam_exec.8", " and pam_unix.8 in addition to (and after) the changes to the", " source .xml files. This avoids unwanted rebuilds that can cause", " problems due to differing files on different architectures of", " the Multi-Arch: same libpam-modules. (Closes: #851545)", "" ], "package": "pam", "version": "1.1.8-3.6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Adrian Bunk ", "date": "Sat, 27 May 2017 18:44:02 +0300" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Build-Depend on libfl-dev:native as well, for cross builds.", " Re-closes: #846459", " * Fix \"Unescaped left brace in regex\" with Perl 5.22. Closes: #810873", "" ], "package": "pam", "version": "1.1.8-3.5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Adam Borowski ", "date": "Fri, 30 Dec 2016 14:37:29 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Add libfl-dev to Build-Depends, fixing FTBFS. Closes: #846459", " * Move xsl stuff to Build-Depends from -Indep to fix misbuilt manpages.", " Closes: #812566", "" ], "package": "pam", "version": "1.1.8-3.4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Adam Borowski ", "date": "Sun, 18 Dec 2016 01:03:58 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " [ Steve Langasek ]", " * Updated Swedish translation to correct a typo, thanks to Anders Jonsson", " and Martin Bagge. Closes: #743875", " * Updated Turkish translation, thanks to Mert Dirik .", " (closes: #756756)", " * d/applied-patches/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE. Thanks to Robie Basak", " for the patch. Closes: #783105.", " * Acknowledge security NMU.", " * pam-auth-update: don't mishandle trailing whitespace in profiles.", " LP: #1487103.", "", " [ Laurent Bigonville ]", " * debian/control: Fix Vcs-* and Homepage fields (Closes: #752343)", " * debian/watch: Update watch file and point it to http://www.linux-pam.org", " * debian/patches-applied/pam_namespace_fix_bashism.patch: Fix bashism in", " namespace.init script (Closes: #624842)", " * debian/control: Build-depends against debhelper (>= 9) to match the", " defined debhelper compatibility", " * Rename the cve-2011-4708.patch to cve-2010-4708.patch to match reality,", " thanks to Jakub Wilk for noticing (Closes: #761594)", " * debian/control: Bump Standards-Version to 3.9.8 (no further changes)", " * debian/libpam-doc.doc-base.applications-guide: Fix spelling", " * debian/libpam0g-dev.examples: Do not use shell brace expansion", " * debian/patches-applied/pam-loginuid-in-containers: Updated with the version", " from Ubuntu, this should fix logins in containers (Closes: #726661)", " * debian/patches-applied/update-motd: Updated with the version from Ubuntu:", " use /run/motd.dynamic instead of /var/run/motd, nothing in the archive", " uses the later (Closes: #743286)", " * debian/patches-applied/make_documentation_reproducible.patch: Make the", " build reproducible, removes differences when building with different", " locale values (Closes: #792127)", "" ], "package": "pam", "version": "1.1.8-3.3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 1487103 ], "author": "Laurent Bigonville ", "date": "Wed, 18 May 2016 02:04:29 +0200" }, { "cves": [], "log": [ "", " * No-change rebuild to pick up -fPIE compiler default in static", " libraries", "" ], "package": "pam", "version": "1.1.8-3.2ubuntu3", "urgency": "medium", "distributions": "artful", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 21 Apr 2017 20:53:23 +0000" }, { "cves": [], "log": [ "", " * debian/patches-applied/cve-2015-3238.patch: removed manpage changes", " so they don't get regenerated during build and cause a multiarch", " installation issue. (LP: #1558114)", "" ], "package": "pam", "version": "1.1.8-3.2ubuntu2", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [ 1558114 ], "author": "Marc Deslauriers ", "date": "Wed, 16 Mar 2016 13:34:02 -0400" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include patch to autogenerated manpage file", " - debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - debian/patches-applied/extrausers.patch: Ship pre-generated man page", " - debian/patches-applied/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE.", " - debian/control: have libpam-modules recommend update-motd package", "" ], "package": "pam", "version": "1.1.8-3.2ubuntu1", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 16 Mar 2016 09:50:51 -0400" }, { "cves": [ { "cve": "CVE-2015-3238", "url": "https://ubuntu.com/security/CVE-2015-3238", "cve_description": "The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.", "cve_priority": "low", "cve_public_date": "2015-08-24 14:59:00 UTC" } ], "log": [ "", " * Non-maintainer upload.", " * Fix CVE-2015-3238: DoS/user enumeration due to blocking pipe in pam_unix", " module (Closes: #789986)", "" ], "package": "pam", "version": "1.1.8-3.2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Tianon Gravi ", "date": "Wed, 06 Jan 2016 15:53:31 -0800" }, { "cves": [], "log": [ "", " * d/applied-patches/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE.", "" ], "package": "pam", "version": "1.1.8-3.1ubuntu3", "urgency": "medium", "distributions": "vivid", "launchpad_bugs_fixed": [], "author": "Robie Basak ", "date": "Wed, 22 Apr 2015 08:55:24 +0000" }, { "cves": [], "log": [ "", " * debian/control:", " - have libpam-modules recommend update-motd package", " + while libpam-modules provides pam_motd, which does dynamically", " generate the motd from /etc/update-motd.d on login, hundreds of", " users have asked in the past few years how they might \"force\"", " a MOTD update; this is provided by /usr/sbin/update-motd", " in the tiny update-motd package (already in main); recommend", " this package", "" ], "package": "pam", "version": "1.1.8-3.1ubuntu2", "urgency": "medium", "distributions": "vivid", "launchpad_bugs_fixed": [], "author": "Dustin Kirkland ", "date": "Tue, 11 Nov 2014 12:49:14 -0600" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include patch to autogenerated manpage file", " - debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - debian/patches-applied/extrausers.patch: Ship pre-generated man page", "" ], "package": "pam", "version": "1.1.8-3.1ubuntu1", "urgency": "low", "distributions": "vivid", "launchpad_bugs_fixed": [], "author": "Michael Vogt ", "date": "Mon, 27 Oct 2014 09:57:52 +0100" }, { "cves": [ { "cve": "CVE-2013-7041", "url": "https://ubuntu.com/security/CVE-2013-7041", "cve_description": "The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack.", "cve_priority": "low", "cve_public_date": "2014-05-08 14:29:00 UTC" }, { "cve": "CVE-2014-2583", "url": "https://ubuntu.com/security/CVE-2014-2583", "cve_description": "Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.", "cve_priority": "low", "cve_public_date": "2014-04-10 20:29:00 UTC" } ], "log": [ "", " * Non-maintainer upload by the Security Team.", " * Fix CVE-2013-7041: case-insensitive comparison used for verifying", " passwords in the pam_userdb module (closes: #731368).", " * Fix CVE-2014-2583: multiple directory traversal issues in the", " pam_timestamp module (closes: 757555)", "" ], "package": "pam", "version": "1.1.8-3.1", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Gilbert ", "date": "Sat, 09 Aug 2014 09:50:42 +0000" }, { "cves": [], "log": [ "", " * No-change rebuild to get debug symbols on all architectures.", "" ], "package": "pam", "version": "1.1.8-3ubuntu4", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [], "author": "Brian Murray ", "date": "Tue, 21 Oct 2014 12:32:23 -0700" }, { "cves": [], "log": [ "", " * debian/patches-applied/extrausers.patch:", " - Ship pre-generated man page", "" ], "package": "pam", "version": "1.1.8-3ubuntu3", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [], "author": "Michael Terry ", "date": "Tue, 22 Jul 2014 14:13:31 -0400" }, { "cves": [], "log": [ "", " * debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " * debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " * debian/rules: Make pam_extrausers_chkpwd sguid shadow", "" ], "package": "pam", "version": "1.1.8-3ubuntu2", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [], "author": "Michael Terry ", "date": "Fri, 18 Jul 2014 14:52:08 -0400" }, { "cves": [], "log": [ "", " [ Stéphane Graber ]", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include patch to autogenerated manpage file", " - debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", "", " [ Timo Aaltonen ]", " * pam-configs/mkhomedir: Added a config for pam_mkhomedir, disabled", " by default. (LP: #557013)", "" ], "package": "pam", "version": "1.1.8-3ubuntu1", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [ 557013 ], "author": "Stéphane Graber ", "date": "Fri, 02 May 2014 14:59:10 -0400" }, { "cves": [], "log": [ "", " * debian/rules: On hurd, link libpam explicitly with -lpthread since glibc", " will not dynamically switch between the libc stubs and the libpthread", " implementations on this architecture. Thanks to Samuel Thibault for the", " patch. Closes: #743891.", "" ], "package": "pam", "version": "1.1.8-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Apr 2014 17:49:38 -0700" }, { "cves": [], "log": [ "", " * Mark the libaudit-dev build-dependency linux-any, since it's not", " available on non-Linux archs. Closes: #737035.", "" ], "package": "pam", "version": "1.1.8-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 13 Feb 2014 15:02:00 -0800" }, { "cves": [], "log": [ "", " * debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", "" ], "package": "pam", "version": "1.1.8-1ubuntu2", "urgency": "medium", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Stéphane Graber ", "date": "Fri, 31 Jan 2014 22:11:02 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " * debian/patches-applied/pam_umask_usergroups_from_login.defs.patch: include", " patch to autogenerated manpage file", "" ], "package": "pam", "version": "1.1.8-1ubuntu1", "urgency": "medium", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 16 Jan 2014 02:40:41 +0000" }, { "cves": [], "log": [ "", " * New upstream release.", " - includes upstream changes to pam_exec. Closes: #670147.", " - adds support for newer hashing algorithms to pam_userdb.", " Closes: #671740.", " - fixes handling of 'quiet' argument to pam_listfile, to match the", " documentation. Closes: #592219.", " - fixes handling of @users@@hosts netgroup syntax in access.conf.", " Closes: #681223.", " - fixes installation of the /etc/security/namespace.d directory.", " Closes: #710998.", " - 027_pam_limits_better_init_allow_explicit_root: support for reading", " /proc/1/limits is upstream, this patch now only handles the policy", " of resetting limits by default and not applying glob limits to root.", " - debian/patches/fix-manpage-crud: drop, manpages now being generated", " upstream with a newer, fixed xsltproc.", " - debian/patches/pam_env-fix-overflow.patch, pam_env-fix-dos.patch,", " glibc-2_16-compilation-fix.patch, sys-types-include.patch: drop,", " included upstream.", " * Add build-dependency on pkg-config.", " * Ensure autogenerated files are after source files in all relevant patches,", " so that regenerating documentation doesn't cause build skew.", " * Drop the --disable-regenerate-docu argument, restoring the HTML manuals", " to the libpam-doc package. Closes: #700485.", " * No need to override dh_compress in debian/rules, it already handles .html", " files correctly.", " * debian/libpam-cracklib.prerm: use $DPKG_MAINTSCRIPT_PACKAGE_COUNT to avoid", " prematurely removing the PAM config when the package is installed for", " multiple architectures. Closes: #647428.", "" ], "package": "pam", "version": "1.1.8-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 16 Jan 2014 00:38:42 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " * Dropped changes, merged in Debian:", " - Disable libaudit for stage1 bootstrap.", "" ], "package": "pam", "version": "1.1.3-11ubuntu1", "urgency": "medium", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 13 Jan 2014 21:41:05 -0800" }, { "cves": [], "log": [ "", " [ Wookey ]", " * Disable libaudit for stage1 bootstrap.", "", " [ Steve Langasek ]", " * debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Ignore failure in user namespaces.", " * Use [linux-any] in build-deps, instead of hard-coding a list of", " non-Linux archs. Closes: #634516.", "" ], "package": "pam", "version": "1.1.3-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 14 Jan 2014 03:33:31 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Disable libaudit for stage1 bootstrap.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", "" ], "package": "pam", "version": "1.1.3-10ubuntu1", "urgency": "low", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 20 Oct 2013 18:21:34 -0700" }, { "cves": [], "log": [ "", " * Fix pam-auth-update handling of trailing blank lines in the fields of", " profiles. LP: #1160288.", " * Reintroduce libaudit support now that libaudit has been multiarched.", " Closes: #699159.", "" ], "package": "pam", "version": "1.1.3-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 1160288 ], "author": "Steve Langasek ", "date": "Sun, 20 Oct 2013 15:30:46 -0700" }, { "cves": [], "log": [ "", " * Revert libaudit support for now, because libaudit isn't multiarched yet", " in unstable so this regresses cross-installability. Reopens bug", " #699159.", " * Add an or'ed dependency on cdebconf, which also implements the", " xloadtemplatefile extension that prevents us from depending on just", " 'debconf-2.0'. Thanks to Régis Boudin for the info.", " Closes: #677278.", "" ], "package": "pam", "version": "1.1.3-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2013 23:06:30 +0000" }, { "cves": [], "log": [ "", " * Adjust debian/patches-applied/update-motd to write to /run/motd.dynamic,", " as sysvinit/ssh/login in Debian have been changed to use this file and", " no longer links /etc/motd to /var/run/motd.", "" ], "package": "pam", "version": "1.1.3-8ubuntu3", "urgency": "low", "distributions": "saucy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 18 May 2013 00:07:43 -0500" }, { "cves": [], "log": [ "", " * Disable libaudit for stage1 bootstrap (LP: #1126404)", "" ], "package": "pam", "version": "1.1.3-8ubuntu2", "urgency": "low", "distributions": "raring", "launchpad_bugs_fixed": [ 1126404 ], "author": "Wookey ", "date": "Fri, 15 Feb 2013 12:45:27 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH. LP: #110287.", "" ], "package": "pam", "version": "1.1.3-8ubuntu1", "urgency": "low", "distributions": "raring", "launchpad_bugs_fixed": [ 110287 ], "author": "Steve Langasek ", "date": "Mon, 11 Feb 2013 22:08:44 -0800" }, { "cves": [], "log": [ "", " * Confirm NMU for bug #611136; thanks to Michael Gilbert.", " - As a side effect, there will no longer be errors from reading the", " .pam_environment twice since we are now reading it 0 times.", " LP: #955032.", " * Adjust the pam_env documentation to match the module behavior resulting", " from the previous security upload. Closes: #693995.", " * debian/rules: never regenerate manpages at build time; this may cause", " build skew that breaks the world in a multiarch context. LP: #1095887.", " * debian/patches-applied/glibc-2_16-compilation-fix.patch: fix missing", " include causing build failure with eglibc 2.16. Thanks to Daniel", " Schepler . Closes: #693450.", " * Ditch autoconf patch in favor of a build-dependency on dh-autoreconf,", " which will let us keep up-to-date with newer autotools. In the present", " instance, this gets us aarch64 support.", " * Install pam_timestamp_check - and while we're at it, move the manpage", " to the correct binary package. Closes: #648695.", " * Update lintian overrides to suppress some noise about hardening and", " manpages.", " * Enable audit support, by popular demand. This should have no major", " impact unless you're also running auditd; but I reserve the right to", " disable this again in the event that this causes a performance hit or", " breaks upgrades (since the dependency is pulled into libpam, not just", " into pam_tty_audit). Closes: #699159, LP: #937005.", "" ], "package": "pam", "version": "1.1.3-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 955032, 1095887, 937005 ], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2013 05:36:29 +0000" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Fix cve-2010-4708: user-configurable .pam_environment allows", " administrator-level changes without root access (closes: #611136).", "" ], "package": "pam", "version": "1.1.3-7.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Gilbert ", "date": "Sun, 29 Apr 2012 02:23:26 -0400" }, { "cves": [], "log": [ "", " [ Nathan Williams ]", " * Add /usr/local/games to PATH. LP: #110287.", "" ], "package": "pam", "version": "1.1.3-7ubuntu3", "urgency": "low", "distributions": "quantal", "launchpad_bugs_fixed": [ 110287 ], "author": "Steve Langasek ", "date": "Tue, 03 Jul 2012 06:55:25 +0000" }, { "cves": [], "log": [ "", " * No-change rebuild with gzip 1.4-1ubuntu2 to get multiarch-clean", " compression of manpages. LP: #871083.", "" ], "package": "pam", "version": "1.1.3-7ubuntu2", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [ 871083 ], "author": "Steve Langasek ", "date": "Wed, 08 Feb 2012 17:15:39 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", "" ], "package": "pam", "version": "1.1.3-7ubuntu1", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 28 Jan 2012 11:36:07 -0800" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Danish, thanks to Joe Dalton (closes: #648382)", " - French, thanks to Jean-Baka Domelevo Entfellner ", " (closes: #649850)", " - Dutch, thanks to Jeroen Schot ", " (closes: #650755)", " - Russian, thanks to Yuri Kozlov (closes: #650867)", " - Portuguese, thanks to Pedro Ribeiro ", " (closes: #652493)", " - German, thanks to Sven Joachim (closes: #653407)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #654043)", " - Bulgarian, thanks to Damyan Ivanov (closes: #656518)", " - Slovak, thanks to Ivan Masár (closes: #656521)", " - Japanese, thanks to Kenshi Muto (closes: #656834)", " - Polish, thanks to Michał Kułach ", " (closes: #657476)", " - Catalan, thanks to Innocent De Marchi ", " (closes: #657489)", " - Czech, thanks to Miroslav Kure ", " (closes: #657578)", " - Swedish, thanks to Martin Bagge (closes: #651349)", "" ], "package": "pam", "version": "1.1.3-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 28 Jan 2012 10:57:49 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " * Dropped changes, included in Debian:", " - debian/patches-applied/update-motd: set a sane umask before calling", " run-parts, and restore the old mask afterwards, so /run/motd gets", " consistent permissions.", " - debian/patches-applied/update-motd: new module option for pam_motd,", " 'noupdate', which suppresses the call to run-parts /etc/update-motd.d.", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " * Build-depend on libfl-dev in addition to flex, for cross-building", " support.", "" ], "package": "pam", "version": "1.1.3-6ubuntu1", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Nov 2011 21:15:00 -0800" }, { "cves": [], "log": [ "", " * debian/patches-applied/hurd_no_setfsuid: we don't want to check all", " setre*id() calls; we know that there are situations where some of these", " may fail but we don't care. As long as the last setre*id() call in each", " set succeeds, that's the state we mean to be in.", " * debian/libpam0g.postinst: according to Kubuntu developers, kdm no longer", " keeps libpam loaded persistently at runtime, so it's not necessary to", " force a kdm restart on ABI bump. Which is good, since restarting kdm", " now seems to also log users out of running sessions, which we rather", " want to avoid. Closes: #632673, LP: #744944.", " * debian/patches-applied/update-motd: set a sane umask before calling", " run-parts, and restore the old mask afterwards, so /run/motd gets", " consistent permissions. LP: #871943.", " * debian/patches-applied/update-motd: new module option for pam_motd,", " 'noupdate', which suppresses the call to run-parts /etc/update-motd.d.", " LP: #805423.", " * debian/libpam0g.templates, debian/libpam0g.postinst: add a new question,", " libraries/restart-without-asking, that allows admins to accept the", " service restarts once for all so that they don't have to repeatedly", " say \"ok\". LP: #745004.", " * debian/libpam-runtime.templates, debian/local/pam-auth-update: add a", " new 'title' template, so pam-auth-update doesn't give a blank title", " when called outside of a maintainer script. LP: #882794.", "" ], "package": "pam", "version": "1.1.3-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 744944, 871943, 805423, 745004, 882794 ], "author": "Steve Langasek ", "date": "Sun, 06 Nov 2011 19:43:14 -0800" }, { "cves": [], "log": [ "", " * Rebuild with dpkg 1.16.1.1ubuntu2 to restore large file support.", "" ], "package": "pam", "version": "1.1.3-5ubuntu2", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 01 Nov 2011 16:59:55 -0400" }, { "cves": [ { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" } ], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - add debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " (Closes: #583958)", " * Dropped changes, included in Debian:", " - debian/patches-applied/CVE-2011-3148.patch", " - debian/patches-applied/CVE-2011-3149.patch", " - debian/patches-applied/update-motd: updated to use clean environment", " and absolute paths in modules/pam_motd/pam_motd.c.", " * debian/libpam0g.postinst: the init script for 'samba' is now named 'smbd'", " in Ubuntu, so fix the restart handling.", " * debian/patches-applied/update-motd: set a sane umask before calling", " run-parts, and restore the old mask afterwards, so /run/motd gets", " consistent permissions. LP: #871943.", " * debian/patches-applied/update-motd: new module option for pam_motd,", " 'noupdate', which suppresses the call to run-parts /etc/update-motd.d.", " LP: #805423.", "" ], "package": "pam", "version": "1.1.3-5ubuntu1", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [ 871943, 805423 ], "author": "Steve Langasek ", "date": "Sun, 30 Oct 2011 09:45:00 -0600" }, { "cves": [ { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" } ], "log": [ "", " [ Kees Cook ]", " * debian/patches-applied/pam_unix_dont_trust_chkpwd_caller.patch: use", " setresgid() to wipe out saved-gid just in case.", " * debian/patches-applied/008_modules_pam_limits_chroot:", " - fix off-by-one when parsing configuration file.", " - when using chroot, chdir() to root to lose links to old tree.", " * debian/patches-applied/022_pam_unix_group_time_miscfixes,", " debian/patches-applied/026_pam_unix_passwd_unknown_user,", " debian/patches-applied/054_pam_security_abstract_securetty_handling:", " improve descriptions.", " * debian/patches-applied/{007_modules_pam_unix,055_pam_unix_nullok_secure}:", " drop unneeded no-op change to reduce delta from upstream.", " * debian/patches-applied/hurd_no_setfsuid: check all set*id() calls.", " * debian/patches-applied/update-motd: correctly clear environment when", " building motd.", " * debian/patches-applied/pam_env-fix-overflow.patch: fix stack overflow", " in environment file parsing (CVE-2011-3148).", " * debian/patches-applied/pam_env-fix-dos.patch: fix DoS in environment", " file parsing (CVE-2011-3149).", "" ], "package": "pam", "version": "1.1.3-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 27 Oct 2011 21:33:57 -0700" }, { "cves": [], "log": [ "", " * Make sure shared library links are also installed to the multiarch", " directory, not just the .a files; otherwise the static libs get found", " first by the linker. Thanks to Russ Allbery for catching this.", " Closes: #642952.", "" ], "package": "pam", "version": "1.1.3-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 25 Sep 2011 22:33:55 +0000" }, { "cves": [], "log": [ "", " * Look for /etc/init.d/postgresql, not /etc/init.d/postgresql-8.{2,3},", " for service restarts; the latter are obsolete since squeeze.", " Closes: #631511.", " * Move debian/libpam0g-dev.install to debian/libpam0g-dev.install.in", " and substitute the multiarch path at build time, so our .a files go to", " the multiarch dir instead of to /usr/lib. Thanks to Riku Voipio for", " pointing out the bug.", " * debian/control: adjust the package descriptions, as the current ones", " use some awkward language that's gone unnoticed for a long time. Thanks", " to Martin Eberhard Schauer for pointing this", " out. Closes: #633863.", " * Build-depend on debhelper 8.9.4 and bump debian/compat to 9 for", " dpkg-buildflags integration, and drop manual setting of -g -O options in", " CFLAGS now that we can let dh do it for us", " * Don't set --sbindir when calling configure; upstream takes care of this", " for us", "" ], "package": "pam", "version": "1.1.3-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 24 Sep 2011 20:08:56 +0000" }, { "cves": [ { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: possible code execution via incorrect environment file", " parsing (LP: #874469)", " - debian/patches-applied/CVE-2011-3148.patch: correctly count leading", " whitespace when parsing environment file in modules/pam_env/pam_env.c.", " - CVE-2011-3148", " * SECURITY UPDATE: denial of service via overflowed environment variable", " expansion (LP: #874565)", " - debian/patches-applied/CVE-2011-3149.patch: when overflowing, exit", " with PAM_BUF_ERR in modules/pam_env/pam_env.c.", " - CVE-2011-3149", " * SECURITY UPDATE: code execution via incorrect environment cleaning", " - debian/patches-applied/update-motd: updated to use clean environment", " and absolute paths in modules/pam_motd/pam_motd.c.", " - CVE-2011-XXXX", "" ], "package": "pam", "version": "1.1.3-2ubuntu2.1", "urgency": "low", "distributions": "oneiric-security", "launchpad_bugs_fixed": [ 874469, 874565 ], "author": "Marc Deslauriers ", "date": "Tue, 18 Oct 2011 09:33:47 -0400" }, { "cves": [], "log": [ "", " * Merge with Debian to get bug fix for unknown kernel rlimits. Remaining", " changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - add debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " (Closes: #583958)", " * Dropped changes:", " - debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " no need to bump the hard limit for number of file descriptors any more", " since we read kernel limits directly now.", "" ], "package": "pam", "version": "1.1.3-2ubuntu1", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Kees Cook ", "date": "Thu, 18 Aug 2011 16:41:18 -0500" }, { "cves": [], "log": [ "", " [ Kees Cook ]", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " - only report about unknown kernel rlimits when \"debug\" is set", " (Closes: 625226, LP: #794531).", "", " [ Steve Langasek ]", " * Build for multiarch. Closes: #463420.", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " don't reset the process niceness for root; since it's root, they can", " still renice to a lower nice level if they need to and changing the", " nice level by default is unexpected behavior. Closes: #594377.", "" ], "package": "pam", "version": "1.1.3-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 794531 ], "author": "Steve Langasek ", "date": "Tue, 21 Jun 2011 11:41:12 -0700" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * debian/patches/pam_motd-legal-notice: use pam_modutil_gain/drop_priv", " common helper functions, instead of hand-rolled uid-setting code.", "", " [ Martin Pitt ]", " * debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " (LP: #253096, UbuntuSpec:umask-to-0002)", " * debian/local/pam-auth-update: Add the new md5sum of above files.", " * Add debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it from", " /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined there.", " This restores compatibility with the pre-PAM behaviour of login.", " (Closes: #583958)", "" ], "package": "pam", "version": "1.1.3-1ubuntu3", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [ 253096 ], "author": "Martin Pitt ", "date": "Fri, 24 Jun 2011 11:07:57 +0200" }, { "cves": [], "log": [ "", " * debian/patches-applied/update-motd-manpage-ref: refresh patch to apply", " cleanly against new upstream.", "" ], "package": "pam", "version": "1.1.3-1ubuntu2", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 04 Jun 2011 14:20:17 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " bump the hard limit for number of file descriptors, to keep pace with", " the changes in the kernel.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - New patch, lib_security_multiarch_compat, which lets us reuse the", " upstream --enable-isadir functionality to support a true path for", " module lookups; this way we don't have to force a hard transition to", " multiarch, but can support resolving modules in both the multiarch and", " non-multiarch directories.", " - build for multiarch, splitting our executables out of libpam-modules", " into a new package, libpam-modules-bin, so that modules can be", " co-installable between architectures.", " * Dropped changes:", " - bumping the service restart version in libpam0g.postinst to ensure", " servers don't fail to find the pam modules in the new paths; the min", " version requirement upstream is higher than this now.", "" ], "package": "pam", "version": "1.1.3-1ubuntu1", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 04 Jun 2011 14:04:19 -0700" }, { "cves": [ { "cve": "CVE-2010-3853", "url": "https://ubuntu.com/security/CVE-2010-3853", "cve_description": "pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3316", "url": "https://ubuntu.com/security/CVE-2010-3316", "cve_description": "The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pam_xauth PAM check.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3430", "url": "https://ubuntu.com/security/CVE-2010-3430", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3431", "url": "https://ubuntu.com/security/CVE-2010-3431", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3435", "url": "https://ubuntu.com/security/CVE-2010-3435", "cve_description": "The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" } ], "log": [ "", " * New upstream release.", " - Fixes CVE-2010-3853, executing namespace.init with an insecure", " environment set by the caller. Closes: #608273.", " - Fixes CVE-2010-3316 CVE-2010-3430 CVE-2010-3431 CVE-2010-3435.", " Closes: #599832.", " * Port hurd_no_setfsuid patch to new pam_modutil_{drop,restore}_priv", " interface; now possibly upstreamable", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " set a better default RLIMIT_MEMLOCK value for BSD kernels. Thanks to", " Petr Salinger for the fix. Closes: #602902.", " * bump the minimum version check in maintainer scripts for the restart", " handling.", "" ], "package": "pam", "version": "1.1.3-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 04 Jun 2011 03:10:50 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " bump the hard limit for number of file descriptors, to keep pace with", " the changes in the kernel.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - New patch, lib_security_multiarch_compat, which lets us reuse the", " upstream --enable-isadir functionality to support a true path for", " module lookups; this way we don't have to force a hard transition to", " multiarch, but can support resolving modules in both the multiarch and", " non-multiarch directories.", " - build for multiarch, splitting our executables out of libpam-modules", " into a new package, libpam-modules-bin, so that modules can be", " co-installable between architectures.", " - bumping the service restart version in libpam0g.postinst to ensure", " servers don't fail to find the pam modules in the new paths.", " * bump debhelper build-dep for final multiarch support.", "" ], "package": "pam", "version": "1.1.2-3ubuntu1", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 20 May 2011 12:53:24 -0700" }, { "cves": [], "log": [ "", " [ Kees Cook ]", " * 027_pam_limits_better_init_allow_explicit_root: load rlimit defaults", " from the kernel (via /proc/1/limits), instead of continuing to hardcode", " the settings internally. Fall back to internal defaults when the kernel", " rlimits are not found. Closes: #620302. (LP: #746655, #391761)", "", " * Updated debconf translations:", " - Vietnamese, thanks to Clytie Siddall ", " (closes: #601197)", " - Dutch, thanks to Eric Spreen (closes: #605592)", " - Danish, thanks to Joe Dalton (closes: #606739)", " - Catalan, thanks to Innocent De Marchi ", " (closes: #622786)", "" ], "package": "pam", "version": "1.1.2-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 746655, 391761 ], "author": "Steve Langasek ", "date": "Sun, 01 May 2011 01:49:11 -0700" }, { "cves": [], "log": [ "", " * Check if gdm is actually running before trying to reload it. (LP: #745532)", "" ], "package": "pam", "version": "1.1.2-2ubuntu8", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 745532 ], "author": "Stéphane Graber ", "date": "Mon, 11 Apr 2011 21:57:36 -0400" }, { "cves": [], "log": [ "", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " bump the hard limit for number of file descriptors, to keep pace with", " the changes in the kernel. Fortunately this shadowing should all go", " away next cycle when we can start to grab defaults directly from /proc.", " LP: #663090", "" ], "package": "pam", "version": "1.1.2-2ubuntu7", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 663090 ], "author": "Steve Langasek ", "date": "Tue, 05 Apr 2011 13:02:02 -0700" }, { "cves": [], "log": [ "", " * debian/libpam0g.postinst: according to Kubuntu developers, kdm no longer", " keeps libpam loaded persistently at runtime, so it's not necessary to", " force a kdm restart on ABI bump. Which is good, since restarting kdm", " now seems to also log users out of running sessions, which we rather", " want to avoid. LP: #744944.", "" ], "package": "pam", "version": "1.1.2-2ubuntu6", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 744944 ], "author": "Steve Langasek ", "date": "Tue, 29 Mar 2011 13:16:26 -0700" }, { "cves": [], "log": [ "", " * Force a service restart on upgrade to the new libpam0g, to ensure", " servers don't fail to find the pam modules in the new paths.", " * libpam-modules should also Pre-Depend: on the multiarch-aware libpam0g,", " for the same reason.", "" ], "package": "pam", "version": "1.1.2-2ubuntu5", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 22 Mar 2011 02:19:51 -0700" }, { "cves": [], "log": [ "", " * Build for multiarch; FFe LP: #733501.", " * Split our executables out of libpam-modules into a new package,", " libpam-modules-bin, so that modules can be co-installable between", " architectures.", " * New patch, lib_security_multiarch_compat, which lets us reuse the", " upstream --enable-isadir functionality to support a true path for module", " lookups; this way we don't have to force a hard transition to multiarch,", " but can support resolving modules in both the multiarch and", " non-multiarch directories.", " * Build-Depend on the multiarchified debhelper.", " * Add Pre-Depends: ${misc:Pre-Depends} for multiarch-support.", "" ], "package": "pam", "version": "1.1.2-2ubuntu4", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 733501 ], "author": "Steve Langasek ", "date": "Fri, 18 Mar 2011 00:12:26 -0700" }, { "cves": [], "log": [ "", " * Er, but let's get this patch applying cleanly.", "" ], "package": "pam", "version": "1.1.2-2ubuntu3", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 21 Feb 2011 16:10:11 -0800" }, { "cves": [], "log": [ "", " * debian/patches/update-motd-manpage-ref: patch the manpage too, not just", " the xml source.", "" ], "package": "pam", "version": "1.1.2-2ubuntu2", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 21 Feb 2011 15:47:27 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", "" ], "package": "pam", "version": "1.1.2-2ubuntu1", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 17 Feb 2011 16:15:47 -0800" }, { "cves": [], "log": [ "", " * debian/patches-applied/hurd_no_setfsuid: handle some new calls to", " setfsuid in pam_xauth that I overlooked, so that the build works again", " on non-Linux. Closes: #613630.", "" ], "package": "pam", "version": "1.1.2-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 16 Feb 2011 09:27:11 -0800" }, { "cves": [], "log": [ "", " * New upstream release.", " - Add support for NSS groups to pam_group. Closes: #589019,", " LP: #297408.", " - Support cross-building the package. Thanks to Neil Williams", " for the patch. Closes: #284854.", " * debian/rules: pass getconf LFS_CFLAGS so that we get a 64-bit rlimit", " interface. Closes: #579402.", " * Drop patches conditional_module,_conditional_man and", " mkhomedir_linking.patch, which are included upstream.", " * debian/patches/hurd_no_setfsuid: pam_env and pam_mail now also use", " setfsuid, so patch them to be likewise Hurd-safe.", " * Update debian/source.lintian-overrides to clean up some spurious", " warnings.", " * debian/libpam-modules.postinst: if any 'min=n' options are found in", " /etc/pam.d/common-password, convert them on upgrade to 'minlen=n' for", " compatibility with upstream.", " * debian/NEWS: document the disappearance of 'min=n', in case users have", " encoded this option elsewhere outside of /etc/pam.d/common-password.", " * debian/patches/007_modules_pam_unix: drop compatibility handling of", " 'max=' no-op; use of this option will now log an error, as warned three", " years ago.", " * Bump Standards-Version to 3.9.1.", " * Add lintian overrides for a few more spurious warnings.", " * debian/patches-applied/no_PATH_MAX_on_hurd: define PATH_MAX for", " compatibility when it's not already set. Closes: #552043.", " * debian/local/pam-auth-update: Don't try to pass embedded newlines to", " debconf; backslash-escape them instead and use CAPB escape.", " * debian/local/pam-auth-update: sort additional module options before", " writing them out, so that we don't wind up with a different config file", " on every invocation. Thanks to Jim Paris for the patch.", " Closes: #594123.", " * debian/libpam-runtime.{postinst,templates}: since 1.1.2-1 is targeted", " for post-squeeze, we don't need to support upgrades from 1.0.1-6 to", " 1.0.1-10 anymore. Drop the debconf error note about having configured", " your system with a lack of authentication, so that translators don't", " spend any more time on it.", " * Updated debconf translations:", " - Swedish, thanks to Martin Bagge (closes: #575875)", "" ], "package": "pam", "version": "1.1.2-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 297408 ], "author": "Steve Langasek ", "date": "Tue, 15 Feb 2011 23:21:41 -0800" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Italian, thanks to Nicole B. (closes: #602112)", "" ], "package": "pam", "version": "1.1.1-7", "urgency": "low", "distributions": "UNRELEASED", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 17 Nov 2010 16:53:46 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " * Dropped changes:", " - libpam-modules depend on base-files (>= 5.0.0ubuntu6): 5.0.0ubuntu20", " is in 10.04 LTS and this is an essential package, so no more need for", " the versioned dependency.", "" ], "package": "pam", "version": "1.1.1-6.1ubuntu1", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 15 Feb 2011 23:36:47 -0800" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Fix pending l10n issues. Debconf translations:", " - Czech (Miroslav Kure). Closes: #598329", " - Slovak (Ivan Masár). Closes: #600164", " - Japanese (Kenshi Muto). Closes: #600247", " - Finnish (Esko Arajärvi). Closes: #600641", "" ], "package": "pam", "version": "1.1.1-6.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Christian Perrier ", "date": "Tue, 19 Oct 2010 07:30:49 +0200" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Swedish, thanks to Martin Bagge (closes: #575875)", "" ], "package": "pam", "version": "1.1.1-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 05 Sep 2010 23:36:35 -0700" }, { "cves": [], "log": [ "", " * debian/rules: pass getconf LFS_CFLAGS so that we get a 64-bit rlimit", " interface. Closes: #579402.", " * Update debian/source.lintian-overrides to clean up some spurious", " warnings.", " * Bump Standards-Version to 3.9.1.", " * Add lintian overrides for a few more spurious warnings.", " * debian/patches-applied/no_PATH_MAX_on_hurd: define PATH_MAX for", " compatibility when it's not already set. Closes: #552043.", " * debian/local/pam-auth-update: Don't try to pass embedded newlines to", " debconf; backslash-escape them instead and use CAPB escape.", " * debian/local/pam-auth-update: sort additional module options before", " writing them out, so that we don't wind up with a different config file", " on every invocation. Thanks to Jim Paris for the patch.", " Closes: #594123.", "" ], "package": "pam", "version": "1.1.1-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 05 Sep 2010 12:42:34 -0700" }, { "cves": [ { "cve": "CVE-2010-0832", "url": "https://ubuntu.com/security/CVE-2010-0832", "cve_description": "pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to \"user file stamps\" and the motd.legal-notice file.", "cve_priority": "high", "cve_public_date": "2010-07-12 16:30:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: root privilege escalation via symlink following.", " - debian/patches-applied/pam_motd-legal-notice: drop privs for work.", " - CVE-2010-0832", "" ], "package": "pam", "version": "1.1.1-4ubuntu2", "urgency": "low", "distributions": "maverick-security", "launchpad_bugs_fixed": [], "author": "Kees Cook ", "date": "Mon, 25 Oct 2010 06:40:32 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", "" ], "package": "pam", "version": "1.1.1-4ubuntu1", "urgency": "low", "distributions": "maverick", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 16 Aug 2010 19:12:35 -0700" }, { "cves": [], "log": [ "", " * debian/patches/conditional_module,_conditional_man: if we don't have the", " libraries required for building pam_tty_audit, we shouldn't install the", " manpage either. LP: #588547.", " * Updated debconf translations:", " - Portuguese, thanks to Eder L. Marques ", " (closes: #581746)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #592172)", " - Galician, thanks to Jorge Barreiro ", " (closes: #592808)", " * Don't pass --version-script options when linking executables,", " only when linking libraries. Thanks to Julien Cristau", " for the fix. Closes: #582362.", "" ], "package": "pam", "version": "1.1.1-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 588547 ], "author": "Steve Langasek ", "date": "Sun, 15 Aug 2010 21:53:46 -0700" }, { "cves": [], "log": [ "", " * Trigger a rebuild, applying changes from 1.1.1-2ubuntu2 which", " were previously not committed to bzr", "" ], "package": "pam", "version": "1.1.1-3ubuntu2", "urgency": "low", "distributions": "maverick", "launchpad_bugs_fixed": [], "author": "Dustin Kirkland ", "date": "Thu, 13 May 2010 10:04:23 +0200" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " * Dropped changes:", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade - upgrades to maverick are", " only supported from lucid, so this delta can be dropped.", " - debian/patches-applied/ubuntu-no-error-if-missingok: 'missingok' option", " is obsoleted by 10.04 LTS and no longer needs to be supported for", " upgrades.", "" ], "package": "pam", "version": "1.1.1-3ubuntu1", "urgency": "low", "distributions": "maverick", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 13 May 2010 00:39:44 +0200" }, { "cves": [], "log": [ "", " * pam-auth-update: fix a bug in our handling of module options when the", " module name contains digits, caused by a buggy regexp. :/ Partially", " addresses LP #369575.", " * Install /sbin/pam_tally2 in the libpam-modules package; thanks to", " Olivier BONHOMME for reporting. Closes: #554010.", "" ], "package": "pam", "version": "1.1.1-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 25 Apr 2010 05:53:44 -0700" }, { "cves": [], "log": [ "", " * debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation,", " LP: #562566", " * debian/patches/update-motd-manpage-ref: add a reference in pam_mod(8)", " to update-motd(5), LP: #552175", "" ], "package": "pam", "version": "1.1.1-2ubuntu2", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [ 562566, 552175 ], "author": "Dustin Kirkland ", "date": "Tue, 13 Apr 2010 16:58:12 -0500" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.1.1-2ubuntu1", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Feb 2010 12:04:18 +0000" }, { "cves": [], "log": [ "", " * Document the new symbols added in 1.1.1 in debian/libpam0g.symbols, and", " raise the minimum version for the service restarting code.", " Closes: #568480.", "" ], "package": "pam", "version": "1.1.1-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 17 Feb 2010 23:21:23 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.1.1-1ubuntu1", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 01 Feb 2010 09:55:02 -0800" }, { "cves": [], "log": [ "", " * New upstream version.", " - restore proper netgroup handling in pam_access.", " Closes: #567385, LP: #513955.", " * Drop patches pam.d-manpage-section, namespace_with_awk_not_gawk, and", " pam_securetty_tty_check_before_user_check, which are included upstream.", " * debian/patches/026_pam_unix_passwd_unknown_user: don't return", " PAM_USER_UNKNOWN on password change of a user that has no shadow entry,", " upstream now implements auto-creating the shadow entry in this case.", " * Updated debconf translations:", " - French, thanks to Jean-Baka Domelevo Entfellner ", " (closes: #547039)", " - Bulgarian, thanks to Damyan Ivanov (closes: #562835)", " * debian/patches/sys-types-include.patch: fix pam_modutil.h so that it can", " be included directly, without having to include sys/types.h first.", " Closes: #556203.", " * Add postgresql-8.3 to the list of services in need of restart on upgrade.", " Closes: #563674.", " * And drop postgresql-{7.4,8.1} from the list, neither of which is present", " in stable.", " * debian/patches/007_modules_pam_unix: recognize that *all* of the password", " hashes other than traditional crypt handle passwords >8 chars in length.", " LP: #356766.", "" ], "package": "pam", "version": "1.1.1-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 513955, 356766 ], "author": "Steve Langasek ", "date": "Mon, 01 Feb 2010 02:04:33 -0800" }, { "cves": [], "log": [ "", " * Brown paper bag: remove the right patch from the series file.", "" ], "package": "pam", "version": "1.1.0-4ubuntu3", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 10 Dec 2009 23:09:03 -0800" }, { "cves": [], "log": [ "", " * \"Rebase\" Ubuntu patches to apply them last in the series.", " * Drop patch ubuntu-regression_fix_securetty, superseded by the more", " precise fix in pam_securetty_tty_check_before_user_check.", "" ], "package": "pam", "version": "1.1.0-4ubuntu2", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 10 Dec 2009 22:52:20 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.1.0-4ubuntu1", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 05 Nov 2009 21:33:15 -0800" }, { "cves": [], "log": [ "", " * debian/patches/pam_securetty_tty_check_before_user_check: new patch,", " to make pam_securetty always return success on a secure tty regardless", " of what username was passed. Thanks to Nicolas François", " for the patch. Closes: #537848", " * debian/local/pam-auth-update: only reset the seen flag on the template", " when there's new information; this avoids reprompting users for the same", " information on upgrade, regardless of the debconf priority used.", " Closes: #544805.", " * libpam0g no longer depends on libpam-runtime; packages that use", " /etc/pam.d/common-* must depend directly on libpam-runtime, and most do", " (including the Essential: yes ones), so let's break this circular", " dependency. Closes: #545086, LP: #424566.", "" ], "package": "pam", "version": "1.1.0-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 424566 ], "author": "Steve Langasek ", "date": "Mon, 14 Sep 2009 18:47:25 -0700" }, { "cves": [], "log": [ "", " * Bump debian/compat to 7, so we can use sane contents in debian/*.install", " * Switch all packages over to dh_install", " * Rename debian/*.lintian to debian/*.lintian-overrides and use dh_lintian", " * Move installation logic out of debian/rules into individual .install", " files", " * Drop superfluous options to dh_installchangelogs, dh_shlibdeps", " * Use debian/clean instead of rm -f'ing files in debian/rules clean target", " * Drop ./configure options that are no-ops", " * Drop the /lib/security/pam_unix_*.so symlinks, which have been deprecated", " now for 10 years and are not used at all if pam-auth-update is in play.", " * Drop the pam_rhosts_auth.so symlink as well, and document in NEWS.Debian", " that this is now obsolete.", " * Drop stale content from README.debian: some of this should have been in", " NEWS.Debian instead (but is so old it's not worth putting it there now),", " some of it is obsolete by the change in package VCS.", " * Convert debian/rules to debhelper 7 and add versioned build-dependencies", " on debhelper and quilt to suit.", " * Drop CFLAGS that we don't need anymore (-fPIC, -D_REENTRANT,", " -D_GNU_SOURCE).", " * Explicitly add -O0 to CFLAGS when noopt is set.", " * debian/patches/autoconf.patch: pull ltmain.sh in, to fix some spurious", " library linkage in the modules.", " * Move pam_cracklib manpage to the libpam-cracklib package, and add the", " requisite Replaces", " * Drop dh_makeshlibs -V; everything from lenny on should use the .symbols", " file instead, making the shlibs redundant so we don't need to care what", " version gets listed there.", "" ], "package": "pam", "version": "1.1.0-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Sep 2009 18:47:45 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", " * Changes merged in Debian:", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.1.0-2ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 04 Sep 2009 01:11:48 -0700" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * debian/patches/pam_unix_dont_trust_chkpwd_caller.patch: fix this patch", " to call setregid() instead of always returning an error on username", " mismatch in unix_chkpwd, needed in the SELinux case and in some corner", " cases with the broken_shadow option. Thanks to Michael Spang for the", " analysis. Closes: #543589.", " * fix the PAM mini-policy to not tell app maintainers that they don't need", " to depend on libpam-modules if they reference modules from there.", " * make libpam-runtime depend on libpam-modules (>= 1.0.1-6) - nothing else", " guarantees that we have pam_unix available for use by pam-auth-update.", " * Use /bin/sh instead of /bin/bash for libpam0g.postinst, since we've", " confirmed there are no longer any bashisms there. Closes: #519973.", " * Clean up the libpam0g postinst a bit; invoke-rc.d has been a guaranteed", " interface for two stable release cycles now", " * debian/patches/namespace_with_awk_not_gawk: fix the sample", " namespace.init script's dependency on non-POSIX features of gawk, since", " we don't use gawk by default. Closes: #518908.", " * Updated debconf translations:", " - German, thanks to Sven Joachim (closes: #544464)", "", " [ Kees Cook ]", " * debian/local/common-password, debian/pam-configs/unix: switch from \"md5\"", " to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.1.0-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 31 Aug 2009 14:21:27 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", " * Dropped changes, superseded upstream:", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf.", "" ], "package": "pam", "version": "1.1.0-1ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 26 Aug 2009 00:40:14 -0700" }, { "cves": [], "log": [ "", " * New upstream version.", " - pam_access no longer does DNS lookups when we know we're comparing", " with a tty name or a service name. Closes: #376209.", " - fixes for manpage spelling. Closes: #488690.", " - fix evaluation of or'ed list of users in time.conf and group.conf.", " Closes: #326407, #514423.", " * Drop patches pam_unix_thread-safe_save_old_password.patch,", " pam_env_ignore_garbage.patch, dont_freeze_password_chain,", " pam_1.0.4_mindays, pam_mail-fix-quiet, pam_unix-chkpwd-wait, and", " cve-2009-0887-libpam-pam_misc.patch, which are included upstream.", " * Trim pam.d-manpage-section patch, which was mostly but not completely", " applied upstream.", " * Update debian/libpam0g.symbols for new extension.", " * Bump the shlibs version as well, for our dpkg-shlibdeps fallback.", " * And bump the version checks in the libpam-modules {pre,post}inst, so that", " the necessary services get restarted for any modules that need the new", " symbols.", " * Add /sbin/mkhomedir_helper to libpam-modules.", " * Document that pam_cracklib no longer checks /etc/security/opasswd.", " Closes: #263767.", " * debian/patches/007_modules_pam_unix: drop divergence from upstream", " that treats \"0\" as a special value in various fields in /etc/shadow,", " and document this in debian/NEWS. Thanks to Nicolas François", " for the detailed analysis.", " Closes: #308229.", " * Updated debconf translations:", " - French, thanks to Jean-Baka Domelevo Entfellner ", " (closes: #521266)", " * Build with LDFLAGS=-Wl,-z,defs to guard against the possibility of", " any undefined symbols (due to typos or otherwise) at build time.", " Closes: #102311.", " * On upgrade from versions before 1.1.0-1, if", " /etc/pam.d/common-session-noninteractive has not been created (because", " the user declined use of pam-auth-update), create it by copying", " /etc/pam.d/common-session. Closes: #543401.", " * debian/patches/fix-man-crud: new patch, fix \"undefined macro\" errors in", " manpages caused by oddities of toolchain used when generating them", " upstream.", "" ], "package": "pam", "version": "1.1.0-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 25 Aug 2009 20:35:26 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " * debian/local/pam-auth-update: prune some more md5sums from intrepid", " pre-release versions, reducing the Ubuntu delta some", " * debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.0.1-11ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 23 Aug 2009 20:14:58 -0700" }, { "cves": [], "log": [ "", " * debian/libpam-runtime.postinst: bump the --force version check to", " 1.0.1-11, to allow for a new common-session-noninteractive config file;", " and include md5sum checking logic that will work the same with old", " unmanaged and new managed /etc/pam.d/common-* files.", " * debian/local/common-{auth,account,session,password}.md5sums: document", " the known md5sums for the new managed files.", " * debian/local/common-session-noninteractive{,.md5sums},", " debian/local/pam-auth-update: split out a session-noninteractive include", " file, so that we can at last distinguish between interactive and", " non-interactive PAM sessions at a policy level. Closes: #169930,", " LP: #287715.", " * debian/local/pam-auth-update: prune md5sums for unsupported upgrade", " paths (intrepid pre-release -> karmic/squeeze)", " * Clean up the PAM mini-policy, which hasn't been touched in a number of", " years and was looking a bit crufty", " * debian/libpam-runtime.templates: correctly tag the URL as a", " non-translatable string.", " * Updated debconf translations:", " - Swedish, thanks to Martin Bagge (closes: #541399)", " - Portuguese, thanks to Américo Monteiro ", " (closes: #541108)", " - Russian, thanks to Yuri Kozlov (closes: #541094)", "" ], "package": "pam", "version": "1.0.1-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 287715 ], "author": "Steve Langasek ", "date": "Sun, 23 Aug 2009 18:07:11 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", "" ], "package": "pam", "version": "1.0.1-10ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 07 Aug 2009 09:50:02 +0100" }, { "cves": [ { "cve": "CVE-2009-0887", "url": "https://ubuntu.com/security/CVE-2009-0887", "cve_description": "Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.", "cve_priority": "low", "cve_public_date": "2009-03-12 15:20:00 UTC" } ], "log": [ "", " [ Steve Langasek ]", " * Updated debconf translations:", " - Finnish, thanks to Esko Arajärvi (closes: #520785)", " - Russian, thanks to Yuri Kozlov (closes: #521874)", " - German, thanks to Sven Joachim (closes: #521530)", " - Basque, thanks to Piarres Beobide ", " (closes: #524285)", " * When no profiles are chosen in pam-auth-update, throw an error message", " and prompt again instead of letting the user end up with an insecure", " system. This introduces a new debconf template. Closes: #519927,", " LP: #410171.", "", " [ Kees Cook ]", " * Add debian/patches/pam_1.0.4_mindays: backport upstream 1.0.4 fixes", " for MINDAYS-Field regression (closes: #514437).", " * debian/control: add missing misc:Depends for packages that need it.", "", " [ Sam Hartman ]", " * Remove conflicts information for transitions prior to woody release", " * Fix lintian overrides for libpam-runtime", " * Overrides for lintian finding quilt patches", " * pam_mail-fix-quiet: patch from Andreas Henriksson", " applied upstream to fix quiet option of pam_mail, Closes: #439268", "", " [ Dustin Kirkland ]", " * debian/patches/update-motd: run the update-motd scripts in pam_motd;", " render update-motd obsolete, LP: #399071", "", " [ Sam Hartman ]", " * cve-2009-0887-libpam-pam_misc.patch: avoid integer signedness problem", " (CVE-2009-0887) (Closes: #520115)", "" ], "package": "pam", "version": "1.0.1-10", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [ 410171, 399071 ], "author": "Steve Langasek ", "date": "Thu, 06 Aug 2009 17:54:32 +0100" }, { "cves": [], "log": [ "", " * Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", "" ], "package": "pam", "version": "1.0.1-9ubuntu3", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 15 Jul 2009 23:55:50 -0700" }, { "cves": [], "log": [ "", " [ Dustin Kirkland ]", " * debian/patches/update-motd: run the update-motd scripts in pam_motd;", " render update-motd obsolete, LP: #399071", " * debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", "" ], "package": "pam", "version": "1.0.1-9ubuntu2", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [ 399071 ], "author": "Steve Langasek ", "date": "Wed, 15 Jul 2009 20:41:52 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.0.1-9ubuntu1", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 20 Mar 2009 19:12:10 -0700" }, { "cves": [], "log": [ "", " * Move the pam module packages to section 'admin'.", " * 027_pam_limits_better_init_allow_explicit_root: defaults need to be", " declared as LIMITS_DEF_DEFAULT instead of LIMITS_DEF_ALL, otherwise", " global limits will fail to be applied. LP: #314222.", "" ], "package": "pam", "version": "1.0.1-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 314222 ], "author": "Steve Langasek ", "date": "Fri, 20 Mar 2009 19:48:47 -0700" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Bulgarian, thanks to Damyan Ivanov (closes: #518121)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #518214)", " - Swedish, thanks to Martin Bagge (closes: #518324)", " - Vietnamese, thanks to Clytie Siddall ", " (closes: #518329)", " - Japanese, thanks to Kenshi Muto (closes: #518335)", " - Slovak, thanks to Ivan Masár (closes: #518341)", " - Czech, thanks to Miroslav Kure (closes: #518992)", " - Portuguese, thanks to Américo Monteiro ", " (closes: #519204)", " - Galician, thanks to Marce Villarino ", " (closes: #519447)", " - Romanian, thanks to Eddy Petrișor ", " (closes: #520552)", " * 027_pam_limits_better_init_allow_explicit_root: set the RLIMIT_MEMLOCK", " limit correctly to match the kernel default, which is not RLIM_INFINITY.", " Closes: #472629.", "" ], "package": "pam", "version": "1.0.1-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 20 Mar 2009 18:15:07 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " * Dropped changes, merged in Debian:", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " - New patch dont_freeze_password_chain, cherry-picked from upstream:", " don't always follow the same path through the password stack on", " the PAM_UPDATE_AUTHTOK pass as was used in the PAM_PRELIM_CHECK", " pass; this Linux-PAM deviation from the original PAM spec causes a", " number of problems, in particular causing wrong return values when", " using the refactored pam-auth-update stack. LP: #303515, #305882.", " - debian/patches/027_pam_limits_better_init_allow_explicit_root:", " Add documentation to the patch showing how to set limits for root.", " * Bump the libpam-cracklib dependency on libpam-runtime to 1.0.1-6,", " reducing the delta with Debian.", " * Drop upgrade handling code from libpam-runtime.postinst that's only", " needed when upgrading from 1.0.1-2ubuntu1, a superseded intrepid", " pre-release version of the package.", " * pam-auth-update: swap out known md5sums from intrepid pre-release versions", " with the md5sums from the released intrepid version", " * pam-auth-update: drop some md5sums that will only be seen on upgrade from", " pre-intrepid versions; skipping over the 8.10 final release is not", " supported, and upgrading via 8.10 means those config files will be", " replaced so the old md5sums will never be seen again.", "" ], "package": "pam", "version": "1.0.1-7ubuntu1", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [ 303515, 305882 ], "author": "Steve Langasek ", "date": "Tue, 03 Mar 2009 17:34:19 -0800" }, { "cves": [], "log": [ "", " * 027_pam_limits_better_init_allow_explicit_root:", " - fix the patch so that our limit resets are actually *applied*,", " which has apparently been broken for who knows how long!", " - shadow the finite kernel defaults for RLIMIT_SIGPENDING and", " RLIMIT_MSGQUEUE as well, so that the preceding change doesn't", " suddenly expose systems to DoS or other issues.", " - include documentation in the patch, giving examples of how to set", " limits for root. Thanks to Jonathan Marsden.", " * pam-auth-update: swap out known md5sums from intrepid pre-release", " versions with the md5sums from the released intrepid version", " * pam-auth-update: set the umask, so we don't accidentally mark", " /etc/pam.d/common-* unreadable. Thanks to Martin Krafft for catching.", " Closes: #518042.", "" ], "package": "pam", "version": "1.0.1-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 03 Mar 2009 17:18:42 -0800" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Vietnamese, thanks to Clytie Siddall ", " * New patch dont_freeze_password_chain, cherry-picked from upstream:", " don't always follow the same path through the password stack on", " the PAM_UPDATE_AUTHTOK pass as was used in the PAM_PRELIM_CHECK", " pass; this Linux-PAM deviation from the original PAM spec causes a", " number of problems, in particular causing wrong return values when", " using the refactored pam-auth-update stack. LP: #303515, #305882.", " * debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", "" ], "package": "pam", "version": "1.0.1-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 303515, 305882 ], "author": "Steve Langasek ", "date": "Sat, 28 Feb 2009 13:36:57 -0800" }, { "cves": [], "log": [ "", " * New patch dont_freeze_password_chain, cherry-picked from upstream:", " don't always follow the same path through the password stack on", " the PAM_UPDATE_AUTHTOK pass as was used in the PAM_PRELIM_CHECK", " pass; this Linux-PAM deviation from the original PAM spec causes a", " number of problems, in particular causing wrong return values when", " using the refactored pam-auth-update stack. LP: #303515, #305882.", "" ], "package": "pam", "version": "1.0.1-5ubuntu2", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [ 303515, 305882 ], "author": "Steve Langasek ", "date": "Fri, 27 Feb 2009 16:20:24 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " * Bump the version numbers referenced in the config files, again, as pam", " has revved in Debian and moved the bar.", " * pam-auth-update: If /var/lib/pam/seen is absent, treat this the same", " as a present but empty file; thanks to Greg Price for the patch.", " LP: #294513.", " * pam-auth-update: Ignore removed profiles when detecting an empty set", " of currently-enabled modules. Thanks to Greg Price for this as well.", " * debian/control: libpam-runtime needs a versioned dependency on", " debconf, because it uses the x_loadtemplatefile extension that's ", " not supported by debconf versions before hardy. LP: #295135.", " * pam-auth-update: trim leading whitespace from multiline fields when", " parsing PAM profiles. LP: #295441.", " * pam-auth-update: factor out the duplicate code used for returning", " the lines for a given module", "", " [ Jonathan Marsden ]", " * debian/patches/027_pam_limits_better_init_allow_explicit_root:", " Add to patch, documenting how to set limits for root user.", " Include an example. Alters limits.conf, limits.conf.5.xml,", " and limits.conf.5 . (LP: #65244)", "" ], "package": "pam", "version": "1.0.1-5ubuntu1", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [ 294513, 295135, 295441, 65244 ], "author": "Steve Langasek ", "date": "Thu, 08 Jan 2009 20:26:25 +0000" }, { "cves": [], "log": [ "", " * Build-conflict with libxcrypt-dev, which otherwise pulls libxcrypt in as", " a dependency of libpam-modules if it's installed during the build.", " Thanks to Larry Doolittle for catching.", " * Don't refer to gnome-screensaver in the debconf template; it isn't", " actually affected by the libpam symbol issue because it forks a separate", " process to display the screensaver dialog.", " * Have libpam-modules Pre-Depend on ${misc:Depends}, so that we can", " warn users about needing to disable xscreensaver and xlockmore", " before libpam-modules is unpacked. Closes: #502140, LP: #256238.", " * Updated debconf translations for the new template:", " - Italian, thanks to David Paleino ", " - Simplified Chinese, thanks to Deng Xiyue", " (closes: #510371)", " - Portuguese, thanks to Américo Monteiro ", " - Swedish, thanks to Martin Bagge (closes: #510379)", " - Japanese, thanks to Kenshi Muto (closes: #510380)", " - Finnish, thanks to Esko Arajärvi (closes: #510382)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #510389)", " - Galician, thanks to Marce Villarino ", " - Slovak, thanks to helix84 (closes: #510412)", " - Bulgarian, thanks to Damyan Ivanov ", " - Czech, thanks to Miroslav Kure <", " (closes: #510608)", " - French, thanks to Steve Petruzzello ", " - German, thanks to Sven Joachim (closes: #510617)", " - Basque, thanks to Piarres Beobide ", " (closes: #510699)", " - Russian, thanks to Yuri Kozlov (closes: #510701)", " - Turkish, thanks to Mert Dirik (closes: #510707)", "" ], "package": "pam", "version": "1.0.1-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 256238 ], "author": "Steve Langasek ", "date": "Tue, 06 Jan 2009 00:05:13 -0800" }, { "cves": [], "log": [ "", " * No-change upload to jaunty to fix publication on armel.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.4", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 18 Nov 2008 14:09:00 +0000" }, { "cves": [], "log": [ "", " * No-change upload of 1.0.1-4ubuntu5.1 to -updates. -proposed package was", " copied while some ports were not built yet.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.3", "urgency": "low", "distributions": "intrepid-updates", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Tue, 11 Nov 2008 14:50:12 +0100" }, { "cves": [], "log": [ "", " * No-change rebuild because the archive admin (me) copied the package", " to jaunty too soon.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.2", "urgency": "low", "distributions": "intrepid-proposed", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 05 Nov 2008 20:28:11 +0000" }, { "cves": [], "log": [ "", " * Allow passwords to change on expired accounts, by passing", " new_authtok_reqd return codes immediately (LP: #291091).", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.1", "urgency": "low", "distributions": "intrepid-proposed", "launchpad_bugs_fixed": [ 291091 ], "author": "Kees Cook ", "date": "Wed, 05 Nov 2008 09:31:45 -0800" }, { "cves": [], "log": [ "", " * debian/libpam0g.postinst: change 'cupsys' to 'cups' in the list of", " default desktop services that are ignored in deciding whether to prompt", " for service restarts on upgrade. Partially addresses LP #278117.", " * debian/libpam0g.postinst: also filter out samba, which may be installed", " on the desktop to enable filesharing.", " * debian/libpam-cracklib.prerm, debian/libpam-runtime.prerm: add the", " ubiquitous debhelper tokens (currently a no-op)", " * pam-auth-update: Use -Initial only for the first profile, even when", " there's no explicit -Initial config for that first profile", " * fix common-session/common-password to use the same overall stack", " structure as auth/account, so that we get the correct behavior when", " all password modules fail. LP: #272232.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 272232 ], "author": "Steve Langasek ", "date": "Wed, 15 Oct 2008 18:11:13 -0700" }, { "cves": [], "log": [ "", " * Fix a bug in the parser that caused spewing of errors when there", " were more lines in the config file following the managed block.", " LP: #270328.", "" ], "package": "pam", "version": "1.0.1-4ubuntu4", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 270328 ], "author": "Steve Langasek ", "date": "Tue, 23 Sep 2008 06:34:56 +0000" }, { "cves": [], "log": [ "", " * Fix up the code that saves state to /var/lib/pam, so that it matches", " what's expected by the code which later compares the saved and active", " profiles in the case that there are both primary and additional", " modules present.", "" ], "package": "pam", "version": "1.0.1-4ubuntu3", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 16 Sep 2008 06:49:56 +0000" }, { "cves": [], "log": [ "", " * Brown paper bag bug: fix a missing comma in pam-auth-update.", "" ], "package": "pam", "version": "1.0.1-4ubuntu2", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 13 Sep 2008 08:55:32 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " * Bump the version numbers referenced in the config files, again, as pam", " has revved in Debian and moved the bar.", " * debian/pam-config/*: refine the password profiles to use a 'primary'", " block, to better parallel the auth structure.", " * Drop '-Final' from the field names in /usr/share/pam-configs, supporting", " these field names for backwards compatibility only", " * Bump the dependency version requirement to 1.0.1-4ubuntu1 for the above", " change", "" ], "package": "pam", "version": "1.0.1-4ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 13 Sep 2008 08:55:19 +0000" }, { "cves": [], "log": [ "", " * High-urgency upload for RC bugfix.", "", " [ Julien Cristau ]", " * pam_unix-chkpwd-wait: don't assume that the unix_chkpwd process exits", " normally; if it was killed by a signal, we don't want to accept the", " password. Closes: #495879.", "", " [ Steve Langasek ]", " * 007_modules_pam_unix: update the manpage at the same time as the xml", " source (grr, autogenerated files in source packages). Closes: #495804.", " * 055_pam_unix_nullok_secure: also don't call the helper at all from", " _unix_blankpasswd when we can detect that null passwords are disallowed,", " to avoid causing spammy logs on successful authentications.", " Closes: #496620.", " * debian/rules: call chgrp *before* calling chmod, lest the sgid bit", " on unix_chkpwd be cleared during the build when using -rsudo.", " Closes: #496983.", "" ], "package": "pam", "version": "1.0.1-4", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 28 Aug 2008 22:59:23 -0700" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * Never remove the .pam-old files; just avoid creating them if --force isn't", " set.", " * Add a manpage for pam-auth-update.", " * Automatically upgrade the boilerplate for /etc/pam.d/common-* if we", " detect that they have not been locally modified.", "", " [ Kees Cook ]", " * debian/local/common-password, debian/pam-configs/unix: switch from \"md5\"", " to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.0.1-3ubuntu5", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 26 Aug 2008 06:33:07 +0000" }, { "cves": [], "log": [ "", " * If two profiles have the same Priority, sort by the profile name to", " ensure a complete sort so we can filter out all the duplicates from the", " list and not write out broken configs. LP: #260371.", "" ], "package": "pam", "version": "1.0.1-3ubuntu4", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 260371 ], "author": "Steve Langasek ", "date": "Fri, 22 Aug 2008 17:33:14 +0000" }, { "cves": [], "log": [ "", " * s/pam-auth-config/pam-auth-update/ in the source, I can't seem to get", " this name consistent to save my life - I'm starting to think I named it", " wrong...", " * Fix the regex used when suppressing jump counts when reading the saved", " config, so that we don't clobber module options with numbers in them.", " * If the target doesn't already exist, don't try to copy it.", " * Filter the config list to exclude configs that no longer exist.", " LP: #260122.", " * Avoid unnecessary sort/grep in the case where we already have a sorted", " list.", " * Implement pam-auth-update --remove, for use in package prerms when called", " with \"remove\".", "" ], "package": "pam", "version": "1.0.1-3ubuntu3", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 260122 ], "author": "Steve Langasek ", "date": "Thu, 21 Aug 2008 15:38:37 -0700" }, { "cves": [], "log": [ "", " * debian/local/common-session: the session stack needs to be handled the", " same way as the password stack, with the possibility of zero primary", " modules; required to fix build failures on the Ubuntu buildds due to", " su not being able to open sessions by default. LP: #259867.", " * debian/libpam-runtime.postinst: when upgrading from the broken", " 1.0.1-2ubuntu1 version, manually edit /etc/pam.d/common-session to", " recover.", "" ], "package": "pam", "version": "1.0.1-3ubuntu2", "urgency": "high", "distributions": "intrepid", "launchpad_bugs_fixed": [ 259867 ], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 13:27:10 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " * Remove spurious 'conflict' with a non-existent module, which was added", " just as an example", "" ], "package": "pam", "version": "1.0.1-3ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 11:58:35 -0700" }, { "cves": [], "log": [ "", " * 055_pam_unix_nullok_secure: don't call _pammodutil_tty_secure with a NULL", " tty argument, since this will cause our helper to segfault instead of", " returning a useful value. Thanks to Troy Davis for the report.", " Closes: #495806.", "" ], "package": "pam", "version": "1.0.1-3", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 11:55:47 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam-runtime.postinst,", " debian/local/common-{auth,password}{,.md5sums}:", " Use the new 'missingok' option by default for pam_smbpass in case", " libpam-smbpass is not installed (LP: #216990); must use \"requisite\"", " rather than \"required\" to prevent \"pam_smbpass migrate\" from firing in", " the event of an auth failure; md5sums updated accordingly.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " * debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", "" ], "package": "pam", "version": "1.0.1-2ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 216990 ], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 09:17:28 +0000" }, { "cves": [], "log": [ "", " * 007_modules_pam_unix: update the documentation to correctly document", " the default minimum password length is 6, not 1.", " * Look for cups instead of cupsys as an init script name when restarting", " services; thanks to Stephen Olander-Waters for pointing this out.", " Closes: #492977.", " * Update the Debian PAM mini-policy to remove references to the", " long-obsolete pam_pwdb, and clarify the relationship between pam_stack", " and @include.", " * Drop various bits of unused cruft from the debian/ directory.", " * Drop libpam-runtime.preinst, only used for upgrades from woody to sarge", " to deal with modified conffiles.", " * Build-Conflict with libdb4.2-dev, which satisfies the libdb-dev", " build-dependency but causes pam_userdb to be silently omitted.", " Closes: #493574.", " * 054_pam_security_abstract_securetty_handling: move the warning log about", " an insecure tty back to pam_securetty proper; we don't want to generate", " log messages every time pam_unix is called as non-root.", " Closes: #493283. As a side-effect, pam_unix no longer logs any warnings", " about NULL password + insecure tty, but I don't think this is critical.", "" ], "package": "pam", "version": "1.0.1-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 08 Aug 2008 10:47:26 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Dropped changes:", " - Linux-PAM/modules/pam_selinux/pam_selinux.8: Ubuntu pam_selinux manpage", " is 2 years newer than Debian's, contains a number of character escaping", " fixes plus content updates", " - debian/patches-applied/ubuntu-pam_selinux_seusers: patch pam_selinux to", " correctly support seusers (backported from changes in PAM 0.99.8). ", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Bound RLIMIT_NICE", " from below as well as from above. Fix off-by-one error when converting", " RLIMIT_NICE to the range of values used by the kernel.", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam-runtime.postinst,", " debian/local/common-{auth,password}{,.md5sums}:", " Use the new 'missingok' option by default for pam_smbpass in case", " libpam-smbpass is not installed (LP: #216990); must use \"requisite\"", " rather than \"required\" to prevent \"pam_smbpass migrate\" from firing in", " the event of an auth failure; md5sums updated accordingly.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " * Refresh patch ubuntu-no-error-if-missingok for the new upstream version.", " * Change Vcs-Bzr to point at the new Ubuntu branch.", "" ], "package": "pam", "version": "1.0.1-1ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 216990 ], "author": "Steve Langasek ", "date": "Mon, 28 Jul 2008 20:58:26 +0000" }, { "cves": [], "log": [ "", " * New upstream version.", " - pam_limits: bound RLIMIT_NICE from below. Closes: #403718.", " - pam_mail: set the MAIL variable even when .hushlogin is set.", " Closes: #421010.", " - new minclass option introduced for pam_cracklib. Closes: #454237.", " - fix a failure to check the string length when matching usernames in", " pam_group. Closes: #444427.", " - fix setting shell security context in pam_selinux. Closes: #451722.", " - use --disable-audit, to avoid libaudit being linked in", " accidentally", " - pam_unix now supports SHA-256 and SHA-512 password hashes.", " Closes: #484249, LP: #245786.", " - pam_rhosts_auth is dropped upstream (closes: #382987); add a compat", " symlink to pam_rhosts to support upgrades for a release, and give a", " warning in NEWS.Debian.", " - new symbol in libpam.so.0, pam_modutil_audit_write; shlibs bump, and", " do another round of service restarts on upgrade.", " - pam_unix helper is now called whenever an unprivileged process", " tries and fails to query a user's account status. Closes: #367834.", " * Drop patches 006_docs_cleanup, 015_hurd_portability,", " 019_pam_listfile_quiet, 024_debian_cracklib_dict_path, 038_support_hurd,", " 043_pam_unix_unknown_user_not_alert, 046_pam_group_example,", " no_pthread_mutexes, limits_wrong_strncpy, misc_conv_allow_sigint.patch,", " pam_tally_audit.patch, 057_pam_unix_passwd_OOM_check, and", " 065_pam_unix_cracklib_disable which have been merged upstream.", " * Patch 022_pam_unix_group_time_miscfixes: partially merged upstream;", " now is really just \"pam_group_miscfixes\".", " * Patch 007_modules_pam_unix partially superseded upstream; stripping", " hpux-style expiry information off of password fields is now supported.", " * New patch pam_unix_thread-safe_save_old_password.patch, to make sure all", " our getpwnam() use in pam_unix is thread-safe (fixes an upstream", " regression)", " * New patch pam_unix_fix_sgid_shadow_auth.patch, fixing an upstream", " regression which prevents sgid shadow apps from being able to authenticate", " any more because the module forces use of the helper and the helper won't", " allow authentication of arbitrary users. This change does mean we're", " going to be noisier for the time being in an SELinux environment, which", " should be addressed but is not a regression on Debian.", " * New patch pam_unix_dont_trust_chkpwd_caller.patch, rolling back an", " upstream change that causes unix_chkpwd to assume that setuid(getuid())", " is sufficient to drop permissions and attempt any authentication on", " behalf of the user.", " * The password-changing helper functionality for SELinux systems has been", " split out into a separate unix_update binary, so at long last we can", " change unix_chkpwd to be sgid shadow instead of suid root.", " Closes: #155583.", " - Update the lintian override to match.", " * Install the new unix_update helper into libpam-modules.", " * Use a pristine upstream tarball instead of repacking; requires various", " changes to debian/rules and debhelper files.", " * Replace the Vcs-Svn field with a Vcs-Bzr field; jumping ship from svn,", " and how!", " * Debconf translations:", " - Romanian, thanks to Igor Stirbu ", " (closes: #491821)", " * Add libpam0g.symbols, for finer-grained package dependencies with", " dpkg-gensymbols.", " * Fix debian/copyright to list the known copyright holders", " * Fix up the doc-base sections for the libpam-doc documentation, \"Apps\"", " should not be part of the section name", " * Also fix up whitespace issues in the doc-base abstracts", " * Fix a typo in the libpam0g-dev description.", " * 027_pam_limits_better_init_allow_explicit_root: RLIM_INFINITY is also", " invalid for RLIMIT_NOFILE, so when resetting the limits for a new session,", " use the kernel default of 1024 instead. Closes: #404836.", " * Create /etc/environment on initial install of libpam-modules (or on", " upgrade from an old version), to quell warnings in the logs about it", " being missing. Closes: #442049.", " * 026_pam_unix_passwd_unknown_user: drop a redundant, and broken, check for", " the NSS source of our user; this was preventing password changes for NIS", " users, which otherwise should have worked. Closes: #203222, LP: #9224.", " * New patch do_not_check_nis_accidentally: respect the 'nis' option", " (set or unset) when looking up the user's password entry for password", " changes. Thanks to Quentin Godfroy for the", " patch. Closes: #469635.", " * Drop patch 049_pam_unix_sane_locking, which upon review is not needed;", " it reduces the length of time we hold the lock, but at the expense of", " being able to enforce minimum times between password changes.", " * debian/watch: upstream has hit 1.0, so we're no longer in a \"pre\"", " directory. Fix up the regex for uscan.", " * Fix the libpam0g-dev examples directory to not include a gratuitous", " .cvsignore file.", " * New patch, pam.d-manpage-section, to fix the manpage references to", " point to section 5 instead of section 8.", " * Update patch PAM-manpage-section to fix the references to pam(7) from", " other manpages. Closes: #470137.", " * Add debian/README.source documenting that this package uses quilt.", " * Bump Standards-Version to 3.8.0.", " * Fix a bug in the uid-restoring code in the hurd_no_setfsuid patch; thanks", " to Tomas Mraz for indirectly bringing this to my", " attention", "" ], "package": "pam", "version": "1.0.1-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 245786, 9224 ], "author": "Steve Langasek ", "date": "Mon, 28 Jul 2008 13:56:26 -0700" }, { "cves": [], "log": [ "", " * Medium-urgency upload for RC bugfix", " * Debconf translations:", " - Italian, thanks to David Paleino (closes: #483913)", " - Slovak, thanks to Ivan Masár (closes: #488908)", " - Turkish, thanks to Mert Dirik (closes: #490880)", " - Basque, thanks to Piarres Beobide ", " (closes: #473975)", " * Drop the 'XS' from Vcs-Svn/Vcs-Browser, since these are now officially", " recognized fields.", " * Add a Homepage field. Closes: #473338.", " * Drop -DCRACKLIB_DICTS from CFLAGS, since the referenced define is no", " longer provided by cracklib2-dev 2.8 and above. This requires a", " build-dependency on the corresponding version of libcrack2-dev.", " Closes: #490236.", "" ], "package": "pam", "version": "0.99.7.1-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 21 Jul 2008 11:49:59 -0700" }, { "cves": [], "log": [ "", " * debian/libpam-modules.postinst: revert addition of ~/bin to the end of the", " default PATH set in /etc/environment as it was pointed out by Colin", " Watson that getenv() does not properly expand '~'", "" ], "package": "pam", "version": "0.99.7.1-6ubuntu2", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Jamie Strandboge ", "date": "Tue, 24 Jun 2008 06:29:40 -0400" }, { "cves": [], "log": [ "", " * Merge from debian unstable", " * Dropped changes:", " - Linux-PAM/modules/pam_limits/README,", " Linux-PAM/modules/pam_selinux/README: Ubuntu versions had some", " insignificant character differences, dropping in favor of Debian", " versions; pam_selinux documentation has dropped \"multiple\", and added", " \"select_context\", and \"use_current_range\" as options.", " - debian/control, debian/local/common-session{,md5sums}: use", " libpam-foreground for session management.", " - Build using db4.5 instead of db4.6.", " * Remaining changes:", " - Linux-PAM/modules/pam_selinux/pam_selinux.8: Ubuntu pam_selinux manpage", " is 2 years newer than Debian's, contains a number of character escaping", " fixes plus content updates; (should send to Debian).", " - debian/control: Maintainer updated.", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf; add ~/bin to PATH", " (LP: #64064); (should send to Debian).", " - debian/libpam-runtime.postinst,", " debian/local/common-{auth,password}{,.md5sums}:", " Use the new 'missingok' option by default for pam_smbpass in case", " libpam-smbpass is not installed (LP: #216990); must use \"requisite\"", " rather than \"required\" to prevent \"pam_smbpass migrate\" from firing in", " the event of an auth failure; md5sums updated accordingly.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running (LP: #141309).", " - debian/applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-pam_selinux_seusers: patch pam_selinux to", " correctly support seusers (backported from changes in PAM 0.99.8). ", " Without this patch login will not get correct security context when ", " using libselinux >= 1.27.2 (LP: #187822).", " - debian/patches-applied/ubuntu-regression_fix_securetty: securetty's", " earlier behavior would correctly prompt for password on bad usernames", " (LP: #139075).", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits. Bound", " RLIMIT_NICE from below as well as from above. Fix off-by-one error when", " converting RLIMIT_NICE to the range of values used by the kernel.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " * Alphabetized this merge changelog entry by filename (easier reading", " against Ubuntu patch).", "" ], "package": "pam", "version": "0.99.7.1-6ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 64064, 216990, 141309, 187822, 139075 ], "author": "Dustin Kirkland ", "date": "Fri, 20 Jun 2008 10:32:00 -0500" }, { "cves": [], "log": [ "", " * Debconf translations:", " - Updated Vietnamese, thanks to Clytie Siddall ", " (closes: #444437)", " - Updated Spanish, thanks to Javier Fernández-Sanguino Peña", " (closes: #444479)", " - Updated German, thanks to Sven Joachim ", " (closes: #444566)", " - Galician, thanks to Jacobo Tarrio (closes: #444758)", " - Updated Czech, thanks to Miroslav Kure ", " (closes: #445022)", " - French, thanks to Cyril Brulebois ", " (closes: #445869)", " - Japanese, thanks to Kenshi Muto (closes: #446584)", " - Dutch, thanks to Bart Cornelis (closes: #448930)", " - Basque, thanks to Piarres Beobide (closes: #457042)", " - Updated Finnish, thanks to Esko Arajärvi (closes: #458264)", " - Swedish, thanks to Christer Andersson ", " (closes: #457674)", " * Make sure the \"audit\" option is specified in octal instead of in decimal,", " so that it doesn't randomly set other options. Thanks to Corey Wright", " for the catch. Closes: #446327.", "" ], "package": "pam", "version": "0.99.7.1-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 16 Mar 2008 02:06:28 -0700" }, { "cves": [], "log": [ "", " * debian/libpam-modules.postinst: Add ~/bin to the end of the default PATH", " set in /etc/environment (LP: #64064).", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu8", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 64064 ], "author": "Dustin Kirkland ", "date": "Thu, 19 Jun 2008 12:52:48 -0500" }, { "cves": [], "log": [ "", " * debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " * debian/local/common-{auth,password}, debian/libpam-runtime.postinst:", " Use the new 'missingok' option by default for pam_smbpass, to", " correct the problem of very loud logging introduced in the previous", " upload when libpam-smbpass is not installed. LP: #216990.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu7", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 216990 ], "author": "Steve Langasek ", "date": "Tue, 22 Apr 2008 18:53:37 +0000" }, { "cves": [], "log": [ "", " * debian/local/common-{auth,password}, debian/libpam-runtime.postinst:", " Add pam_smbpass as an optional module in the stack, to keep NTLM", " passwords (for filesharing) in sync with the main system passwords on a", " best-effort basis. LP: #208419.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu6", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [ 208419 ], "author": "Steve Langasek ", "date": "Tue, 08 Apr 2008 18:21:40 +0000" }, { "cves": [], "log": [ "", " * debian/local/common-session: Drop libpam-foreground. It's gone for good,", " and we do not want this in the PAM config for new installations, since it", " just spams syslog with error messages. (LP: #198714)", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu5", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [ 198714 ], "author": "Martin Pitt ", "date": "Tue, 11 Mar 2008 11:22:11 +0100" }, { "cves": [], "log": [ "", " * ubuntu-pam_selinux_seusers: patch pam_selinux to correctly support", " seusers (backported from changes in PAM 0.99.8). Without this patch", " login will not get correct security context when using libselinux", " >= 1.27.2 (LP: #187822).", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu4", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [ 187822 ], "author": "Caleb Case ", "date": "Wed, 30 Jan 2008 06:39:48 -0500" }, { "cves": [], "log": [ "", " * Temporarily reenable libpam-foreground in common-session again, until", " dbus' at_console policy works with ConsoleKit.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu3", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Thu, 29 Nov 2007 15:17:54 +0100" }, { "cves": [], "log": [ "", " * debian/local/common-session{,.md5sums}, debian/control: Drop", " libpam-foreground, superseded by ConsoleKit integration into hal.", " * debian/control: Build against libdb4.6 again. This drops this Debian delta", " and 4.6 is our target version in Hardy.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu2", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Thu, 22 Nov 2007 18:56:47 +0100" }, { "cves": [], "log": [ "", " * Resynchronise with Debian. Remaining changes:", " - debian/control, debian/local/common-session{,md5sums}: use", " libpam-foreground for session management.", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf.", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits. Bound", " RLIMIT_NICE from below as well as from above. Fix off-by-one error when", " converting RLIMIT_NICE to the range of values used by the kernel.", " (Originally patch 101; converted to quilt.)", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - debian/patches-applied/ubuntu-regression_fix_securetty: securetty's", " earlier behavior would correctly prompt for password on bad usernames", " (LP: #139075).", " - Build using db4.5 instead of db4.6.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running (LP: #141309).", " * debian/libpam0g.postinst: don't display a debconf warning about display", " managers that need restarting when update-manager is running, instead", " signal to update-notifier if a reboot is required.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu1", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 139075, 141309 ], "author": "Steve Langasek ", "date": "Fri, 28 Sep 2007 23:45:24 -0700" }, { "cves": [], "log": [ "", " * More lintian overrides, related to debconf prompting in the postinst", " * Debconf translations:", " - Brazilian Portuguese, thanks to Eder L. Marques ", " (closes: #440385)", " - Russian, thanks to Yuri Kozlov ", " (closes: #440390, #440953, #444039)", " - Bulgarian, thanks to Damyan Ivanov ", " (closes: #441863)", " - Finnish, thanks to Esko Arajärvi (closes: #443720)", " - Simplified Chinese, thanks to Ming Hua", " (closes: #443924)", " - Updated Portuguese, thanks to Américo Monteiro ", " - Updated Vietnamese, thanks to Clytie Siddall ", " (closes: #440800)", " - Updated German, thanks to Sven Joachim ", " - Updated Spanish, thanks to Javier Fernández-Sanguino Peña", " ", " - Updated Czech, thanks to Miroslav Kure ", " (closes: #441325)", " * Further cleanups of 007_modules_pam_unix -- don't use a global variable", " for pass_min_len, don't gratuitously move the length checking into the", " \"obscure\" checks, and internationalize the error strings.", " * Stop overriding the built-in default minimum password length in", " /etc/pam.d/common-password, and also drop the \"max\" option which has now", " been obsoleted.", " * Fix up the comments in /etc/pam.d/common-password to make it clear that", " the options are specific to pam_unix. Closes: #414559.", " * Patch 038: fix another thinko in the getline handling. Closes: #442276.", " * If there are active X logins, don't restart kdm, wdm, and xdm by default;", " instead, display a debconf error if they haven't been restarted.", " Closes: #441843.", " * Drop the local patch for Linux capabilities in pam_limits; Linux", " capabilities are not generally useful in a PAM context, and the PAM", " capabilities patch has been broken through much of its life.", " Closes: #440130.", " * -Wl,-z,defs was never enabled correctly, drop it since upstream is", " already using -no-undefined", " * Pass --build and --host args to ./configure as necessary, for", " cross-building support.", "" ], "package": "pam", "version": "0.99.7.1-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 28 Sep 2007 00:17:00 -0700" }, { "cves": [], "log": [ "", " * debian/libpam0g.postinst: call \"reload\" for all display managers", " (LP: #139065).", " * debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running (LP: #141309).", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu4", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 139065, 141309 ], "author": "Kees Cook ", "date": "Mon, 24 Sep 2007 15:01:29 -0700" }, { "cves": [], "log": [ "", " * ubuntu-regression_fix_securetty: securetty's earlier behavior would", " correctly prompt for password on bad usernames (LP: #139075).", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu3", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 139075 ], "author": "Kees Cook ", "date": "Wed, 12 Sep 2007 15:20:09 -0700" }, { "cves": [], "log": [ "", " * Build using db4.5 (instead of db4.6). One db4.x version less on the CD.", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu2", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Wed, 12 Sep 2007 17:44:25 +0200" }, { "cves": [], "log": [ "", " * Resynchronise with Debian (LP: #43169, #14505, #80431). Remaining changes:", " - debian/control, debian/local/common-session{,md5sums}: use", " libpam-foreground for session management.", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf.", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits. Bound", " RLIMIT_NICE from below as well as from above. Fix off-by-one error when", " converting RLIMIT_NICE to the range of values used by the kernel.", " (Originally patch 101; converted to quilt.)", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " * Dropped:", " - debian/rules: bashism fixes (merged upstream).", " - debian/control: Conflict on ancient nis (expired with Breezy).", " - debian/libpam-runtime.postinst: check for ancient pam (expired with", " Breezy).", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu1", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 43169, 14505, 80431 ], "author": "Kees Cook ", "date": "Wed, 05 Sep 2007 15:18:36 -0700" }, { "cves": [], "log": [ "", " * libpam0g.postinst, libpam0g.templates: gdm doesn't need to be restarted", " to fix the library skew, only reloaded; special-case this daemon in the", " postinst and remove the mention of it from the debconf template, also", " tightening the language of the debconf template in the process.", " Closes: #440074.", " * Add courier-authdaemon to the list of services that need to be", " restarted; thanks to Micah Anderson for reporting.", " * New patch pam_env_ignore_garbage.patch: fix pam_env to really skip over", " garbage lines in /etc/environment and log an error, instead of failing", " with an obscure error; and ignore any PAM_BAD_ITEM values returned", " by pam_putenv(), since this is the expected error return when trying", " to delete a non-existent var. Closes: #439984.", " * Yet another thinko in hurd_no_setfsuid and in", " 029_pam_limits_capabilities; this code should really be Hurd-safe at", " last...", " * getline() returns -1 on EOF, not 0; check this appropriately, to fix", " an infinite loop in pam_rhosts_auth. Thanks to Stephan Springl", " for the fix. Closes: #440019.", " * Use ${misc:Depends} for libpam0g, so we get a proper dependency on", " debconf.", " * 019_pam_listfile_quiet: per discussion with upstream, don't suppress", " errors about missing files or files with wrong permissions; these are", " real errors that should not be buried.", " * Drop the remainder of 061_pam_issue_double_free, not required for the", " original bugfix.", " * Drop patch 064_pam_unix_cracklib_dictpath, which is not needed now that", " we define CRACKLIB_DICTS in debian/rules.", " * Drop patch 063_paswd_segv, superseded by a different upstream fix", " * Split 047_pam_limits_chroot_string_value up between", " 008_modules_pam_limits_chroot and 029_pam_limits_capabilites", " * Updates to patch 007_modules_pam_unix: restore the same built-in min", " password len of 6 that upstream uses; fix a typo panlindrome ->", " palindrome.", " * The 'max=' option was never intended to be used to limit maximum password", " length for users, only to declare what the number of significant", " characters /is/ for a password. But we don't need a config option to", " tell us that, we know the answer based on which crypt type we're using,", " so drop this as a config file option. Closes: #389197.", " * Debconf translations:", " - Spanish, thanks to Javier Fernández-Sanguino Peña ", " - Vietnamese, thanks to Clytie Siddall ", " - German, thanks to Sven Joachim (closes: #440355)", " - Czech, thanks to Miroslav Kure ", " (closes: #440362)", " - Portuguese, thanks to Américo Monteiro ", " (closes: #440368)", "" ], "package": "pam", "version": "0.99.7.1-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 31 Aug 2007 17:11:05 -0700" }, { "cves": [], "log": [ "", " * New patch limits_wrong_strncpy: fix unnecessary manipulations of string", " buffers, including an illegal use of strncpy(). Thanks to Paul Hampson", " for reporting. Closes: #331278.", " * New patch misc_conv_allow_sigint.patch: allow SIGINT to be handled by the", " application, instead of blocking it when misc_conv is in use and", " preventing users from being able to ^C at any PAM prompt. Closes: #1708.", " * 024_debian_cracklib_dict_path: default to NULL instead of a specific", " dictionary path when none is defined for consistency with the new upstream", " version of cracklib, and define our path in debian/rules.", " * 055_pam_unix_nullok_secure: document the pam_unix \"nullok_secure\" option,", " a prereq for forwarding this patch upstream. Closes: #325974.", " * Create /etc/security/opasswd on new installs or on upgrades from", " 0.99.7.1-2 or below, so that users that enable the remember= option to", " pam_unix aren't left unable to change passwords. Closes: #95324.", " * Fix a couple of thinkos in hurd_no_setfsuid, that were preventing the code", " from compiling on the Hurd still. Thanks to Michael Banck for the catch.", " * Fix a memory leak in the pam_limits capabilities patch: always", " cap_free() the cap_t before returning from pam_sm_open_session().", " Closes: #153157.", " * libpam0g.postinst, libpam0g.templates: on upgrades from versions", " prior to 0.99.7.1-3, restart known PAM-using services so that they", " get the new libpam symbols, since otherwise the newer PAM modules", " will fail to load. Postinst taken from libssl0.9.8; thanks to", " Christoph Martin for the fine example! Closes: #439835.", " * Build-depend on po-debconf to support l10n of the debconf questions", " from the above.", "" ], "package": "pam", "version": "0.99.7.1-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 28 Aug 2007 06:33:33 -0700" }, { "cves": [ { "cve": "CVE-2005-2977", "url": "https://ubuntu.com/security/CVE-2005-2977", "cve_description": "The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unix_chkpwd, which does not log failed guesses or delay its responses.", "cve_priority": "medium", "cve_public_date": "2005-11-01 12:47:00 UTC" } ], "log": [ "", " * New upstream release; thanks to Roger Leigh and Jan Christoph Nordholz", " for their extensive work in helping to prepare for this update in Debian.", " Closes: #360460.", " - now uses autoconf for library detection, so SELinux should not be", " unconditionally enabled on non-Linux archs. Closes: #333141.", " - pam_mail notice handling has been completely reworked, so there should", " no longer be missing spaces in the messages. Closes: #119689.", " - with libtool and autoconf, now behaves \"sensibly\" on unknown", " platforms. Closes: #165067.", " - the source now builds without warnings. Closes: #212165.", " - uses automake instead of hand-rolled makefiles with indentation", " bugs. Closes: #241661, #328084.", " - pam_mkhomedir now creates directories recursively as needed.", " Closes: #178225.", " - pam_listfile now supports being used as a session module too.", " Closes: #416665.", " - misspelled pam_userdb log message has been corrected. Closes: #305058.", " - the current pam_strerror manpage no longer mentions \"Unknown", " Linux-PAM error\". Closes: #220157.", " - the text documentation no longer uses ANSI bold sequences.", " Closes: #181451.", " - pam_localuser now supports being used as a session module.", " Closes: #412484.", " - package no longer fails to build with dash as /bin/sh.", " Closes: #331208.", " - All modules should now be documented in the system administrator", " guide. Closes: #350620.", " - pam_userdb now logs an error instead of segfaulting when no db=", " option is provided. Closes: #436005.", " - pam_time now warns on a missing tty instead of erroring out,", " making it possible to use the module with non-console services.", " Closes: #127931.", " - upstream changelog is now 'ChangeLog' instead of 'CHANGELOG'; install", " accordingly", " - bump the shlibs", " - the 'test.c' example no longer exists", " - add /usr/share/locale to libpam-runtime.", " - CVE-2005-2977: only uid=0 is allowed to invoke unix_chkpwd with an", " arbitrary username, and then only when SELinux is active.", " Closes: #336344.", " * Mark myself as primary maintainer as previously discussed with Sam, and", " add Roger as an uploader.", " * Refactor to use quilt.", " * Update to Standards-Version 3.7.2.", " * Drop unnecessary build-dependency on patch, which is", " build-essential (and no longer invoked directly).", " * Drop patches 002_debian_no_ldconfig_call, 010_pam_cplusplus,", " 018_man_fixes, 030_makefile_link_against_libpam,", " 037_pam_issue_ttyname_can_be_null, 044_configure_supports_bsd,", " 050_configure_in_gnu and 052_pam_unix_no_openlog, which have been", " superseded upstream.", " * Drop patches 005_pam_limits_099_6,", " 012_pam_group_less_restrictive_charset, 023_pam_env_limits_miscfixes,", " 048_pam_group_colon_valid_char, 058_pam_env_enable, 059_pam_userdb_segv,", " 060_pam_tally_segv and 062_c++_safe_headers, which have been integrated", " upstream.", " * Patch 057: SELinux support is merged upstream, leaving only an", " unrelated OOM check for pam_unix_passwd. Rename as", " 057_pam_unix_passwd_OOM_check.", " * Patches 006, 008, 036: update for the switch from SGML to XML.", " * Patch 007: update for the switch from SGML to XML; drop some log", " messages that were already added upstream; update for the pam_modutil", " changes; tighten the flag handling of the 'obscure' option; drop bogus", " check in unix_chkpwd for null passwords. Also fix a grammar error", " along the way. Closes: #362855.", " * Patch 024: CRACKLIB_DICTPATH is no longer set in configure.in, so patch", " pam_cracklib.c instead to use the default dictpath already available", " from crack.h; and patch configure.in to use AC_CHECK_HEADERS instead", " of AC_CHECK_HEADER, so crack.h is actually included. Also remove", " unnecessary string copies, which break on the Hurd due to PATH_MAX.", " * Patch 038: partially merged/superseded upstream; also add new Hurd", " fix for pam_xauth.", " * Patch 061: partially merged upstream", " * Use ${binary:Version} instead of ${Source-Version} in", " debian/control.", " * Remove empty maintainer scripts debian/libpam0g-dev.{postinst,prerm},", " debian/libpam0g.{postinst,prerm}, and", " debian/libpam-modules.{postinst,prerm}; debhelper can autogenerate these", " just fine without our help.", " * Build-Depend on xsltproc, libxml2-utils, docbook-xml, docbook-xsl", " and w3m instead of on linuxdoc-tools, linuxdoc-tools-latex, tetex-extra,", " groff, and opensp.", " * Also build-depend on flex for libfl.a.", " * Updates for documentation handling:", " - move debian/local/pam-*-guide to debian/libpam-doc.doc-base.foo-guide,", " and invoke dh_installdocs instead of installing these by hand.", " - drop libpam-doc.{postinst,prerm}, which are no longer needed.", " - add an install target to debian/rules, and have binary-indep depend on", " it instead of trying to install doc files individually from the source", " tree", " - consequently, drop libpam-doc.dirs as well which is no longer needed", " and no longer accurate", " - add debian/libpam-doc.install for moving the docs to the right place,", " and also replace libpam-runtime.files with libpam-runtime.install;", " for the moment this means we're using both dh_movefiles and", " dh_install...", " - libpam0g.docs: install the Debian-PAM-MiniPolicy from here, further", " cleaning up debian/rules", " * Drop debian/libpam0g.links, no longer needed because upstream now has a", " working install target which creates the library symlinks", " * Add libpam-modules.links: create pam_unix_{acct,auth,passwd,session}.so", " symlinks by hand, no longer provided upstream.", " * debian/patches-applied/PAM-manpage-section: \"PAM\" is not a daemon, manpage", " belongs in section 7, not in section 8.", " * Actually ship the pam, pam.conf, and pam.d manpages in libpam-runtime.", " * debian/patches-applied/autoconf.patch: move all changes to autotools", " generated files into a single patch at the end of the stack.", " - don't touch configure in debian/rules, the quilt patch takes care", " of this for us.", " * New patch 064_pam_unix_cracklib_dictpath: correctly define", " CRACKLIB_DICTS, since this is not defined by configure. Thanks to Jan", " Christoph Nordholz.", " * New patch 065_pam_unix_cracklib_disable: Debian-specific patch to disable", " cracklib support in pam_unix. Thanks to Christoph Nordholz.", " * debian/rules:", " - Rename OS_CFLAGS to CFLAGS.", " - kill off references to unused variables", " - make binary-arch also depend on the install target, and streamline the", " rules", " - fix up the clean target to not ignore errors; thanks to Roger Leigh", " - drop the local module_check target in favor of using -Wl,-z,defs", " in LDFLAGS to enforce correct linkage of all objects at build time", " * Drop debian/local/unix_chkpwd.8 in favor of the upstream manpage.", " * libpam-modules.files: /usr/sbin/pam_tally has moved to /sbin/pam_tally", " for consistency.", " * Update to debhelper V5.", " * Don't ship Makefiles as part of the libpam0g-dev examples.", " * libpam-modules.manpages, libpam-runtime.manpages, libpam0g-dev.manpages:", " put all the manpages in the correct packages. Closes: #411812,", " #62193, #313486, #300773, #330545, #184270.", " * Drop libpam{0g,0g-dev,-modules,-runtime}.dirs, not needed for anything", " because we aren't trying to ship empty directories in the packages", " * Build-Conflict with fop, to avoid unreproducible builds of pdf", " documentation from a tool in contrib.", " * libpam-cracklib should depend on a real wordlist package, per policy;", " use wamerican as the default.", " * Drop local/pam-undocumented.7 from the package, since we no longer have", " a reason to ship it", " * Add lintian overrides for known false-positives", " * Conflicts/Replaces/Provides libpam-umask, now included upstream.", " Closes: #436222.", " * Upstream no longer marks unix_chkpwd suid-root for us, so set the perms", " by hand in debian/rules. In the process, unix_chkpwd is now writable", " by the owner, as expected by policy. Closes: #368100.", " * Migrate from db4.3 to db4.6; once again, no administrator action should", " be needed for upgrading on-disk database formats. Closes: #354309.", " * Add XS-Vcs-Svn and XS-Vcs-Browser fields to debian/control; thanks to", " Laurent Bigonville for the hint. Closes: #439038.", " * Add a watch file for use with uscan; thanks to Laurent Bigonville for", " this patch as well. Closes: #439040.", " * Rewrite of 031_pam_include, fixing a memory leak and letting us drop", " patch 056_no_label_at_end; thanks to Jan Christoph Nordholz", " for this much-improved version!", " * New patch no_pthread_mutexes: don't use pthread mutexes in", " pam_modutil functions, they're not needed because pam handles", " themselves should not be used concurrently by multiple threads and", " using pthreads causes problems for portable linking.", " * New patch hurd_no_setfsuid: if we don't have sys/fsuid.h, work around", " using setreuid instead.", "" ], "package": "pam", "version": "0.99.7.1-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 26 Aug 2007 19:15:09 -0700" }, { "cves": [], "log": [ "", " * Remove /usr/bin/X11 from default PATH (new installs only).", "" ], "package": "pam", "version": "0.79-4ubuntu2", "urgency": "low", "distributions": "feisty", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Wed, 20 Dec 2006 16:14:37 +0000" }, { "cves": [], "log": [ "", " * Resynchronise with Debian. Remaining changes:", " - Patch 100 (renumbered from 060): Look at ~/.pam_environment too, with", " the same format as /etc/security/pam_env.conf.", " - Patch 101 (renumbered from 061): Explicitly initialise RLIMIT_NICE", " rather than relying on the kernel limits. Bound RLIMIT_NICE from below", " as well as from above. Fix off-by-one error when converting", " RLIMIT_NICE to the range of values used by the kernel.", " - Add PATH to /etc/environment if it's not present there or in", " /etc/security/pam_env.conf.", " - debian/rules: Fix a bashism.", " - Install unix_chkpwd setgid shadow instead of setuid root. The nis", " package handles overriding this as necessary.", " - Use pam_foreground in the default session.", " - Linux-PAM/libpamc/test/regress/test.libpamc.c: Use standard u_int8_t", " type rather than __u8.", "" ], "package": "pam", "version": "0.79-4ubuntu1", "urgency": "low", "distributions": "feisty", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 19 Dec 2006 10:32:47 +0000" }, { "cves": [], "log": [ "", " * Medium-urgency upload; at least one RC bugfix, but also a", " significant number of changes, hence not urgency=high.", " * Move libpam-modules and libpam0g to Section: libs and libpam-runtime", " to section: admin, to match the overrides in the archive.", " * Move old changelog entries (well, entry) that don't follow the current", " format to debian/changelog.old, since there's no way to figure out a", " timestamp for an 8-year-old upload, and this is the most effective", " way to clear a glut of lintian warnings.", " * Fix the formatting of the libpam-cracklib package description.", " * Patch 010: remove parts of the patch that aren't necessary for C++", " compatibility.", " * Patch 060: fix a segfault in pam_tally caused by misuse of", " pam_get_data(); already fixed upstream. Closes: #335273.", " * Patch 061: fix a double free in pam_issue, caused by overuse (and misuse)", " of strdup (similar to patch 059). Already fixed upstream.", " Closes: #327272.", " * Don't build-depend on libselinux1-dev and libcap-dev on kfreebsd archs.", " Closes: #352329.", " * Patch 005: sync pam_limits with upstream:", " - support \"-\" (unlimited) for all limit types except process priority.", " - support the additional aliases \"-1\", \"unlimited\", and \"infinity\" for", " clearing the limits; closes: #122400, #149027.", " - restrict the range of process priority, login count, and system login", " count settings to (INT_MIN,INT_MAX) (heh).", " - special-case RLIM_INFINITY when applying multipliers to values from", " the config.", " - document maxsyslogins in the default limits.conf; closes: #149883.", " - use the current process priority as a default instead of resetting to", " 0; closes: #241663.", " - add support for (and document) new RLIMIT_NICE and RLIMIT_RTPRIO", " settings in Linux 2.6.12 and above; closes: #313542, #313588.", " - allow imposing limits on uid=0.", " * Patch 027: only set RLIM_INFINITY as the default for the limits where", " we know this is sensible, so that recompiling in an environment with new", " limits doesn't create a security hole -- as happened with RLIMIT_NICE and", " RLIMIT_RTPRIO! Thanks to Ville Hallik for the initial patch.", " Closes: #388431.", " * Patch 029, 047: Fix up the broken pam_limits capabilities patch so it", " actually works -- which may well be a first... Closes: #318452.", "" ], "package": "pam", "version": "0.79-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 23 Oct 2006 05:36:08 -0700" }, { "cves": [], "log": [ "", " * Non-maintainer upload to fix important bug, that makes passwd segfault", " when CTRL-D is pressed at the password prompt. Applied the patch", " provided by Dann Frazier. (Closes: #360657)", "" ], "package": "pam", "version": "0.79-3.2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Margarita Manterola ", "date": "Sat, 5 Aug 2006 02:11:22 -0300" }, { "cves": [], "log": [ "", " * Resynchronise with Debian.", "" ], "package": "pam", "version": "0.79-3.1ubuntu1", "urgency": "low", "distributions": "edgy", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 29 Jun 2006 17:27:34 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Linux-PAM/libpamc/include/security/pam_client.h,", " Linux-PAM/libpamc/pamc_converse.c: Apply patch from", " latest upstream version to remove redefinition of internal", " glibc/libstdc++ types. Closes: #344447.", "" ], "package": "pam", "version": "0.79-3.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Roger Leigh ", "date": "Sun, 5 Feb 2006 21:46:59 +0000" }, { "cves": [], "log": [ "", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: Protect use of", " RLIMIT_NICE in init_limits() with an #ifdef.", "" ], "package": "pam", "version": "0.79-3ubuntu14", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Fri, 12 May 2006 17:42:40 +0100" }, { "cves": [], "log": [ "", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: Set soft and hard", " nice limits to 20 (= userland nice value 0) rather than unlimited by", " default. Correct off-by-one error (the same error as in Linux 2.6.12,", " but fixed in 2.6.13) in user<->kernel translation of nice limit.", "" ], "package": "pam", "version": "0.79-3ubuntu13", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 11 May 2006 11:29:58 +0100" }, { "cves": [], "log": [ "", " * debian/control: Add libpam-foreground dependency to libpam-runtime, since", " the default /etc/pam.d/common-session refers to it. Closes: LP#35142", "" ], "package": "pam", "version": "0.79-3ubuntu12", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Mon, 10 Apr 2006 14:42:40 +0200" }, { "cves": [], "log": [ "", " [ Dana Olson ]", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: removed glibc", " workaround now that glibc is aware of rlimits.", "", " [ Martin Pitt ]", " * debian/rules: Fix bashisms.", "" ], "package": "pam", "version": "0.79-3ubuntu11", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Thu, 6 Apr 2006 15:03:37 +0200" }, { "cves": [], "log": [ "", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: Support \"nice\" and", " \"rtprio\" rlimits, new in Linux 2.6.12. Backported from upstream thanks", " to Dana Olson and others (closes: Malone #17348).", "" ], "package": "pam", "version": "0.79-3ubuntu10", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 23 Feb 2006 16:22:12 +0000" }, { "cves": [], "log": [ "", " * Fix operator precedence in libpam-modules.postinst.", "" ], "package": "pam", "version": "0.79-3ubuntu9", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 16 Feb 2006 15:23:04 +0000" }, { "cves": [], "log": [ "", " * Make pam_env be quiet if it can't find the user's configuration file,", " since it's optional.", "" ], "package": "pam", "version": "0.79-3ubuntu8", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Sat, 4 Feb 2006 16:44:12 +0100" }, { "cves": [], "log": [ "", " * Add the PATH on initial install for real this time.", "" ], "package": "pam", "version": "0.79-3ubuntu7", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Thu, 2 Feb 2006 20:33:42 +0100" }, { "cves": [], "log": [ "", " * Changes from Roger Leigh:", "", " * Linux-PAM/libpamc/include/security/pam_client.h,", " Linux-PAM/libpamc/pamc_converse.c: Apply patch from", " latest upstream version to remove redefinition of internal", " glibc/libstdc++ types. Closes: #344447.", " * Linux-PAM/libpamc/test/regress/test.libpamc.c: Also switch to standard", " types; not taken from upstream.", " " ], "package": "pam", "version": "0.79-3ubuntu6", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Reinhard Tartler ", "date": "Wed, 1 Feb 2006 13:14:24 +0000" }, { "cves": [], "log": [ "", " * Add pam_foreground to /etc/pam.d/common-session", "" ], "package": "pam", "version": "0.79-3ubuntu5", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Matthew Garrett ", "date": "Tue, 24 Jan 2006 02:26:19 +0000" }, { "cves": [], "log": [ "", " * Add PATH on initial install, too.", "" ], "package": "pam", "version": "0.79-3ubuntu4", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Mon, 23 Jan 2006 15:55:40 +0100" }, { "cves": [], "log": [ "", " * Add PATH to /etc/environment if it's not present there or in", " /etc/security/pam_env.conf and we are upgrading from a version which", " didn't add it.", "" ], "package": "pam", "version": "0.79-3ubuntu3", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Tue, 17 Jan 2006 15:54:01 +0100" }, { "cves": [], "log": [ "", " * Look at ~/.pam_environment too. Same format as", " /etc/security/pam_env.conf. The patch is recorded as", " patches-applied/060_pam_env_per_user", "" ], "package": "pam", "version": "0.79-3ubuntu2", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Tue, 17 Jan 2006 15:32:55 +0100" }, { "cves": [], "log": [ "", " * Resynchronise with Debian.", "" ], "package": "pam", "version": "0.79-3ubuntu1", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Mon, 21 Nov 2005 12:15:44 +0000" }, { "cves": [], "log": [ "", " * Patch 059", " - Fix a segfault in pam_userdb when the new \"crypt=\" option", " is unset, as will be the case for all existing users; already fixed", " upstream. Closes: #330829.", " - Fix a memory leak in the same code due to gratuitous strdup()s.", " * Further regression in pam_env: don't treat a missing /etc/environment", " as a fatal error, either. Amend patch 058 accordingly. Closes: #330852.", "" ], "package": "pam", "version": "0.79-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 30 Sep 2005 01:17:53 -0700" }, { "cves": [], "log": [ "", " The \".c.o: rm -rf $@\" release", " * Fix debian/rules so that make clean doesn't remove ./configure when the", " timestamp on configure.in is newer (!).", " * Switch pam_userdb from db3 to db4.3, which according to the libdb", " maintainers should require no manual intervention for upgrading on-disk", " database formats. Closes: #165068.", " * Patch 058: yes, of course we want to read /etc/environment by", " default. Grr! Revert upstream change which disables this for no", " apparent reason (closes: #330458).", " * Tweak selinux rootok code to use the version of the function call that", " doesn't pollute namespace", "" ], "package": "pam", "version": "0.79-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 27 Sep 2005 02:44:36 -0700" }, { "cves": [], "log": [ "", " * New upstream version (closes: #284954, #300775).", " - includes some fixes for typos (closes: #319026).", " - pam_unix should now be LSB 3.0-compliant (closes: #323982).", " - fixes segfaults in libpam on config file syntax errors", " (closes: #330097).", " * Drop patches 000_bootstrap, 004_libpam_makefile_static_works,", " 011_pam_access, 013_pam_filter_termio_to_termios, 017_misc_fixes,", " 025_pam_group_conffile_name, 028_pam_mail_delete_only_when_set,", " 033_use_gcc_not_ld, 034_pam_dispatch_ignore_PAM_IGNORE,", " 035_pam_unix_security, 039_pam_mkhomedir_no_maxpathlen_required,", " 041_call_bootstrap, 042_pam_mkhomedir_dest_not_source_for_errors,", " 051_32_bit_pam_lastlog_ll_time, and", " 053_pam_unix_user_known_returns_user_unknown which have been", " integrated upstream.", " * Merge one last bit of patch 053 into patch 043, where it should have", " been in the first place", " * Patch 057: SELinux support:", " - add support to pam_unix for copying SELinux security contexts when", " writing out new passwd/shadow files and creating lockfiles", " - support calling unix_chkpwd if opening /etc/shadow fails due to", " SELinux permissions", " - allow unix_chkpwd to authenticate for any user when in an SELinux", " context (hurray!); we depend on SELinux policies to prevent the", " helper's use as a brute force tool", " - also support querying user expiration info via unix_chkpwd", " - misc cleanup: clean up file descriptors when invoking unix_chkpwd", " (closes: #248310)", " - make pam_rootok check the SELinux passwd class permissions, not just", " the uid", " - add new pam_selinux module (closes: #249499)", " * Build-depend on libselinux1-dev.", " * Fix pam_getenv, so that it can read the actual format of /etc/environment", " instead of trying to read it using the syntax of", " /etc/security/pam_env.conf; thanks to Colin Watson for the patch.", " Closes: #327876.", " * Set LC_COLLATE=C when using alphabetic range expressions in", " debian/rules; bah, so *that's* what kept happening to my README file", " when trying to build out of svn! Closes: #295296.", " * Add a reference to the text of the GPL to debian/copyright.", "" ], "package": "pam", "version": "0.79-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 25 Sep 2005 22:08:20 -0700" }, { "cves": [], "log": [ "", " * Fix Gcc 3.4 compilation, Closes: #259634", " * Note that pam.conf is not read if /etc/pam.d exists, Closes: #248928", " * Fix typo in pam_env.conf, Closes: #277633", "" ], "package": "pam", "version": "0.76-23", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 10 Jul 2005 16:42:25 -0400" }, { "cves": [], "log": [ "", " * Fix pam_getenv, which never worked:", " - Parse /etc/security/pam_env.conf using its own syntax, and then", " /etc/environment using its own syntax rather than the syntax of", " /etc/security/pam_env.conf.", " - 'my $val' was used in an incorrect scope; fixed.", " - Exit non-zero if the requested environment variable is not found.", "" ], "package": "pam", "version": "0.76-22ubuntu3", "urgency": "low", "distributions": "breezy", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Mon, 12 Sep 2005 18:32:54 +0100" }, { "cves": [], "log": [ "", " * debian/rules: Install unix_chkpwd setgid shadow instead of setuid root.", " This only breaks when using NIS lookups, therefore the new nis package", " dpkg-statoverrides it back to setuid root while being installed.", " (Debian #155583, http://udu.wiki.ubuntu.com/ProactiveSecurityRoadmap)", " * debian/control: Added conflict to nis (<< 3.13-3ubuntu1): This is the", " version that corrects the permissions for usage with NIS.", "" ], "package": "pam", "version": "0.76-22ubuntu2", "urgency": "low", "distributions": "breezy", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Fri, 17 Jun 2005 12:34:23 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS with gcc-3.4 (closes: #259634). Ubuntu 9037.", "" ], "package": "pam", "version": "0.76-22ubuntu1", "urgency": "low", "distributions": "breezy", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Wed, 4 May 2005 18:14:51 +0200" }, { "cves": [], "log": [ "", " * Add uploaders", " * Document location of repository", " * Fix options containing arguments in pam_unix, Closes: #254904", "" ], "package": "pam", "version": "0.76-22", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 28 Jun 2004 14:28:08 -0400" }, { "cves": [], "log": [ "", " * Fix patch 055 again because -20 was broken and didn't actually fix the", " problem.", "" ], "package": "pam", "version": "0.76-21", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 4 May 2004 21:37:38 -0400" }, { "cves": [], "log": [ "", " * Update to patch 55 to only check securetty when we are sure the", " password is null, Closes: #243698", " * Medium urgency because the version now in testing has confusing and", " verbose log messages.", " * Include pam_getenv script which hopefully will be used by some people", " somewhere for some purpose", "" ], "package": "pam", "version": "0.76-20", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 28 Apr 2004 22:51:18 -0400" }, { "cves": [], "log": [ "", " * Oops, too busy testing the upgrade from woody to make sure the upgrade", " from -16 to -18 worked. Thanks to all those who reported,", " Closes: #243413", "" ], "package": "pam", "version": "0.76-19", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 13 Apr 2004 16:08:54 -0400" }, { "cves": [], "log": [ "", " * Manipulate conffiles to avoid unnecessary prompt in woody to sarge", " upgrade, Closes: #218318", "" ], "package": "pam", "version": "0.76-18", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 10 Apr 2004 18:10:35 -0400" }, { "cves": [], "log": [ "", " * common-password now includes length restrictions and cracklib", " examples, Closes: #227681, #237537", " * Patch 054: abstract out the logic from pam_securetty to determine if a", " tty is in /etc/securetty into a library function", " * Patch 55: Add nullok_secure option to pam_unix. If set, then null", " passwords are accepted from terminals in /etc/securetty.", " * common-auth now includes nullok_secure, Closes: #228114", "", "" ], "package": "pam", "version": "0.76-17", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 4 Apr 2004 23:10:11 -0400" }, { "cves": [], "log": [ "", " * Patch 51 from the x86-64 folks to support 32-bit ll_time in", " pam_lastlog even if time_t is 64-bits", " * Don't call openlog in pam_unix (patch 52), Closes: #213566", " * Return PAM_USER_UNKNOWN for unknown users in pam_unix (patch 53), Closes: #204506", "" ], "package": "pam", "version": "0.76-16", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 23 Mar 2004 22:26:04 -0500" }, { "cves": [], "log": [ "", " * Fix description of libpam-runtime, Closes: #209755", " * Fix description of libpam-cracklib, Closes: #210014", " * Depend on libc6-dev|libc-dev not libc6-dev, Closes: #212354", " * Clean up binaries, Thanks Russell, Closes: #212158", " * Depend on sufficiently new cracklib2-dev, Closes: #214092", " * Treate GNU/* as GNU for OS variable to make pam_limits compile,", " (patch 050) Closes: #220980", " * No longer build-depend on latex2html, Closes: #221318", " * Allow : in tty specification for pam_group, (patch 048) Closes: #220439", " * Pull in locking patch from Linux-PAM CVS; this ended up causing", " 021_pam_nis_locking to be reworked and that patch now no longer", " contains locking fixes, but just NIS cleanup in general. See", " 049_pam_unix_sane_locking for the locking changes, Closes: #220158", "" ], "package": "pam", "version": "0.76-15", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 12 Jan 2004 02:23:59 -0500" }, { "cves": [], "log": [ "", " * Pull in NMU diff from 13.1, Closes: #186011", " * Split out common-password into its own file, Closes: #207497", " * Make other a conffile again and update to @include stuff", " * Add missing symlink, Closes: #196605", " * Remove undocumented manpages", " * Update PAM mini-policy", "" ], "package": "pam", "version": "0.76-14", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 1 Sep 2003 18:08:54 -0400" }, { "cves": [], "log": [ "", " * NMU with maintainer's permission.", " * Add three new config files (/etc/pam.d/common-{auth,account,session})", " to libpam-runtime. Other packages which depend on libpam-runtime", " can now @include these files from their own PAM configs.", " * Convert /etc/pam.d/other from a conffile to a non-conffile config", " file. Closes: #186011.", " * Remove empty libpam-runtime.prerm script (debhelper will autocreate if needed)", "" ], "package": "pam", "version": "0.76-13.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 19 Aug 2003 19:41:03 -0500" }, { "cves": [], "log": [ "", " * Nope, that dependency didn't work, so let's remove it. If we run into other module versioning issues, I now have an arm build environment to debug with. Closes: #198618", "" ], "package": "pam", "version": "0.76-13", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 7 Jul 2003 00:22:34 -0400" }, { "cves": [], "log": [ "", " * Fix group.conf example, (patch 046) Closes: #197080", " * Ignore module return value in jumps, (patch 045) Closes: #176693", " * Accept string value for chroot limit, thanks Andrei Pelinescu-Onciul,", " Patch (047), Closes: #196903", " * Depend on libpam-modules instead of conflicting with older versions.", " This creates a circular dependency between libpam0g and", " libpam-modules. James says this works fine; we hope he's right.", " Closes: #196949" ], "package": "pam", "version": "0.76-12", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 21 Jun 2003 17:19:29 -0400" }, { "cves": [], "log": [ "", " * Don't allow db4 to satisfy build-depends because it doesn't actually", " work, and sometimes building with it would be wrong.", " * Don't depend on libpcap-dev on Debian BSD", " * Conflict with old libpam-modules, Closes: #191906", " * Incorrect username should not be logged at alert (patch 43),", " Closes: #175900", " * Patch to support FreeBSD (patch 44, thanks Robert), Closes: #191906", "" ], "package": "pam", "version": "0.76-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 31 May 2003 19:55:26 -0400" }, { "cves": [], "log": [ "", " * Don't double list conffiles, Closes: #190954", " * Only install example sources not executables, Closes: #185286", " * Display correct directory in error message for pam_mkhomedir, patch", " 042 thanks to Akira TAGOH, Closes: #165240", " * Don't log EPERM when setting NOFILE limit as Linux doesn't let you", " set that to -1, Closes: #180310", " * Add newline to end of distributed time.conf, Closes: #172229", " * Up our standards version and support noopt in DEB_BUILD_OPTIONS", "" ], "package": "pam", "version": "0.76-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 3 May 2003 22:28:37 -0400" }, { "cves": [], "log": [ "", " * Fix pam_rhosts hurd patch so it actually works, Closes: #172914", " * Fix patch 040 not to clobber errno when logging the error fails,", " Closes: #172186", " * Fix dependency for linuxdoc-tools, Closes: #173097", "" ], "package": "pam", "version": "0.76-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 15 Dec 2002 17:10:58 -0500" }, { "cves": [], "log": [ "", " * Have makefile appropriately depend on bootstrap-libpam", " * Install pam minipolicy, Closes: #167798", " * Don't segfault if ttyname is null; this avoids the segfault but does", " not actually make pam_issue useful for ssh. I believe the way", " pam_issue works is fundamentally incompatible with what sshd expects", " from PAM (patch 037), Closes: #153152", " * We actually fixed passwords containing , in 0.76-6, but failed to", " document it. They do work, Closes: #164713", " * Note that /etc/pam.d/other is a fall back for each service", " * Patches from Michal 'hramrach' Suchanek\" to", " make HURD work, Closes: #165066 (patch 038 and 039)", " * Don't depend on gs and other doc prep tools for build-depends, just", " build-depends-indep, Closes: #165065", " * Patch from Eric Anderson to log failures of", " setrlimit (patch 040), Closes: #169836", " * Build pam_limits on hurd, Closes: #165190", "" ], "package": "pam", "version": "0.76-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 24 Nov 2002 22:04:28 -0500" }, { "cves": [], "log": [ "", " * Fix handling of pam_ignore in case where we're skipping modules;", " update to patch 034", "" ], "package": "pam", "version": "0.76-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 20 Oct 2002 21:49:22 -0400" }, { "cves": [], "log": [ "", " * The \"No, I don't think I actually want any of what upstream is", " smoking\" release", " * If this were already in testing, this would be an severity emergency", " upload", " * pam_unix currently treats * in shadow file as no password not", " disabled; major security issue; fixed in upstream CVS, (patch 035) Closes: #164659", " * OK, I think this actually fixes the rest of the manpage symlinks,", " Closes: #163839, #164298", " * You don't want to use getlogin for pam_wheel because utmp may be wrong or for xterm have no entry, pull forward patch from the 0.72 packages (patch 036), Closes: #163787", "" ], "package": "pam", "version": "0.76-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 15 Oct 2002 10:44:56 -0400" }, { "cves": [], "log": [ "", " * Fix library links from 0.75 to 0.76", " * Ignore PAM_IGNORE in _pam_dispatch_aux (patch 34), Closes: #163841", " * Fix man page symlinks, Closes: #163839", "" ], "package": "pam", "version": "0.76-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 11 Oct 2002 01:08:06 -0400" }, { "cves": [], "log": [ "", " * Upstream correctly states that one should use gcc not ld when", " linking and then hapilly proceeds to actually use ld, fixed, Closes: #163711", "", " * Remove experimental warning from readme, Closes: 163742", "" ], "package": "pam", "version": "0.76-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 7 Oct 2002 23:45:53 -0400" }, { "cves": [], "log": [ "", " * Oops, let's try building -fpic. This currently builds everything", " -fpic which is somewhat wrong, but doing more than that requires", " significant build system hacking (touch every makefile for dynamic", " objects), so it will wait, Closes: #163600", "" ], "package": "pam", "version": "0.76-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 6 Oct 2002 23:33:12 -0400" }, { "cves": [], "log": [ "", " * Link against appropriate libraries so we find the symbols we need,", " Closes: #162175", " * The if everyone's going to complain when I upload broken software to", " experimental release, I might as well upload to unstable and give them", " something worth actually complaining about release.", " * Also the remove the scourge of dbs release", " * Include patch 034 from the 0.72 packages, meaning that we've included", " all the patches we need before release", " * Reject the patch to pam_wheel as I cannot find out what reasonable", " thing it was trying to do and it seemed broken", " * libpam-cracklib should depend on wordlist so it actually works;", " thanks Olaf Meeuwissen,", " Closes: #112965", " * Merge build-depends and build-depends-indep because I'm a bad person", " and was too lazy to make docs build in a separate pass. I'll deal in", " a few versions.", "" ], "package": "pam", "version": "0.76-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 6 Oct 2002 18:52:13 -0400" }, { "cves": [], "log": [ "", " * New upstream version", " * Upstream includes fix to not break cron, Closes: 160566", " * New Upstream correctly handles priority < 0 for pam_limits, Closes: #126251", " * .cvsignores removed, Closes: #159961", "" ], "package": "pam", "version": "0.76-1", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 22 Sep 2002 16:11:35 -0400" }, { "cves": [], "log": [ "", " * Apply patch 027 pam_limits so that we initialize to wide open not", " current limits.", " * In pam_mail, don't complain about deleting environment variable if", " we never set it, Closes: #58429", " * Don't set default max procs limit in pam_limits, Closes: #116874", " * libpam-runtime now arch all since it has no arch-specific files,", " Closes: #132545", " * Update mini policy to reflect confusion on debian-devel", "" ], "package": "pam", "version": "0.75-3", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 16 Jul 2002 09:30:50 -0400" }, { "cves": [], "log": [ "", " * Fix pam_userdb to build and to build against db3, fixes patch 020", " * Fix upstream makefile so pam_group has valid configuration, closes: #148657", " * time.conf reference to logoutd removed, closes: #143801", " * The static library contains all the appropriate symbols in this", " version. You may find the complete lack of PAM modules somewhat", " frustrating; currently the static pam library is only useful if you", " register your own modules. Fixing this would require annoying hacking", " on the upstream build system, closes: #103495", " * unix_chkpwd.8 typo fixes thanks to dancer@anthill.echidna.id.au,", " Closes: #139949", " * Since we're working on the new upstream version, we also have the new docs, closes: #147763", " * Patch from Martin Schwenke to only change", " passwords in pam_unix when they exist in the password file; hopefully", " does not break NIS, closes: #135990", " * Another patch from Martin to return PAM_USER_UNKNOWN if we ever", " actually do get into the password changing routine only to find that", " we have no password to change, closes: #135604", " * .cvsignore no longer installed, closes: #120795", " * We're using debhelper 3, just in time to be obselete, Closes: #93414", "" ], "package": "pam", "version": "0.75-2", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 8 Jun 2002 18:04:40 -0400" }, { "cves": [], "log": [ "", " * Preliminary test packages", " * New upstream version", " * Hopefully works mostly the same as 0.72 except for upstream bug", " fixes and for the fact that pam_limits is fairly broken right now.", " * If it breaks you are lucky if you get to keep both pieces release.", "" ], "package": "pam", "version": "0.75-1", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 25 May 2002 22:57:57 -0400" }, { "cves": [], "log": [ "", " * Fix like_auth to make libpam-krb5 and libpam-heimdal actually useful,", " patch from RISKO Gergely , closes: #126251", "" ], "package": "pam", "version": "0.72-35", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 21 Jan 2002 15:20:22 -0500" }, { "cves": [], "log": [ "", " * Note that HOME may not be useful in pam_environment, closes: #109281", " * Don't smash case domains (groups/users) in pam_limits, closes: #119893", " * Remove double the from description, closes: #107705", " * Fix typo on mail message, closes: #119689", " * Medium since these are small fixes that should go into woody", "" ], "package": "pam", "version": "0.72-34", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 23 Nov 2001 21:24:20 -0500" }, { "cves": [], "log": [ "", " * Fix pam_mail to look in /var/mail not /var/spool/mail, thanks mjb.", "" ], "package": "pam", "version": "0.72-33", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 11 Oct 2001 15:44:32 -0400" }, { "cves": [], "log": [ "", " * This should probably get into testing before freeze; medium.", " * Patch from Volker Stolz to fix bug in previous pam_group patch,", " closes: #111854", "" ], "package": "pam", "version": "0.72-32", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 22 Sep 2001 06:32:29 -0400" }, { "cves": [], "log": [ "", " * Add support for credential reinitialization in pam_group, closes: #108697", "" ], "package": "pam", "version": "0.72-31", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 31 Aug 2001 13:16:39 -0400" }, { "cves": [], "log": [ "", " * Include patch from robbe@orcus.priv.at to build pam_limits on hurd,", " closes: #103556", " * Start installing limits.conf for hurd (may not work quite right)", "" ], "package": "pam", "version": "0.72-30", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 16 Jul 2001 09:35:51 -0400" }, { "cves": [], "log": [ "", " * Correctly declare uint32 type for ia64, closes: #104584", "" ], "package": "pam", "version": "0.72-29", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 14 Jul 2001 01:30:39 -0400" }, { "cves": [], "log": [ "", " * Fix scanf string so pam_limits chroot works, closes: #100812", " * Only log unknown user at warning, not alert, closes: #95220", " * By default do complete matches not substring matches for pam_time.", " You can include explicit wildcard for substring, closes: #66152", "" ], "package": "pam", "version": "0.72-28", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 3 Jul 2001 17:31:45 -0400" }, { "cves": [], "log": [ "", " * Fix typo in last patch", "" ], "package": "pam", "version": "0.72-27", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 25 Jun 2001 18:27:42 -0400" }, { "cves": [], "log": [ "", " * Block SIGCHLD when calling unix password verification program, patch from mdz@debian.org, fixes pam part of #97977", "" ], "package": "pam", "version": "0.72-26", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 25 Jun 2001 08:47:12 -0400" }, { "cves": [], "log": [ "", " * Depend on opensp, working around #89063, closes: #100125", " * This is urgency medium to get docs back into testing.", "" ], "package": "pam", "version": "0.72-25", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 8 Jun 2001 11:44:12 -0400" }, { "cves": [], "log": [ "", " * New NIS double locking and root password patch from Philippe Troin", " , fixes bug in unreleased patch submitted for", " 0.72-23. Also improves changing root password so it does something;", " ongoing discussion on whether this is right.", "" ], "package": "pam", "version": "0.72-24", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 21 May 2001 08:06:05 -0400" }, { "cves": [], "log": [ "", " * Patch from Benoit Gaussen , Don't trim from , to end", " of string in user input, only trim from salt", " grabbed from passwd file, closes: #96779", " * Fix NIS double locking, closes: #96736", "" ], "package": "pam", "version": "0.72-23", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 16 May 2001 15:46:34 -0400" }, { "cves": [], "log": [ "", " * Fix pam.8 to be pam.7, closes: #92874", "" ], "package": "pam", "version": "0.72-22", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 17 Apr 2001 23:04:04 -0400" }, { "cves": [], "log": [ "", " * Don't depend on libcap for hurd, closes: #91998", " * Don't list scurity/limits.conf as a conffile for hurd", "" ], "package": "pam", "version": "0.72-21", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 9 Apr 2001 12:30:18 -0400" }, { "cves": [], "log": [ "", " * Install pam-undocumented in -runtime not -dev, closes: #93063", " * Mark pam-runtime as replacing files from -dev in case you installed", " -19 and have pam-undocumented in the wrong place", "" ], "package": "pam", "version": "0.72-20", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 6 Apr 2001 06:38:15 -0400" }, { "cves": [], "log": [ "", " * New maintainer, closes: #92353", " * Install pam-undocumented; somehow it was not installed in -18", "" ], "package": "pam", "version": "0.72-19", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 4 Apr 2001 21:32:17 -0400" }, { "cves": [], "log": [ "", " * pam_securetty: log failed tty checks. Normally this was only done if", " the \"debug\" option was on...do it regardless now, closes: #89390", " * Get rid of log message for when \"root\" is not applied to group checks.", " closes: #88825", " * Add quiet option to pam_listfile, closes: #84428", " * pam(8) should be pam(7), pam.conf(8) should be pam.conf(5), closes:", " #89322", " * Added groff to Build-Depends-Indep, closes: #88794", "" ], "package": "pam", "version": "0.72-18", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 25 Mar 2001 21:40:32 -0500" }, { "cves": [], "log": [ "", " * Fixed login in pam_limits where the max logins could be ignored.", "" ], "package": "pam", "version": "0.72-17", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 9 Mar 2001 09:14:48 -0500" }, { "cves": [], "log": [ "", " * New pam limits cap patch from Topi Miettinen", " , closes: #88401, #88406, #88525, #88399,", " #86197", " * pwdb no longer used, closes: #59917", " * fix patch 023 for gethostbyname build failure, closes: #86156", " * Make sure unix_chkpwd gets installed as suid root, closes: #88519", " * Fix whatis parse of manpages, closes: #86203", " * pam_listfile, fix arg parsing when arg does not contain '=', closes:", " #86070", "" ], "package": "pam", "version": "0.72-16", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 4 Mar 2001 22:45:58 -0500" }, { "cves": [], "log": [ "", " * Doh, added build-depends for libcap, closes: #85352", " * Change section of libpam-cracklib from admin to libs to match", " overrides.", "" ], "package": "pam", "version": "0.72-15", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 9 Feb 2001 09:06:40 -0500" }, { "cves": [], "log": [ "", " * Added fix to pam_access for gethostname decleration. closes: #82100", " * Just name the lib/security directory instead of all the modules", " seperately for dh_movefiles. closes: #76119", " * Fix pam_env corruption, closes: #66849, #77229", " * Add patch to allow recursive /etc/skel copy in pam_mkhomedir, closes:", " #67211", " * remove dh_suidregister call, added conflict for old suidregister", " package", " * Applied patch for Linux capabilities in pam_limits, closes: #74176", " * pam_issue.so works for me, without segv, and even with escapes. This", " is with login. Note, things like pam_issue do not work with ssh simply", " because ssh is not able to work in that way (does not support", " arbiitrary conversations). So if you want it to work there, file a bug", " on ssh, not on libpam-modules. closes: #77228", " * unix_chkpwd: check for NULL password, closes: #69960", "" ], "package": "pam", "version": "0.72-14", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 8 Feb 2001 11:06:03 -0500" }, { "cves": [], "log": [ "", " * Fix grammar in pam_source.sgml, closes: #78959", " * pam_undocumented.7: Fix escaped 's, closes: #75987", " * Fix build ordering, closes: #71442, #80397, #77017", " * Applied Hurd patch, closes: #76119", " * Use gcc for linking, not ld. closes: #71941", " * Pretty sure this was fixed, closes: #67172", " * Applied spealang fixes to Debian-mini-policy. closes: #80249", " * Applied patch to allow devfs style terminal devices with pam_group,", " closes: #77661", " * Could not reproduce, even using md5 passwords. User, if you still have", " * this problem, you need to tell me with what service (login, which I", " tested, sshd, telnet, etc...) and also send me the entire pam.d file", " for that service. closes: #76087", " * Fixed awhile back, closes: #72858", " * Closing this since I am not going to include any modules in this", " package that aren't in upstream. If someone else wants to package", " these modules seperately, they can do so. closes: #69550", " * For correct usage, pam_wheel.so should be used with \"sufficient\" and", " not \"required\". This is documented. If you use \"required\", then you", " must also use the \"trust\" option, but that doesn't give you the", " results you want. closes: #76236", "" ], "package": "pam", "version": "0.72-13", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 31 Dec 2000 05:38:23 -0500" }, { "cves": [], "log": [ "", " * Recompile against db2 for glibc change", " * Add db2 to build-deps", "" ], "package": "pam", "version": "0.72-12", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 27 Sep 2000 12:08:11 -0400" }, { "cves": [], "log": [ "", " * Removed all traces of pwdb in packages. libpwdb has been removed from", " the archive. This means that the pam_pwdb and pam_radius modules are", " no longer available (from the libpam-pwdb package).", " * doc/modules/pam_wheel.sgml: Really spell out that being a member of a", " group meands the user is listed in /etc/group, closes: #69242", " * doc/*: s/PAM_AUTHOK_RECOVERY_ERR/PAM_AUTHOK_RECOVER_ERR/g,", " closes: #64473", " * pam_wheel: PAM does not distinguish it, the libc calls make the", " distinction. The users gid is returned in their passwd info, while", " getgrent() returns only the members of the group listed in /etc/group.", " This is ok, because if it's really that important, you can actually", " have it in both places. The fact that it's documented should suffice", " in making this clear, closes: #69236", " * Sorry, but seperate modules generally need to be packaged seperately.", " I don't want to overload this package with everyone's pet module, so I", " have to put my foot down, closes: #61759", " * Actually, I'm going to move in Woody to make packages depend more on", " the defaults in /etc/pam.d/other, so that admins have less to", " maintain. For one, all packages should not have a password service", " listed, closes: #70000 (YAY! I got the 70k rollover bug number!)", " * Sorry, I can't include this. \",\" is a legitimate char in a password", " salt/hash. If you can code up something that is super intelligent", " about lenghts of the field, I can go for it, maybe, closes: #59459", " * modules/pam_limits: Added chroot feature patch, closes: #61090", " * modules/pam_access: Allow last field to contain ':', closes: #67291", " * modules/pam_limits: Allow explicit limits for root, closes: #62448", " * modules/pam_unix: Do not zero old/new password fields, libpam does", " this itself, and doing so in the module breaks stacking,", " closes: #66270", " * modules/pam_group: Allow alpha *and* numeric in tty field (duh),", " closes: #63752", " * modules/pam_access: Enable NIS, closes: #64854", " * libpam0g-dbg: removed, useless anyway", "" ], "package": "pam", "version": "0.72-11", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 30 Aug 2000 18:39:32 -0400" }, { "cves": [], "log": [ "", " * Update build depends", " * Fixed logic for showing non-existent user names when auth failed in", " pam_unix.so, closes: #67786 (thanks to Jim Breton for being patient in", " helping track this down). It would sometimes show them, even if we", " didn't want to.", "" ], "package": "pam", "version": "0.72-10", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 27 Jul 2000 09:17:08 -0400" }, { "cves": [], "log": [ "", " * pam_unix: do not call obscure_msg() of pass_old is NULL,", " closes: #65321", " * pam_access: check for from[0] == '\\0' so that tty logic is actually", " used, closes: #65401", "" ], "package": "pam", "version": "0.72-9", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 14 Jun 2000 11:38:35 -0400" }, { "cves": [], "log": [ "", " * Build depends added in previous version, closes: #60817, #61439", " * Allow use of \":0\" in group.conf, closes: #61966", " * Added syslog entry to notify that a user succesfully changed their", " password, closes: #61724", " * Make pam_unix compatible with HP-UX style NIS+ password information,", " patch from ldaffner@rsn.hp.com, closes: #61942", " * If \"audit\" is not enabled, don't let pam_unix print the names of", " unknown users for auth attempts, closes: #61942", " * Fixed ttyname() parsing in pam_access to match that of the old shadow", " access.conf s,/dev/,, closes: #61644", " * Set some sane defaults for pam_limits.so instead of carrying over", " potentially bad defaults, patch from Peter Paluch", " closes: #63230", " * Allow explicit (e.g. specified specifically for) limits for root,", " patch from Topi Miettinen , closes: #62448", " * Added information to time.conf about logoutd, which is now enabled via", " this file.", " * cracklib maintainer claims this isn't a bug, closes: #54180", " * fixed control syntax handling which was causing segfaults, closes: #62237", "" ], "package": "pam", "version": "0.72-8", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 29 Apr 2000 11:39:59 -0400" }, { "cves": [], "log": [ "", " * pam_limits: fix parsing of users which explicitly removes limits,", " closes: #59911, #60287", " * Added build-depends", "" ], "package": "pam", "version": "0.72-7", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 20 Mar 2000 16:06:28 -0500" }, { "cves": [], "log": [ "", " * Remove conflict for libpam0g-util from libpam0g and put it in", " libpam-runtime. This should fix a problem with upgrades that apt", " experiences, closes: #58677", "" ], "package": "pam", "version": "0.72-6", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 28 Feb 2000 14:05:28 -0500" }, { "cves": [], "log": [ "", " * Added obscure password checks to pam_unix. Required for shadow to be", " able to emulate the pre-PAM setup (referenced in a bug on passwd).", " * Applied patch from #57800 to fix NIS/NIS+ shadow accounting checks,", " closes: #57800, #58164", " * Fixed two typos in the PAM System Administrators Guide,", " closes: #56578, #56587", "" ], "package": "pam", "version": "0.72-5", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 28 Feb 2000 10:58:09 -0500" }, { "cves": [], "log": [ "", " * unix_chkpwd: check for NULL on stdin aswell as 0 reads, closes: #56375", " * pam_unix/Makefile: removed bashism, closes: #56370", " * fixed in shadow upload, closes: #49832", "" ], "package": "pam", "version": "0.72-4", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 29 Jan 2000 00:27:28 -0500" }, { "cves": [], "log": [ "", " * Added cpluplus wraps in all the headers, closes: #53653", "" ], "package": "pam", "version": "0.72-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 2 Jan 2000 15:15:40 -0500" }, { "cves": [], "log": [ "", " * Well, this is an odd one. A recompile fixes it. So it must have been a", " problem from linking with 0.71 when this is version 0.72. All of this", " build daemons seem to have compiled the latest 0.72, so this should be", " resolved after this gets recompiled on all of them, closes: #51619, #49584", " * This is from a very old version (0.56) of libpam0. It is not relevant", " to the latest version, closes: #47162", "" ], "package": "pam", "version": "0.72-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 26 Dec 1999 09:10:13 -0500" }, { "cves": [], "log": [ "", " * New upstream source release, lots of patches merged upstream (thanks", " Andrew).", " * libpam-doc: now provides pam-doc, closes: #45631", " * cleanups to the build system", " * shlibs.local: bumped shlib deps", "" ], "package": "pam", "version": "0.72-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 14 Dec 1999 11:17:36 -0500" }, { "cves": [], "log": [ "", " * Debian-PAM-MiniPolicy: new document describing how PAM is implemented", " in Debian", "" ], "package": "pam", "version": "0.71-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 26 Nov 1999 17:26:40 -0500" }, { "cves": [], "log": [ "", " * pam_listfile: lstat -> stat, closes: #49833", " * pam_tally: install the pam_tally program, closes: #50314", " * debian/control: libpam-modules, replaces libpam0g-util, closes: #50716", "" ], "package": "pam", "version": "0.71-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 25 Nov 1999 21:02:23 -0500" }, { "cves": [], "log": [ "", " * New upstream release, merges lots of patches from the Debian source,", " also merges the pam_{motd,mkhomedir,issue} modules into the main", " source. Lots of minor bugs fixed, and compiler warnings", " * pam_mail: Reimplemented the authentication handlers, so now this works", " as both (changes nothing in Debian, but was required to get the patch", " accepted upstream)", " * general: Lots of small edits to fix compiler warnings", " * pam_userdb: fixed potential usage of an unitialized value as", " PAM_AUTHTOK, doesn't look particularly exploitable, but better safe", " than sorry", "" ], "package": "pam", "version": "0.71-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 8 Nov 1999 19:21:52 -0500" }, { "cves": [], "log": [ "", " * pam_wheel/pam_wheel.c: change to use getpwuid(getuid()) by default, so", " avoid the problems associated with getlogin()", "" ], "package": "pam", "version": "0.70-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 1 Nov 1999 13:33:10 -0500" }, { "cves": [], "log": [ "", " * Applied patch from Herbert Xu to enable PAM_CONV_AGAIN support in", " pam_ftp, closes: #47288", "" ], "package": "pam", "version": "0.70-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 13 Oct 1999 13:25:21 -0400" }, { "cves": [], "log": [ "", " * 100_pam_pwdb_security_fix: new patch fixes security problem with", " regard to NIS accounts", "" ], "package": "pam", "version": "0.70-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 13 Oct 1999 11:42:41 -0400" }, { "cves": [], "log": [ "", " * New upstream release", " * Seems there were a lot of fixes merged/matches upstream, looks good,", " (maybe it's time I start sending my patches in, since the maintainer", " is active again).", " * libpamc: new library (libpam client library), this actually used to be", " in the Debian packages for a few versions, but it was removed upstream.", " Guess what, it's back :)", "" ], "package": "pam", "version": "0.70-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 10 Oct 1999 01:07:43 -0400" }, { "cves": [], "log": [ "", " * {pwdb,unix}_chkpwd.8: fixed format to get rid of \"no whatis\" warnings", " from mandb, closes: #47004", " * pam_unix.sgml: new file, documents the pam_unix.so module,", " closes: #46511", "" ], "package": "pam", "version": "0.69-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 9 Oct 1999 12:41:58 -0400" }, { "cves": [], "log": [ "", " * libpam/pam_item.c: fixed debug message being in wrong place", " * 013_pam_issue: new patch, provides issue file parsing for PAM", " applications (helps to replace lost functionality in login).", "" ], "package": "pam", "version": "0.69-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 6 Oct 1999 20:30:17 -0400" }, { "cves": [], "log": [ "", " * Fix typo in pam_mail.so module's \"no\" return", "" ], "package": "pam", "version": "0.69-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 3 Oct 1999 15:08:56 -0400" }, { "cves": [], "log": [ "", " * docs/modules/pam_mkhomedir.sgml: Fixed module name", " * changed build system structure", " * libpam/Makefile: add -lcrypt to the linked libs, closes: #46104", " * increase shlib deps to 0.69-7, closes: #45801", " * pam_motd.c: close motd file after reading, closes: #46122", " * pam_motd.c: fix setting \\0 in the wrong place when motd file is", " zero length, closes: #45686, #45632", " * pam_unix_acct.c: allow '0' to denote disabled for some expiry fields", " since chage(1) documents it this way, closes: #45446", " * pam_mail.c|modules/pam_mail.sgml: added 2 options, one \"standard\" to", " give the old style \"You have ...\" response and \"quiet\" which only", " reports new mail for both formats, documented both options,", " closes: #45670", " * with the new pam_unix module, this bug is fixed, closes: #42230", " * pam_limits.c: make sure that we not only ignore limits on root, we", " also remove them just in case we are su'ing from a limited user to", " the root account (since as root they can remove the limits anyway),", " closes: #35302", "" ], "package": "pam", "version": "0.69-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 3 Oct 1999 12:07:28 -0400" }, { "cves": [], "log": [ "", " * debian/rules: fixed module_check", " * pam_env/pam_env.c: fixed env parsing to include values wrapped in ''", " and also allow continued lines with a trailing '\\'.", " * pam_motd,pam_mail: converted to session modules, so that they could", " be ordered with the lastlog module", " * updated default pam.d/login to reflect above change (now login looks", " the same as the non-PAM version, lastlog, then motd, and then mail", " check)", " * pam_motd: removed extraneous \\n from output", " * modules/pam_limits/pam_limits.c: Fixed parsing of lines with only", " \"domain -\", which was documented as being able to get rid of limits", " for that user or group.", " * debian/control: (libpam-cracklib) Added depends for cracklib-runtime,", " closes: #45488", " * modules/pam_env.c: Fixed /etc/environment parsing causing segfaults on", " long lines, closes: #45408", "" ], "package": "pam", "version": "0.69-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 19 Sep 1999 13:50:40 -0400" }, { "cves": [], "log": [ "", " * Install unix_chkpwd suid root, it's needed for NIS to work without", " modification to the binary.", " * modules/pam_limits/pam_limits.c: hmm, some how I got a strange broken", " patch left over from the source upgrade...removed all but the pwdb", " purging, closes: #45088", " * modules/pam_env/pam_env.c: Changed to a debug message, instead of a", " syslog message when /etc/environment does not exist.", "" ], "package": "pam", "version": "0.69-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 15 Sep 1999 04:25:21 -0400" }, { "cves": [], "log": [ "", " * Removed libpam0g's preinst check for full paths in the pam.d files,", " this should really be a lintian check at build (i think the old libpam", " could not work like this, but hey...things change for the better some", " times. This PAM works fine like that). closes: #45001", " +NOTE: Debian packages should not reference modules by the full path", " so they don't break if I ever decide to move the modules to a different", " default directory. Only the admin should reference full paths and only", " for locally installed modules. I have submitted a request to check for", " this in lintian along with a few other devious things.", " * debian/patches/008_pam_mkhomedir: Fix title of sgml doc", " * modules/pam_userdb/Makefile: added patch for building against glibc 2.0", " (request from Roman Hodek), closes: #45064", "" ], "package": "pam", "version": "0.69-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 14 Sep 1999 06:12:34 -0400" }, { "cves": [], "log": [ "", " * Link all dynamic modules with libpam. For some reason, alpha doesn't", " like it when we don't", "" ], "package": "pam", "version": "0.69-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 13 Sep 1999 06:01:40 -0400" }, { "cves": [], "log": [ "", " * doc/modules/pam_cracklib.sgml: changed to correct path for", " cracklib_dict reference.", " * modules/pam_env/pam_env.c: now groks bash style env's from", " /etc/environment to be compatible with other programs that use it.", " * modules/pam_securetty/pam_securetty.c: don't just plain fail when", " root isn't allowed to login, fake a password request just like any", " good auth module would. Keeps us from letting them know that they", " are doing something bad :)", " * modules/pam_{motd,mkhomedir}: merged these two modules into this", " source, also wrote corresponding sgml files for libpam-doc,", " closes: #40754", " * debian/control: Moved libpam0g, libpam-modules and libpam-runtime", " to base with required priority since login depends on them and", " policy will require this", "" ], "package": "pam", "version": "0.69-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 11 Sep 1999 08:06:02 -0400" }, { "cves": [], "log": [ "", " * Modified build so that it uses libs and headers in the build tree", " rather than on the local system. This involved changint the build", " order slightly and should make it easier to compile on new archs.", " * Modified pam_limits so that it was invoked during pam_sm_setcred()", " instead of during pam_sm_session_open() so that it will work with", " shadow's su.", " * Fixed missing symbols in libpam.so, they were caused by it thinking", " it was supposed to have static modules built in.", " * Fixed problem where libpam was getting built with -DDEBUG", " * pam_unix_passwd.c: Changed the perms on shadow to be 0.42 and 0640", " instead of 0.0 and 0600", " * unix_chkpwd: fix it not being sgid shadow", "" ], "package": "pam", "version": "0.69-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 9 Sep 1999 13:52:01 -0400" }, { "cves": [], "log": [ "", " * New upstream source", " - Now with a new and improved pam_unix module, closes: #38631", " - Lot's of documentation cleanups", " * Converted build system to dbs (doogie's build system, aka Adam Heath)", " * Fixed libpam.so compilation so that it did not link with any of the", " modules (this was causing lot's of problems, closes; #43913, #40739", " * modules/pam_ftp/pam_ftp.c: Fixed sizeof, to use strlen,", " closes: #44054, #41845, #44142, #39129, #39871, #44412", " * Postscript pages are now generated correctly, closes: #41608", " * Moved to FHS compliance (including use of debhelper 2.0.40),", " this also raises the policy version to 3.0.1.1", " * Don't check the paths in /etc/pam.d files anymore. This is old", " and causes nothing but complaints, closes: #39747", " * Build libpam0g-dbg with debuggable static and shared libraries, also", " enabled the internal DEBUG_REL compile flag for these so that the", " debugging messages will also be output", "" ], "package": "pam", "version": "0.69-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 7 Sep 1999 17:45:20 -0400" }, { "cves": [], "log": [ "", " * Added ability for pam_env to parse /etc/environment and updated", " docs to reflect it", " * Applied patch for pwdb_chkpwd man page, closes: #38976", " * Merged pam_unix_*.so modules into one pam_unix.so with symlinks", " for backward compatibility. This helps centralize this module the", " same way the pam_pwdb.so is and the way pam_unix.so is on other", " operating systems (commercial ones specifically).", " * Closed by pam-apps upload, closes: #38632", " * Fixed `sgml2latex' syntax, closes: #39119", " * Added doc-base support, closes: #37627", "" ], "package": "pam", "version": "0.66-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 16 Jun 1999 01:20:23 -0400" }, { "cves": [], "log": [ "", " * SPARC NMU to fix chown symbols when compiling with glibc 2.1.1", "" ], "package": "pam", "version": "0.66-9.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 11 May 1999 13:33:33 +0000" }, { "cves": [], "log": [ "", " * Changed the debian/rules to not mess with the library symlinks (ie", " running ldconfig in the lib dir) and all is well, closes: #36169", "" ], "package": "pam", "version": "0.66-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 18 Apr 1999 09:09:51 -0400" }, { "cves": [], "log": [ "", " * Compiled with libpam_client.so now (seperate lib in libpam0g)", " * Made regex for libpam0g postinst a little more specific so it", " didn't flag false problems. closes: #34626", " * Applied patch to fix pam_ftp, closes: #35388", " * Modified pam_mail and pam_lastlog to honor PAM_SILENT in order to", " enable apps to use hushlogin/PAM_SILENT", " * Fixed problem with libpam_client.so being static", "" ], "package": "pam", "version": "0.66-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 15 Mar 1999 20:54:23 -0500" }, { "cves": [], "log": [ "", " * Fixed XCASE in pam_filter.c (not really in glibc 2.1 by default)", "" ], "package": "pam", "version": "0.66-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 6 Mar 1999 18:46:56 -0500" }, { "cves": [], "log": [ "", " * Removed empty /lib/security/ from libpam0g (is created in", " libpam-runtime)", " * Added a depends for libpam-runtime to libpam0g (was supposed to be", " there, must have deleted it)", " * Removed empty /usr/bin from libpam-runtime (old directory where", " upperLOWER was)", "" ], "package": "pam", "version": "0.66-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 24 Feb 1999 13:14:25 -0500" }, { "cves": [], "log": [ "", " * Removed harcoded libc6 dependency from libpam0g-dev and changed it to", " libc6-dev. closes: #33615", " * Added md5 flag for pam_unix_passwd.so", " * Removed upperLOWER program since it is just an example. Moved it's", " source to the examples directory in libpam-modules", " * Fixed documentation of pam_strerror() and examples. closes #31142", " * Made pam_unix_passwd.so leave /etc/shadow mode 640 and root.shadow", " after changes", " * Fixed problem in pam_unix_auth that didn't let you su from a normal", " user to another normal user (ie. neither one was root)", " * Closing misc fixed bugs. closes #32809, #32274 (have been fixed,", " just need closing)", " * Tested lockvc with pam support, works for normal users (pam_pwdb)", " closes: #31150", " * Changed /var/log/wtmp in pam_lastlog docs to reflect correct", " /var/log/lastlog file. closes: #26544", " * Added -ldl to libpam.so, so apps don't have to", "" ], "package": "pam", "version": "0.66-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 19 Feb 1999 18:47:30 -0500" }, { "cves": [], "log": [ "", " * Changed pwdb_chkpwd to sgid shadow instead of suid root since it only", " needs read permissions to /etc/shadow and not write.", " * Moved a lot of files arouns to get rid of libpam-runtime dependencies", " * Put libpam-pwdb into it's own package", " * Removed -lpwdb links for modules since libpwdb is somewhat buggy (or", " alteast it's interaction with libpam is)", " * Fixed bug in pam_unix_passwd.so that caused it to never authenticate", " the correct passwd, making it so you couldn't change the passwd", "" ], "package": "pam", "version": "0.66-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 16 Feb 1999 15:50:28 -0500" }, { "cves": [], "log": [ "", " * Fixed defaults in /etc/pam.d/other to be pam_unix_*.so modules instead", " of the accidental pam_pwdb.so module", " * Fixed suid of pwdb_chkpwd (had to move dh_fixperms after", " dh_suidregister)", " * Added Replaces: libpam0g-util in order to help dpkg upgrade from", " older packages", " * Applied glibc 2.1 patch from Christian Meder. closes: #32809", " * Moved libpam-doc to Section doc. closes: #32274", "" ], "package": "pam", "version": "0.66-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 12 Feb 1999 02:01:43 -0500" }, { "cves": [], "log": [ "", " * Removed all of the versioned module stuff. Modules are now in", " /lib/security and stay there. Seems after discussion, that modules may", " not change as often as thought", " * Fixed suidregister for pwdb_chkpwd", " * Fixed incomplete descriptions in control file", " * This is a kludge to close some bugs since the last upload was yanked", " before being installed in the archive, closes: #16882, #30862, #7725,", " #10234, #10406, #12210, #14291, #15528, #15529, #20660, #25330,", " #29868, #31088, #31128, #9131, #9919, #19383, #5132, #14533, #25915,", " #28075, #31548, #31191", "" ], "package": "pam", "version": "0.66-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 2 Feb 1999 12:47:25 -0500" }, { "cves": [], "log": [ "", " * New maintainer", " * New upstream release. closes: #16882, #30862, #7725", " * Created a better split of the main lib and the runtime to kill the", " circular dependencies and make it possible to have two .so version of", " the library installed for upgrades. closes: #10234, #10406, #12210,", " bug #14291, #15528, #15529, #20660, #25330, #29868, #31088, #31128,", " bug #9131, #9919.", " * Harcoded modules directory prefixed with the .so version, and", " used alternatives to create the symlink to the 'default' modules", " directory. libpam will use the full path when specified, but use the", " versioned modules directory for relative names.", " * Put libpam0g-cracklib modules back in (own package). This means that", " cracklib support is _not_ in the static libpam.a, also cracklib", " support is _not_ in pam_unix_passwd.o, but only in pam_cracklib.so", " by itself.", " * Fixed a few typos in the source causing compile errors", " * Fixed source #include's so that pam _didn't_ have to be installed", " in order to compile the source ( changed from <> to \"\" )", " * Removed empty directories from built packages", " * Opted not to build examples, only going to put *.c files in examples", " directory for libpam0g-dev", " * Moved *.sgml files for modules into their own directory (looks like", " that is what the original maintainer wanted to do, but it didn't go)", " * Moved doc build to arch-indep build in rules so that it doesn't get", " built when specifying -B with debuild/dpkg-buildpackage.", " * Moved `touch .quiet...' to build-stamp in order to have -B builds not", " ask about pam.conf", " * Split out non-standard modules to their own package, so as to make the", " base install smaller (planning for base inclusion here)", " * Created small manpage for pwdb_chkpwd. closes: #10941", " * The Copright file in /usr/doc/*/ was already named copright and not", " compressed. closes: #14533", " * Package is now lintian clean. closes #19383, #5132", " * There is a maintainer now and the patch for #25915 is still included", " so.... closes: #25915", " * Added check for editor backup files in /etc/pam.d (*~). closes: #28075", " * Applied patch for md5.h in pam_pwdb module. closes: #31548", " * Added support for dhelp in libpam-doc. closes: #31191", "" ], "package": "pam", "version": "0.66-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 20 Jan 1999 07:09:15 -0500" }, { "cves": [], "log": [ "", " * Marked PAM as orphaned, given that there has been no maintainer upload", " in almost two years.", " * [defs/debian.defs] Removed superflous cracklib2 dependency.", " (Urgent as cracklib still has release-critical bugs).", " (Fixes #30862).", "" ], "package": "pam", "version": "0.65-0.8", "urgency": "high", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Wed, 20 Jan 1999 09:34:35 +0100" }, { "cves": [], "log": [ "", " * Fixed security vulnerability in the pam_unix and pam_tally modules", " (reported by Michal Zalewski on bugtraq; patch", " A000-SECURITY-PATCH-0.65-and-below.gz by Andrey V. Savochkin).", "" ], "package": "pam", "version": "0.65-0.7", "urgency": "high", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Tue, 29 Dec 1998 16:20:18 +0100" }, { "cves": [], "log": [ "", " * Fixed distribution of files over the various packages, which was", " severely messed up.", " * Added appropriate Replaces: to ensure upgrading from both the hamm", " version and previous slink versions.", " * Fixed debug libraries, PAM module loading.", " * Added examples.", " * Added a \"pam-undocumented\" manpage pointing to libpam-doc, and", " made links for functions without a manpage to that.", "" ], "package": "pam", "version": "0.65-0.6", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Sun, 11 Oct 1998 19:29:40 +0200" }, { "cves": [], "log": [ "", " * Rewritten the preinst warning text (it still mentioned the search path).", "" ], "package": "pam", "version": "0.65-0.5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Fri, 9 Oct 1998 14:23:18 +0200" }, { "cves": [], "log": [ "", " * It looks like I misunderstood DEFAULT_MODULE_PATH: Linux-PAM does not", " currently seem to be easily configured to look for modules in more than", " one directory. With this version, it's configured to look only in", " /lib/security .", "" ], "package": "pam", "version": "0.65-0.4", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Fri, 9 Oct 1998 11:43:34 +0200" }, { "cves": [], "log": [ "", " * Moving the PAM modules to /lib/security broke netatalk.", " Added a preinst script to detect /etc/pam.d files with explicit paths to", " PAM modules, give a warning about them, and offer to abort the install", " (Fixes #27514).", "" ], "package": "pam", "version": "0.65-0.3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Tue, 6 Oct 1998 20:10:43 +0200" }, { "cves": [], "log": [ "", " * Argh. The tools didn't recognise -0.1 as a new upstream release, so", " my previous upload was rejected due to a missing .orig.tar.gz .", "" ], "package": "pam", "version": "0.65-0.2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Sun, 4 Oct 1998 17:15:09 +0200" }, { "cves": [], "log": [ "", " * New upstream version.", " * Non-maintainer upload.", " * Major package overhaul; now uses debhelper.", " * In experimental for now. *Please* provide feedback; if the feedback is", " positive, we can put this in slink.", " * Dropped libc5 support.", " * [libpam/pam_static.c] Fixed compilation: \"pamh\" was undefined; use \"NULL\".", " is this the correct fix?", " * [defs/debian.defs] New.", " * [Makefile]", " * Exit when a make in a subdirectory fails.", " * Compile statically too.", " * New variables: LC, LP, LPLIBS, DEFAULT_MODULE_PATH .", " * [libpam/Makefile]", " * Use DEFAULT_MODULE_PATH if nonempty.", " * Link libpam against LPLIBS.", " * [modules/*/Makefile]", " * Link the dynamic security objects against libpam and libc", " (LP and LC).", " * [modules/pam_pwdb/Makefile]", " * Link dynamic security objects against libcrypt and libnsl.", " * [conf/install_conf] Allow for non-interactive install (as the other", " install_conf scripts already did).", " * Automatically determine the list of /etc/security/* conffiles.", " * Moved libpam to /lib, and PAM modules to /lib/security as they will", " become part of the base system in the future.", " * Built without cracklib support, to keep the base system smaller.", " * /sbin/pwdb_chkpwd is undocumented, as is upperLOWER.", "" ], "package": "pam", "version": "0.65-0.1", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Fri, 2 Oct 1998 20:23:27 +0200" }, { "cves": [], "log": [ "", " * Non maintainer upload", " My previous upload had removed the libc5 stuff from the controlfile", " messing up things. Change 'Architecture: any' to 'i386 m68k' for those", " .deb's instead.", "" ], "package": "pam", "version": "0.57b-0.4", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Turbo Fredriksson ", "date": "Thu, 20 Aug 1998 20:06:50 -0400" }, { "cves": [], "log": [ "", " * Non maintainer upload", " On a glibc2.1 system, XCASE is only defined in the ", " _IF_ '__USE_MISC' or '__USE_UNIX98' is defined.", "" ], "package": "pam", "version": "0.57b-0.3", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Turbo Fredriksson ", "date": "Sun, 16 Aug 1998 22:13:45 -0400" }, { "cves": [], "log": [ "", " * Yet another non-maintainer release.", " * Zero changes; simply a re-upload due to a rm-trigger happy release", " ``manager''.", "" ], "package": "pam", "version": "0.57b-0.2", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "James Troup ", "date": "Tue, 17 Mar 1998 19:55:16 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer release.", " * debian/control (Standards-Version): Updated to 2.4.0.0.", " * debian/control (libpam0g-dev): Also conflict with libpam-dbg.", " * debian/postinst: use case statement instead of if.", " * debian/rules (COMPAT_ARCHES): removed sparc.", " * debian/rules (binary-libc6-dev, binary-libc5-altdev): strip static libraries with", " --strip-debug, not --strip-unneeded.", " * debian/rules: each package now has it's own doc directory under", " /usr/doc/, containing at least the copyright file (Policy 5.6).", " * debian/rules: install files with `install -m 644' not `cp -p' to avoid", " read-only files.", " * debian/rules (binary-libc6-util): strip /usr/lib/*/security/*.so with", " --strip-unneeded.", " * debian/rules (binary-libc5-util): ditto.", " * debian/rules (binary-libc5): don't depend on binary-libc5.", "" ], "package": "pam", "version": "0.57b-0.1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "James Troup ", "date": "Sat, 7 Mar 1998 18:04:19 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer release.", " * New upstream version.", " * Doesn't use pristine upstream source as the upstream tar ball is broken.", " * Added libc6 libraries libpam0g, libpam0g-dev, libpam0g-dbg and", " libpam0g-util. [#11697]", " * libpam-dev becomes libpam0-altdev, libpam-util -> libpam0-altutil and", " libpam-dbg is removed.", " * libpam0 depends on libpam0g because libpam0g contains the pam conffile.", " * libpam0-util depends on libpam0g-util because libpam0g contains the binary.", " * Compiled with -D_REENTRANT and link with -lc.", " * Fixed permissions on shared libraries.", " * Corrected syntax of /etc/pam.d/other. [#10497, #10758, #12030]", " * Fixed typos in postinst. [#10474, #11365]", " * Made /etc/pam.conf a conffile.", " * Updated URL in copyright file.", " * Removed over-zelaously installed README* files from libpam-doc.", "" ], "package": "pam", "version": "0.57b-0", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "James Troup ", "date": "Sat, 22 Nov 1997 17:54:30 +0100" }, { "cves": [], "log": [ "", " * Added /etc/pam.d/other with policy 'deny'.", " * Add manual pages for PAM security modules.", "" ], "package": "pam", "version": "0.56-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Klee Dienes ", "date": "Sat, 15 Mar 1997 22:33:22 -0500" }, { "cves": [], "log": [ "", " * New upstream release.", " * Converted to new packaging format.", " * Reorganization of package structure (-dev, -dbg, etc).", "" ], "package": "pam", "version": "0.56-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Klee Dienes ", "date": "Sat, 8 Mar 1997 01:21:17 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-runtime", "from_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.6", "version": "1.5.3-5ubuntu5.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.7", "version": "1.5.3-5ubuntu5.7" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" }, { "cve": "CVE-2024-10963", "url": "https://ubuntu.com/security/CVE-2024-10963", "cve_description": "A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.", "cve_priority": "medium", "cve_public_date": "2024-11-07 16:15:00 UTC" }, { "cve": "CVE-2025-6020", "url": "https://ubuntu.com/security/CVE-2025-6020", "cve_description": "A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.", "cve_priority": "medium", "cve_public_date": "2025-06-17 13:15:00 UTC" }, { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" }, { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" }, { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" }, { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" }, { "cve": "CVE-2015-3238", "url": "https://ubuntu.com/security/CVE-2015-3238", "cve_description": "The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.", "cve_priority": "low", "cve_public_date": "2015-08-24 14:59:00 UTC" }, { "cve": "CVE-2013-7041", "url": "https://ubuntu.com/security/CVE-2013-7041", "cve_description": "The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack.", "cve_priority": "low", "cve_public_date": "2014-05-08 14:29:00 UTC" }, { "cve": "CVE-2014-2583", "url": "https://ubuntu.com/security/CVE-2014-2583", "cve_description": "Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.", "cve_priority": "low", "cve_public_date": "2014-04-10 20:29:00 UTC" }, { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2010-3853", "url": "https://ubuntu.com/security/CVE-2010-3853", "cve_description": "pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3316", "url": "https://ubuntu.com/security/CVE-2010-3316", "cve_description": "The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pam_xauth PAM check.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3430", "url": "https://ubuntu.com/security/CVE-2010-3430", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3431", "url": "https://ubuntu.com/security/CVE-2010-3431", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3435", "url": "https://ubuntu.com/security/CVE-2010-3435", "cve_description": "The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-0832", "url": "https://ubuntu.com/security/CVE-2010-0832", "cve_description": "pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to \"user file stamps\" and the motd.legal-notice file.", "cve_priority": "high", "cve_public_date": "2010-07-12 16:30:00 UTC" }, { "cve": "CVE-2009-0887", "url": "https://ubuntu.com/security/CVE-2009-0887", "cve_description": "Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.", "cve_priority": "low", "cve_public_date": "2009-03-12 15:20:00 UTC" }, { "cve": "CVE-2005-2977", "url": "https://ubuntu.com/security/CVE-2005-2977", "cve_description": "The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unix_chkpwd, which does not log failed guesses or delay its responses.", "cve_priority": "medium", "cve_public_date": "2005-11-01 12:47:00 UTC" } ], "launchpad_bugs_fixed": [ 2164901, 2087827, 2064360, 2064350, 2059859, 2055453, 1953201, 1953201, 1916509, 1860826, 772121, 1860826, 1935972, 1927796, 1659719, 1856703, 1855092, 1192719, 1192719, 1538284, 1081323, 1571864, 1487103, 1558114, 557013, 1160288, 1126404, 110287, 955032, 1095887, 937005, 110287, 871083, 744944, 871943, 805423, 745004, 882794, 871943, 805423, 874469, 874565, 794531, 253096, 746655, 391761, 745532, 663090, 744944, 733501, 297408, 588547, 562566, 552175, 513955, 356766, 424566, 287715, 410171, 399071, 399071, 314222, 303515, 305882, 303515, 305882, 303515, 305882, 294513, 295135, 295441, 65244, 256238, 291091, 272232, 270328, 260371, 260122, 259867, 216990, 216990, 245786, 9224, 64064, 216990, 141309, 187822, 139075, 64064, 216990, 208419, 198714, 187822, 139075, 141309, 139065, 141309, 139075, 43169, 14505, 80431 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:35 -0400" }, { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411-pre1.patch: libpam: add helper to compare", " strings in constant time in libpam/include/pam_inline.h.", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 09:44:01 -0400" }, { "cves": [ { "cve": "CVE-2024-10963", "url": "https://ubuntu.com/security/CVE-2024-10963", "cve_description": "A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.", "cve_priority": "medium", "cve_public_date": "2024-11-07 16:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: pam_access hostname confusion", " - debian/patches/CVE-2024-10963.patch: add \"nodns\" option to disallow", " resolving of tokens as hostname in", " modules/pam_access/access.conf.5.xml,", " modules/pam_access/pam_access.8.xml,", " modules/pam_access/pam_access.c.", " - CVE-2024-10963", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.5", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 15 Sep 2025 08:37:15 -0400" }, { "cves": [ { "cve": "CVE-2025-6020", "url": "https://ubuntu.com/security/CVE-2025-6020", "cve_description": "A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.", "cve_priority": "medium", "cve_public_date": "2025-06-17 13:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: privilege escalation via pam_namespace", " - debian/patches/pam_namespace_170.patch: sync pam_namespace module to", " version 1.7.0.", " - debian/patches/pam_namespace_post170-*.patch: add post-1.7.0 changes", " from upstream git tree.", " - debian/patches/pam_namespace_revert_abi.patch: revert ABI change to", " prevent unintended issues in running daemons.", " - debian/patches/CVE-2025-6020-1.patch: fix potential privilege", " escalation.", " - debian/patches/CVE-2025-6020-2.patch: add flags to indicate path", " safety.", " - debian/patches/CVE-2025-6020-3.patch: secure_opendir: do not look at", " the group ownership.", " - debian/patches/pam_namespace_o_directory.patch: removed, included in", " patch cluster above.", " - CVE-2025-6020", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.4", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 12 Jun 2025 10:45:28 -0400" }, { "cves": [], "log": [ "", " * d/p/031_pam_include: fix loading from /usr/lib/pam.d (LP: #2087827)", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2087827 ], "author": "Simon Chopin ", "date": "Mon, 26 May 2025 16:34:46 +0200" }, { "cves": [], "log": [ "", " [ Sam Hartman ]", " * Correct Build depends for docbook5 (LP: #2064360)", " * Depend on libdb-dev again, bringing back pam_userdb (LP: #2064350)", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2064360, 2064350 ], "author": "Dan Bungert ", "date": "Thu, 02 May 2024 16:20:13 -0600" }, { "cves": [], "log": [ "", " * d/p/pam_env-remove-deprecation-notice-for-user_readenv.patch: drop", " deprecation warning about user_readenv from pam_env (LP: #2059859)", "" ], "package": "pam", "version": "1.5.3-5ubuntu5", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2059859 ], "author": "Andreas Hasenack ", "date": "Wed, 10 Apr 2024 16:19:22 -0300" }, { "cves": [ { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" } ], "log": [ "", " * No-change rebuild for CVE-2024-3094", "" ], "package": "pam", "version": "1.5.3-5ubuntu4", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 31 Mar 2024 00:03:23 +0000" }, { "cves": [], "log": [ "", " * No-change rebuild against libdb5.3t64", "" ], "package": "pam", "version": "1.5.3-5ubuntu3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 02 Mar 2024 20:36:06 +0000" }, { "cves": [], "log": [ "", " * Fix FTBFS when built with -Werror=implicit-function-declaration", " (LP: #2055453)", "" ], "package": "pam", "version": "1.5.3-5ubuntu2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2055453 ], "author": "Dan Bungert ", "date": "Thu, 29 Feb 2024 11:53:08 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager", " when there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", "" ], "package": "pam", "version": "1.5.3-5ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Dan Bungert ", "date": "Thu, 29 Feb 2024 10:25:41 -0700" }, { "cves": [], "log": [ "", " * Revert renaming libpam0g to libpam0t64 for time_t transition: apt", " sometimes removes libpam0g rather than simply letting libpam0t64", " replace libpam0g (and deconfiguring libpam0g), leaving a system where", " essential packages are broken, Closes: #1065017", " * Since libpam0t64 is going away, we do not need dpkg-diversions for it.", " * As a consequence libpam_misc has an ABI break without a package name", " change. We believe nothing in the archive depends on this ABI, and at", " least until we come up with a better solution this is the least bad option.", " * For now remove libdb-dev so that libdb-dev can undergo time_t", " transition. That means this version of pam does not include", " pam_userdb, which makes pam unsuitable for release. ", " * Replace/break libpam0t64", "" ], "package": "pam", "version": "1.5.3-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 29 Feb 2024 09:46:54 -0700" }, { "cves": [ { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" } ], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0t64.postinst: only ask questions during update-manager", " when there are non-default services running.", " - debian/libpam0t64.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " * Dropped changes, included in Debian:", " - SECURITY UPDATE: pam_namespace local denial of service", " - debian/patches/CVE-2024-22365.patch: use O_DIRECTORY to", " prevent local DoS situations in modules/pam_namespace/pam_namespace.c.", " - CVE-2024-22365", " - Install into /usr/{lib,sbin} instead of /{lib,sbin}. Assumes", " usrmerge aliasing symlinks are in place since bookworm to keep", " compatibility with PAM modules still installing into /lib.", " (DEP17 M2) (Closes: #1060160).", " - Mitigate /usr-move file loss. (Closes: #1062802)", " - Update lintian override for setgid binary.", "" ], "package": "pam", "version": "1.5.3-4ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Dan Bungert ", "date": "Wed, 28 Feb 2024 21:07:18 -0700" }, { "cves": [], "log": [ "", " * Upload to unstable", " * Revert 1.5.2-9.1 changes to debian/rules now that we use", " debian/patches properly.", "" ], "package": "pam", "version": "1.5.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 27 Feb 2024 21:30:52 -0700" }, { "cves": [], "log": [ "", " [ Helmut Grohne ]", " * Mitigate /usr-move file loss. (Closes: #1062802)", "" ], "package": "pam", "version": "1.5.3-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Helmut Grohne ", "date": "Sat, 03 Feb 2024 12:18:52 +0100" }, { "cves": [ { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" } ], "log": [ "", " * Rename libpam0g to libpamt64 for time_t transition", " * New Swedish Translations, Thanks Martin Bagge / brother, Closes: #1057775", " * pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS", " situations (CVE-2024-22365) (Closes: #1061097)", "" ], "package": "pam", "version": "1.5.3-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 02 Feb 2024 11:27:45 -0700" }, { "cves": [], "log": [ "", " [ Sam Hartman ]", " * New upstream version", " * Since we no longer build with NIS support, drop Debian patches related", " to NIS", " [ Debian Janitor]", " * Update lintian override info to new format:", " + debian/libpam-runtime.lintian-overrides: line 5, 7, 9-13", " + debian/libpam-modules.lintian-overrides: line 5-10, 14", " * Trim trailing whitespace.", " * Move source package lintian overrides to debian/source.", " * Update renamed lintian tag names in lintian overrides.", " * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository-Browse.", " * Drop unnecessary dependency on dh-autoreconf.", " * Update standards version to 4.6.2, no changes needed.", "", " [ Andreas Henriksson ]", " * debian/rules: use --enable-usergroups configure flag (Closes: #583958)", " * Use pam_umask.so in common-session{-noninteractive} (Closes: #711104)", "", " [ Debian Janitor ]", " * Apply multi-arch hints. + libpam-doc: Add Multi-Arch: foreign.", "", " [ Sam Hartman ]", " * Drop NIS patches and rearrange other patches.", " * Update patch to move pam manpage to section 7: docbook tools now take", " the man page output name from the xml so we need to update the", " Makefile. ", " * Now PAM.7 is actually installed as pam.7 so update packaging", " * pam-auth-update: Session-Interactive-Only set to anything other than", " yes counts as undefined/no, thanks Lucas Nussbaum, Closes: #982309", " * Use logind instead of utmp in pam_issue and pam_timestamp; utmp is not", " y2038-safe.", "", " [ Sam Hartman ]", " * Add new common-session-* templates to pam-auth-update.", "", " [ Chris Hofstaedtler ]", " * Install into /usr/{lib,sbin} instead of /{lib,sbin}. Assumes", " usrmerge aliasing symlinks are in place since bookworm to keep", " compatibility with PAM modules still installing into /lib.", " (DEP17 M2) (Closes: #1060160).", " * Update lintian override for setgid binary.", " " ], "package": "pam", "version": "1.5.3-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 15 Jan 2024 15:45:50 -0700" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Install into /usr/{lib,sbin} instead of /{lib,sbin}. Assumes", " usrmerge aliasing symlinks are in place since bookworm to keep", " compatibility with PAM modules still installing into /lib.", " (DEP17 M2) (Closes: #1060160).", " * Update lintian override for setgid binary.", "", " [ Helmut Grohne ]", " * Mitigate /usr-move file loss. (Closes: #1062802)", "" ], "package": "pam", "version": "1.5.2-9.1ubuntu3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Thu, 22 Feb 2024 13:24:31 +0100" }, { "cves": [ { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: pam_namespace local denial of service", " - debian/patches-applied/CVE-2024-22365.patch: use O_DIRECTORY to", " prevent local DoS situations in modules/pam_namespace/pam_namespace.c.", " - CVE-2024-22365", "" ], "package": "pam", "version": "1.5.2-9.1ubuntu2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 17 Jan 2024 12:28:44 -0500" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " * debian/update-motd.5: fix a typo; thanks to David", " Collantes .", "" ], "package": "pam", "version": "1.5.2-9.1ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 20 Nov 2023 06:39:20 -0800" }, { "cves": [], "log": [ "", " * Non-maintainer upload acked by Sam Hartman.", " * Really fix quilt-related FTBFS: (Closes: #1054505)", " pam is a 3.0 (quilt) source package and has a .pc directory after unpack", " despite having no debian/patches. Even when setting QUILT_PATCH_DIR or", " QUILT_PATCHES, quilt is now mislead to using the non-existent", " debian/patches and this makes dh_quilt_unpatch fail, so we delete that", " directory unless it corresponds to the real debian/patches-applied that we", " want to be used.", "" ], "package": "pam", "version": "1.5.2-9.1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Helmut Grohne ", "date": "Tue, 24 Oct 2023 19:38:53 +0200" }, { "cves": [], "log": [ "", " * Revert 1.5.2-8 upload; as far as I can tell the change is incorrect,", " Closes: #1054493", " " ], "package": "pam", "version": "1.5.2-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 24 Oct 2023 09:19:43 -0600" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * Drop reference to stale package version in libpam-modules.postinst;", " thanks, Gioele Barabucci .", "", " [ Sam Hartman ]", " * Fix pam-auth-update --disable logic error, Closes: #1039873", " * Set myself as maintainer; thanks Steve for past and future work.", " * Fix watch file, thanks Daniel Lewart, Closes: #1040310", " * Install upstream NEWS file as main upstream changelog; detailed", " CHANGELOG only in libpam-doc, Closes: #1040315", " * Updated Turkish Debconf translations, Thanks Atila KOÇ, Closes: #1029002", "" ], "package": "pam", "version": "1.5.2-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 16 Aug 2023 17:22:53 -0600" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", "" ], "package": "pam", "version": "1.5.2-6ubuntu1", "urgency": "medium", "distributions": "mantic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 15 May 2023 15:17:53 -0700" }, { "cves": [], "log": [ "", " * Update debian/copyright, Thanks Bastian Germann, Closes: #460232", " * When pam-auth-update is called with --root, use", " /usr/share/pam-configs from the root not from the host system, Thanks", " Johannes Schauer Marin Rodrigues, Closes: #1022952", " * Build-depend on libcrypt-dev, Closes: #1024645", " * Add pam-auth-udpate --disable, Closes: #1004000", " * Add autopkgtests", "" ], "package": "pam", "version": "1.5.2-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 03 Jan 2023 13:15:23 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable; remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", "" ], "package": "pam", "version": "1.5.2-5ubuntu1", "urgency": "medium", "distributions": "lunar", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Nov 2022 12:53:39 -0800" }, { "cves": [], "log": [ "", " * pam_namespace_helper manpage *wasn't* missing, it was just being", " wrongly shipped in libpam-modules instead - so complete the moving", " of the manpage to the libpam-modules-bin where it belongs with the", " binary. Really Closes: #1021336.", "" ], "package": "pam", "version": "1.5.2-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 06 Oct 2022 18:56:06 +0000" }, { "cves": [], "log": [ "", " * pam_namespace_helper manpage was missing, but namespace.conf.5 was", " already shipped in libpam-modules. Leave it there. Closes: #1021336.", "" ], "package": "pam", "version": "1.5.2-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 06 Oct 2022 17:28:36 +0000" }, { "cves": [], "log": [ "", " * Add missing manpages for pam_namespace which for some reason don't get", " installed by the upstream rules", " * Drop obsolete upgrade code from maintainer scripts which is no longer", " used", " * Drop manual multiarch file handling in favor of dh-exec.", " * No special-case needed for pam_modutil_sanitize_helper_fds in symbols", " file, it's covered by the existing globs.", " * debian/local/Debian-PAM-MiniPolicy: drop references to ancient", " package versions. Thanks, Marc Haber.", " * Support DPKG_ROOT in the postinst scripts. Closes: #993161.", " Thanks, Johannes Schauer Marin Rodrigues.", " * Further proof libpam-runtime postinst for DPKG_ROOT just in case.", "" ], "package": "pam", "version": "1.5.2-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 06 Oct 2022 04:05:02 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " * Dropped changes, no longer needed:", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", " * Refresh patches.", " * debian/patches-applied/extrausers.patch: update for upstream changes.", "" ], "package": "pam", "version": "1.5.2-2ubuntu1", "urgency": "medium", "distributions": "kinetic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Aug 2022 18:16:30 +0000" }, { "cves": [], "log": [ "", " * Pass --with-systemdunitdir=/usr/lib/systemd/system for consistent", " builds whether we are or aren't building in an environment with systemd", " present.", " * Install the pam_namespace.service unit in the libpam-modules-bin", " package.", "" ], "package": "pam", "version": "1.5.2-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Aug 2022 16:47:57 +0000" }, { "cves": [], "log": [ "", " * New upstream release.", " - fixes compatibility with libpam-systemd. Closes: #1017467.", " - fixes bashisms in configure.ac. Closes: #998361.", " * Refresh patches.", " * Drop patches included or obsoleted upstream:", " - debian/patches-applied/pam_unix_fix_sgid_shadow_auth.patch", " - debian/patches-applied/pam_unix_initialize_daysleft", " - debian/patches-applied/pam_faillock_create_directory", " - debian/patches-applied/pam_unix_avoid_checksalt", " - debian/patches-applied/pam_env-allow-environment-files-without-EOL-at-EOF.patch", " * Drop libpam-cracklib which has been obsoleted upstream.", " * Add pkgconfig .pc files to libpam0g-dev. Closes: #1012688.", " * Update .symbols file.", " * Updated Romanian debconf translation, thanks Andrei Popescu, Closes:", " #986416", " * Drop versioning of quilt build-dependency to quiet lintian, since the", " version is satisfied by oldoldoldstable.", " * Drop unused build-build-dependency on bzip2.", " * Adjust lintian overrides for latest lintian syntax.", " * Update Standards-Version.", " * Bump debhelper compat to 13.", " * debian/not-installed: document upstream files that aren't used.", " * Override incorrect lintian warning about use of dpkg database.", " * Override lintian warning for PAM module manpages being in section 8", " * Override lintian warning for unused debconf templates", " * Install additional upstream manpages: faillock(8), environment(5),", " pwhistory_helper(8)", " * Install additional helpers in libpam-modules-bin: pam_namespace_helper,", " pwhistory_helper", " * Fix wrong syntax in symbols file", "" ], "package": "pam", "version": "1.5.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Aug 2022 07:27:16 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", "" ], "package": "pam", "version": "1.4.0-13ubuntu1", "urgency": "medium", "distributions": "kinetic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 26 Apr 2022 11:10:38 -0700" }, { "cves": [], "log": [ "", " * Don't build with NIS support. This is only used for password changes on", " NIS systems, and is pulling a large dependency chain into the Essential", " package set which is not justifiable.", "" ], "package": "pam", "version": "1.4.0-13", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 25 Apr 2022 16:12:04 -0700" }, { "cves": [], "log": [ "", " * Drop Recommends on update-motd which is no longer used and is not being", " maintained.", "" ], "package": "pam", "version": "1.4.0-11ubuntu2", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 23 Mar 2022 18:43:24 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", " * Dropped changes, included in Debian:", " - d/p/pam_env-allow-environment-files-without-EOL-at-EOF.patch:", " Allow /etc/environment files without EOL at EOF.", "" ], "package": "pam", "version": "1.4.0-11ubuntu1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Feb 2022 08:51:50 -0800" }, { "cves": [], "log": [ "", " * Whitespace fixes in debconf templates.", "", " [ Sergio Durigan Junior ]", " * d/p/pam_env-allow-environment-files-without-EOL-at-EOF.patch:", " Allow /etc/environment files without EOL at EOF. In other words,", " allow files without a newline at the end. (LP: #1953201)", "" ], "package": "pam", "version": "1.4.0-11", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 1953201 ], "author": "Steve Langasek ", "date": "Mon, 06 Dec 2021 11:11:31 -0800" }, { "cves": [], "log": [ "", " [ Sergio Durigan Junior ]", " * d/p/pam_env-allow-environment-files-without-EOL-at-EOF.patch:", " Allow /etc/environment files without EOL at EOF. In other words,", " allow files without a newline at the end. (LP: #1953201)", "" ], "package": "pam", "version": "1.4.0-10ubuntu2", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1953201 ], "author": "Steve Langasek ", "date": "Mon, 06 Dec 2021 11:05:28 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable (LP: #1916509). Remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", " * Dropped changes, obsoleted:", " - pam_motd: Export MOTD_SHOWN=pam after showing MOTD", " - Return only PAM_IGNORE or error from pam_motd", " - Fix patches to fix FTBFS", " - Backport pam_faillock module from pam 1.4.0", " - debian/patches-applied/nullok_secure-compat.patch: Support", " nullok_secure as a deprecated alias for nullok.", " - debian/pam-configs/unix: use nullok, not nullok_secure.", " * Patches:", " - d/p/pam_motd-legal-notice: refreshed", " - Refreshed d/p/pam_umask_usergroups_from_login.defs.patch to use", " pam_modutil_search_key instead of our own hand-rolled version", " - d/p/extrausers.patch: Refreshed the patch and fixed the", " HAVE_LIBSELINUX conditional removed upstream.", " * d/local/pam-auth-update: refreshed the md5sum for debian/local/common-session", "" ], "package": "pam", "version": "1.4.0-10ubuntu1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1916509 ], "author": "Simon Chopin ", "date": "Tue, 26 Oct 2021 10:49:14 +0200" }, { "cves": [], "log": [ "", " * Fix syntax error in libpam0g.postinst when a systemd unit fails,", " Closes: #992538", " * Include upstream patch not to use crypt_checksalt; without this", " passwords set prior to bullseye were considered expired, Closes:", " #992848", " * Support DPKG_ROOT for pam-auth-update, thanks Johannes 'josch' Schauer", " Closes: #983427", "", "" ], "package": "pam", "version": "1.4.0-10", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 26 Aug 2021 13:43:23 -0600" }, { "cves": [], "log": [ "", " * Revert prefer the multiarch path from 1.4.0-8: It turns out that", " Debian uses DEFAULT_MODULE_PATH and _PAM_ISA in the opposite meaning", " of upstream. If I had read the patch header of", " patches-applied/lib_security_multiarch_compat more closely I would", " have noticed this. The effect of 1.4.0-9 is what is stated in the", " 1.4.0-8 changelog: we prefer multiarch paths, but the original patch", " did that.", " * I did test this in 1.4.0-8, but my test design was flawed. I placed a", " invalid shared object in /lib/security and confirmed it did not shadow", " an object in /lib/x86_64-linux-gnu/security. However I realized", " shortly after releasing 1.4.0-8 that a valid shared object in", " /lib/security will shadow one in the multiarch path.", "" ], "package": "pam", "version": "1.4.0-9", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 09 Jul 2021 10:55:02 -0600" }, { "cves": [], "log": [ "", " [ Hideki Yamane ]", " * debian/patches-applied/lib_security_multiarch_compat", " - Fix regression introduced in 1.4.0-1: search both /lib/security and", " /lib/[multiarch_tripple]/security/, Closes: #990790", "", " [ Sam Hartman ]", " * Reword changelog", " * Prefer the multiarch path (_PAM_ISA) to the non-multiarch path.", " That's different than buster, but guarantees everything already", " working in bullseye will continue to work and also guarantees that", " when multiarch modules are available we use them.", "" ], "package": "pam", "version": "1.4.0-8", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Hideki Yamane ", "date": "Tue, 06 Jul 2021 22:09:15 +0900" }, { "cves": [], "log": [ "", " * Updated portuguese debconf translation, thanks Pedro Ribeiro, Closes:", " #983594", " * Updated Simplified Chinese Translations, thanks Boyuan Yang", " * Updated Bulgarian Translation, Thanks Damyan Ivanov", " * Updated translation from the Slovak team, thanks Ladislav Michnovič,", " Closes: #984891", " * Updated Catalan translation, thanks Alex Muntada, Closes: #984568", " * Updated Brazilian Portuguese translation, Thanks Adriano Rafael Gomes,", " Closes: #984656", " * French Debconf translations, thanks Jean-Pierre Giraud , Closes:", " #984910", " * Updated russian Debconf translations, thanks Алексей Шилин, Closes:", " #984878", " * Updated Dutch debconf templates, Thanks Frans Spiesschaert, Closes:", " #984823", " * Updated German Debconf translations, Thanks Sven Joachim", " * Code review fixes for the fix to #982295, thanks Mark Hindley", " - Actually set service to $1 rather than happening to use a variable", " of the same name in enclosing scope", " - Remove dead code setting idl when not used", " * Code review fixes to the fix for #982530, thanks Martin Schurz", " - Include '-' in the file matching regexp so we search", " /etc/pam.d/common-* for uses of pam_tally. The profile check will", " catch this unless the user has overwridden the configuration", " - Fix capitalization of pam_Tally in debconf description", "", "" ], "package": "pam", "version": "1.4.0-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 15 Mar 2021 15:01:55 -0400" }, { "cves": [], "log": [ "", " * Clearly it's been too long since I've done debconf; run", " debconf-updatepo so the translations will show up as needing", " translating.", "" ], "package": "pam", "version": "1.4.0-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 26 Feb 2021 10:48:23 -0500" }, { "cves": [], "log": [ "", " * Remove profiles containing pam_tally or pam_tally2 since we no longer", " build them.", " * Also, fail to permit profiles to be selected that include pam_tally", " once the new pam-auth-update is installed", " * Check for any user-added references to pam_tally and halt the upgrade,", " Closes: #982530", " * Handle services with systemd units but no init scripts, Closes: #982295", " * Register md5sum for new common-password template, Closes: #982898", " * After reading pam-auth-update source, I agree with Lucas Nussbaum", " that common-session is intended only for interactive sessions.", " Otherwise pam-auth-update should not duplicate module configurations", " between common-session-noninteractive and common-session, so update", " the documentation, Closes: #982297", "" ], "package": "pam", "version": "1.4.0-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 25 Feb 2021 15:48:22 -0500" }, { "cves": [], "log": [ "", " * Document in README.source how to avoid multi-arch problems with documentation, Closes: #851650", " * Update header to common-password talking about sha512", " * The fix for #977648 incorrectly assumed how prerm scripts are called; update.", "" ], "package": "pam", "version": "1.4.0-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 03 Feb 2021 12:35:12 -0500" }, { "cves": [], "log": [ "", " [ Josh Triplett ]", " * libpam-runtime.postrm: Remove session-noninteractive files on purge,", " Closes: #978601", "", " [ Sam Hartman ]", " * patches-applied/pam_mkhomedir_stat_before_opendir: Stat the skeleton", " directory before opendir, Closes: #834589", " * libpam-modules.install: Install pam_faillock binaries, Closes: #981092", " * debian/patches-applied/pam_unix_initialize_daysleft : Initialize days before password expire, Closes: #980285", " * pam-configs/unix: Default to yescript rather than sha512. From a theoretical security standpoint, it looks like yescript has similar security properties, assuming (as we typically do in the crypto protocol community) that sha256 is still reasonable. However, in terms of practical resistant to password cracking, particularly in terms of valuing space complexity as well as time complexity, yescript is superior, Closes: #978553", " * No infinite loop on purge of libpam-runtime, Closes: #977648", " * patches-applied/pam_faillock_create_directory: create /run/faillock when needed.", "", "" ], "package": "pam", "version": "1.4.0-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 01 Feb 2021 15:27:08 -0500" }, { "cves": [], "log": [ "", " * Restart services on upgrade to 1.4.0. Closes: #978555.", "" ], "package": "pam", "version": "1.4.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 28 Dec 2020 19:20:38 -0800" }, { "cves": [], "log": [ "", " * New upstream release. Closes: #948188.", " - Stop using obsoleted selinux headers. Closes: #956355.", " - Continue building pam_cracklib, which is deprecated upstream;", " the replacement, pam_passwdqc, is packaged separately.", " - Update symbols file for new symbols.", " - Refresh lintian overrides for changes to available pam modules.", " * Drop patches to implement \"nullok_secure\" option for pam_unix.", " Closes: #674857, #936071, LP: #1860826.", " * debian/patches-applied/cve-2010-4708.patch: drop, applied upstream.", " * debian/patches-applied/nullok_secure-compat.patch: Support", " nullok_secure as a deprecated alias for nullok.", " * debian/pam-configs/unix: use nullok, not nullok_secure.", " * Drop pam_tally and pam_tally2 modules, which have been deprecated", " upstream in favor of pam_faillock. Closes: #569746, LP: #772121.", " * Add hardening+=bindnow to build options, per lintian.", "" ], "package": "pam", "version": "1.4.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 1860826, 772121 ], "author": "Steve Langasek ", "date": "Mon, 28 Dec 2020 06:05:13 +0000" }, { "cves": [], "log": [ "", " * extrausers.patch: update for compatibility with the removal of", " nullok_secure.", "" ], "package": "pam", "version": "1.3.1-5ubuntu11", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 15 Sep 2021 22:39:58 -0700" }, { "cves": [], "log": [ "", " * Fix up the nullok_secure-compat.patch to apply properly on 1.3.1.", "" ], "package": "pam", "version": "1.3.1-5ubuntu10", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 15 Sep 2021 18:28:12 -0700" }, { "cves": [], "log": [ "", " * Correctly document current VCS in debian/control.", " * Drop patches to implement \"nullok_secure\" option for pam_unix.", " Closes: #674857, #936071, LP: #1860826.", " * debian/patches-applied/nullok_secure-compat.patch: Support", " nullok_secure as a deprecated alias for nullok.", " * debian/pam-configs/unix: use nullok, not nullok_secure.", "" ], "package": "pam", "version": "1.3.1-5ubuntu9", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1860826 ], "author": "Steve Langasek ", "date": "Wed, 15 Sep 2021 18:18:19 -0700" }, { "cves": [], "log": [ "", " * Disable custom daemon restart detection code if needrestart is available", " (LP: #1935972)", "" ], "package": "pam", "version": "1.3.1-5ubuntu8", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1935972 ], "author": "Simon Chopin ", "date": "Tue, 13 Jul 2021 10:28:04 +0200" }, { "cves": [], "log": [ "", " * Backport pam_faillock module from pam 1.4.0 (LP: #1927796)", " - debian/patches-applied/add_pam_faillock.patch: add module.", " - debian/patches-applied/pam_faillock_create_directory: create dir", " before creating file in modules/pam_faillock/faillock.c.", " - debian/rules: set execute permissions on pam_faillock test.", " - debian/libpam-modules-bin.install: install faillock binary and man", " page.", "" ], "package": "pam", "version": "1.3.1-5ubuntu7", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1927796 ], "author": "Richard Maciel Costa ", "date": "Thu, 08 Apr 2021 07:06:27 -0400" }, { "cves": [], "log": [ "", " * Fix FTBFS with selinux/flask.h", " - debian/patches-applied/selinux_flask_ftbfs.patch: Fix FTBFS due to", " deprecated selinux/flask.h", "" ], "package": "pam", "version": "1.3.1-5ubuntu6", "urgency": "medium", "distributions": "groovy", "launchpad_bugs_fixed": [], "author": "Mike Salvatore ", "date": "Wed, 05 Aug 2020 21:10:51 -0400" }, { "cves": [], "log": [ "", " * debian/libpam-modules.postinst: Add /snap/bin to $PATH in", " /etc/environment. (LP: #1659719)", "" ], "package": "pam", "version": "1.3.1-5ubuntu5", "urgency": "medium", "distributions": "groovy", "launchpad_bugs_fixed": [ 1659719 ], "author": "Michael Hudson-Doyle ", "date": "Fri, 10 Jul 2020 08:35:49 +1200" }, { "cves": [], "log": [ "", " * Return only PAM_IGNORE or error from pam_motd (LP: #1856703)", "" ], "package": "pam", "version": "1.3.1-5ubuntu4", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [ 1856703 ], "author": "Balint Reczey ", "date": "Tue, 17 Dec 2019 17:41:40 +0100" }, { "cves": [], "log": [ "", " * Fix patches to fix FTBFS", "" ], "package": "pam", "version": "1.3.1-5ubuntu3", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [], "author": "Balint Reczey ", "date": "Thu, 05 Dec 2019 13:18:35 +0100" }, { "cves": [], "log": [ "", " * pam_motd: Export MOTD_SHOWN=pam after showing MOTD (LP: #1855092)", "" ], "package": "pam", "version": "1.3.1-5ubuntu2", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [ 1855092 ], "author": "Balint Reczey ", "date": "Wed, 04 Dec 2019 12:23:57 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", "" ], "package": "pam", "version": "1.3.1-5ubuntu1", "urgency": "medium", "distributions": "disco", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 23:16:59 -0800" }, { "cves": [], "log": [ "", " * xdm restart check was inverted in the prior upload; turn it the right", " way around", " * Correctly display the notification when a manual DM restart is needed.", "" ], "package": "pam", "version": "1.3.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 14 Feb 2019 07:08:47 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " * Dropped changes, included in Debian:", " - Fix the name of the samba service being restarted", " - Fix debian/patches-applied/update-motd to apply the correct changes", " to the README", "" ], "package": "pam", "version": "1.3.1-4ubuntu1", "urgency": "medium", "distributions": "disco", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 15:43:33 -0800" }, { "cves": [], "log": [ "", " * Fix the name of the samba services to be restarted on upgrade.", "" ], "package": "pam", "version": "1.3.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 23:39:03 +0000" }, { "cves": [], "log": [ "", " * Fix debian/patches-applied/update-motd to apply the correct changes", " to the README (should be forwarded to Debian)", " * debian/libpam-modules.lintian-overrides: update for the current lintian", " warning given for DSOs with no dependencies.", " * debian/rules: set $DEB_HOST_MULTIARCH only if unset.", " * debian/source.lintian-overrides: update for the current quilt warnings.", " * debian/control: drop redundant priority fields.", " * Standards-Version 4.3.0.", " * Restore lintian overrides for hardening false-positives.", " * debian/libpam0g.postinst: update the xdm restart handling to cope with", " changes to what xdm writes to utmp. Closes: #922239.", "" ], "package": "pam", "version": "1.3.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 20:41:46 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " * Dropped changes, included in Debian:", " - pam-configs/mkhomedir: Added a config for pam_mkhomedir, disabled", " by default.", " * Dropped changes, obsoleted:", " - debian/patches-applied/cve-2015-3238.patch: removed manpage changes", " so they don't get regenerated during build and cause a multiarch", " installation issue.", " * Fix the name of the samba service being restarted, which was now", " differently wrong in each of Debian and Ubuntu.", " * Update extrausers.patch for changes in the upstream build system.", " * Fix debian/patches-applied/update-motd to apply the correct changes", " to the README (should be forwarded to Debian)", " * debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include changes to the README.", " * Add lintian override for pam_extrausers_chkpwd", "" ], "package": "pam", "version": "1.3.1-2ubuntu1", "urgency": "medium", "distributions": "disco", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 06:07:03 +0000" }, { "cves": [], "log": [ "", " * Bump the version check for service restarts to 1.3.1-2.", " Closes: #922178.", " * Drop hard-coded pre-dep on libpam0g, now superseded by shlibdeps.", "" ], "package": "pam", "version": "1.3.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2019 23:52:04 +0000" }, { "cves": [], "log": [ "", " * New upstream release. Closes: #821408.", " - Don't try to close an excessive number of fds when we have a high", " ulimit. Closes: #890524.", " - Clarify pam_access docs regarding handling of daemons and X sessions.", " Closes: #762110.", " - Fix handling of rhost and tty fields in pam_succeed_if.", " Closes: #889910.", " - Fix wrong documentation of pam_umask module behavior.", " Closes: #825782.", " * Refresh patches.", " * Drop patches included or obsoleted upstream:", " - debian/patches-applied/README-rebuild", " - debian/patches-applied/pam-loginuid-in-containers", " - debian/patches-applied/cve-2013-7041.patch", " - debian/patches-applied/cve-2014-2583.patch", " - debian/patches-applied/cve-2015-3238.patch", " - debian/patches-applied/pam_namespace_fix_bashism.patch", " * Drop unused lintian overrides.", " * Fix lintian warnings; thanks to Andreas Henriksson ", " and Florian Vessaz ", " * Switch source package to 3.0 (quilt) to consume upstream .tar.xz.", " * Update debian/watch.", "", " [ Andreas Henriksson ]", " * Update debian/libpam0g.symbols", " * debian/patches-applied/fix-autoreconf.patch: Do not override user", " variables in Makefile.am", "" ], "package": "pam", "version": "1.3.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2019 07:38:11 +0000" }, { "cves": [], "log": [ "", " * Acknowledge various NMUs; thanks to the various folks who have helped", " keep this package in good condition.", " * debian/control: update VCS headers to point to git (temporarily under", " my personal salsa namespace, until I get around to restoring team", " setup).", " * Actually remove Roger Leigh from uploaders (change not included in", " previous upload). Thanks Roger for your contributions to Debian!", " * Use DEB_BUILD_PROFILES instead of the obsolete DEB_BUILD_PROFILE.", " Closes: #907492.", " * Don't include changes to autogenerated files in patches.", " * Use LC_ALL=C.UTF-8, not LC_ALL=C, when generating documentation.", " * Consistently include documentation changes in patches, for clean source", " package.", " * debian/patches-applied/README-rebuild: rebuild README files with", " current docs toolchain.", "" ], "package": "pam", "version": "1.1.8-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 09 Jan 2019 00:29:55 +0000" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Set Rules-Requires-Root to binary-targets as pam relies on", " chgrp in debian/rules.", " * Update pam-auth-update to detect write errors and properly", " fail when that happens. (Closes: #880501)", " * Remove Roger Leigh from uploaders as he has restired from", " Debian. (Closes: #869348)", " * Reduce priority of libpam0g to optional.", " * Rebuild with a recent version of dpkg-source, which ensures", " that the Build-Depends are correct in the .dsc file.", " (Closes: #890602)", " * Apply patch from Felix Lechner to make pam-auth-update ignore", " editor backup files. (Closes: #519361)", " * Apply update to Brazilian Portuguese translations of the", " debconf templates. Thanks to Adriano Rafael Gomes.", " (Closes: #799417)", "" ], "package": "pam", "version": "1.1.8-3.8", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Niels Thykier ", "date": "Sat, 11 Aug 2018 15:31:24 +0000" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * libpam-modules: Added a config for pam_mkhomedir, disabled by default.", " (Closes: #568577)", " * pam-auth-update: Add support for --enable option which is useful for", " enabling non-default configs without prompting the admin. (LP: #1192719)", "" ], "package": "pam", "version": "1.1.8-3.7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 1192719 ], "author": "Timo Aaltonen ", "date": "Fri, 02 Feb 2018 16:57:43 +0200" }, { "cves": [], "log": [ "", " * pam-auth-update: Add support for --enable option which is useful for", " enabling non-default configs without asking the admin. (LP:", " #1192719)", "" ], "package": "pam", "version": "1.1.8-3.6ubuntu2", "urgency": "medium", "distributions": "bionic", "launchpad_bugs_fixed": [ 1192719 ], "author": "Timo Aaltonen ", "date": "Thu, 05 Apr 2018 15:27:42 +0300" }, { "cves": [], "log": [ "", " * Merge with Debian unstable.", " - Fixes unescaped brace in pam_getenv regex. LP: #1538284.", " - Fixes pam_namespace defaults for compatibility with dash. LP: #1081323.", " * Remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - pam-configs/mkhomedir: Added a config for pam_mkhomedir, disabled", " by default.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/cve-2015-3238.patch: removed manpage changes", " so they don't get regenerated during build and cause a multiarch", " installation issue.", " * Dropped changes, included in Debian:", " - Build-depend on libfl-dev.", " - debian/patches-applied/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE.", " * Fix references to /var/run in update-motd.5. LP: #1571864", " * Fix service restart handling to integrate with systemd instead of", " upstart.", "" ], "package": "pam", "version": "1.1.8-3.6ubuntu1", "urgency": "medium", "distributions": "bionic", "launchpad_bugs_fixed": [ 1538284, 1081323, 1571864 ], "author": "Steve Langasek ", "date": "Thu, 26 Oct 2017 23:23:18 -0700" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * cve-2015-3238.patch: Add the changes in the generated pam_exec.8", " and pam_unix.8 in addition to (and after) the changes to the", " source .xml files. This avoids unwanted rebuilds that can cause", " problems due to differing files on different architectures of", " the Multi-Arch: same libpam-modules. (Closes: #851545)", "" ], "package": "pam", "version": "1.1.8-3.6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Adrian Bunk ", "date": "Sat, 27 May 2017 18:44:02 +0300" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Build-Depend on libfl-dev:native as well, for cross builds.", " Re-closes: #846459", " * Fix \"Unescaped left brace in regex\" with Perl 5.22. Closes: #810873", "" ], "package": "pam", "version": "1.1.8-3.5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Adam Borowski ", "date": "Fri, 30 Dec 2016 14:37:29 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Add libfl-dev to Build-Depends, fixing FTBFS. Closes: #846459", " * Move xsl stuff to Build-Depends from -Indep to fix misbuilt manpages.", " Closes: #812566", "" ], "package": "pam", "version": "1.1.8-3.4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Adam Borowski ", "date": "Sun, 18 Dec 2016 01:03:58 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " [ Steve Langasek ]", " * Updated Swedish translation to correct a typo, thanks to Anders Jonsson", " and Martin Bagge. Closes: #743875", " * Updated Turkish translation, thanks to Mert Dirik .", " (closes: #756756)", " * d/applied-patches/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE. Thanks to Robie Basak", " for the patch. Closes: #783105.", " * Acknowledge security NMU.", " * pam-auth-update: don't mishandle trailing whitespace in profiles.", " LP: #1487103.", "", " [ Laurent Bigonville ]", " * debian/control: Fix Vcs-* and Homepage fields (Closes: #752343)", " * debian/watch: Update watch file and point it to http://www.linux-pam.org", " * debian/patches-applied/pam_namespace_fix_bashism.patch: Fix bashism in", " namespace.init script (Closes: #624842)", " * debian/control: Build-depends against debhelper (>= 9) to match the", " defined debhelper compatibility", " * Rename the cve-2011-4708.patch to cve-2010-4708.patch to match reality,", " thanks to Jakub Wilk for noticing (Closes: #761594)", " * debian/control: Bump Standards-Version to 3.9.8 (no further changes)", " * debian/libpam-doc.doc-base.applications-guide: Fix spelling", " * debian/libpam0g-dev.examples: Do not use shell brace expansion", " * debian/patches-applied/pam-loginuid-in-containers: Updated with the version", " from Ubuntu, this should fix logins in containers (Closes: #726661)", " * debian/patches-applied/update-motd: Updated with the version from Ubuntu:", " use /run/motd.dynamic instead of /var/run/motd, nothing in the archive", " uses the later (Closes: #743286)", " * debian/patches-applied/make_documentation_reproducible.patch: Make the", " build reproducible, removes differences when building with different", " locale values (Closes: #792127)", "" ], "package": "pam", "version": "1.1.8-3.3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 1487103 ], "author": "Laurent Bigonville ", "date": "Wed, 18 May 2016 02:04:29 +0200" }, { "cves": [], "log": [ "", " * No-change rebuild to pick up -fPIE compiler default in static", " libraries", "" ], "package": "pam", "version": "1.1.8-3.2ubuntu3", "urgency": "medium", "distributions": "artful", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 21 Apr 2017 20:53:23 +0000" }, { "cves": [], "log": [ "", " * debian/patches-applied/cve-2015-3238.patch: removed manpage changes", " so they don't get regenerated during build and cause a multiarch", " installation issue. (LP: #1558114)", "" ], "package": "pam", "version": "1.1.8-3.2ubuntu2", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [ 1558114 ], "author": "Marc Deslauriers ", "date": "Wed, 16 Mar 2016 13:34:02 -0400" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include patch to autogenerated manpage file", " - debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - debian/patches-applied/extrausers.patch: Ship pre-generated man page", " - debian/patches-applied/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE.", " - debian/control: have libpam-modules recommend update-motd package", "" ], "package": "pam", "version": "1.1.8-3.2ubuntu1", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 16 Mar 2016 09:50:51 -0400" }, { "cves": [ { "cve": "CVE-2015-3238", "url": "https://ubuntu.com/security/CVE-2015-3238", "cve_description": "The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.", "cve_priority": "low", "cve_public_date": "2015-08-24 14:59:00 UTC" } ], "log": [ "", " * Non-maintainer upload.", " * Fix CVE-2015-3238: DoS/user enumeration due to blocking pipe in pam_unix", " module (Closes: #789986)", "" ], "package": "pam", "version": "1.1.8-3.2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Tianon Gravi ", "date": "Wed, 06 Jan 2016 15:53:31 -0800" }, { "cves": [], "log": [ "", " * d/applied-patches/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE.", "" ], "package": "pam", "version": "1.1.8-3.1ubuntu3", "urgency": "medium", "distributions": "vivid", "launchpad_bugs_fixed": [], "author": "Robie Basak ", "date": "Wed, 22 Apr 2015 08:55:24 +0000" }, { "cves": [], "log": [ "", " * debian/control:", " - have libpam-modules recommend update-motd package", " + while libpam-modules provides pam_motd, which does dynamically", " generate the motd from /etc/update-motd.d on login, hundreds of", " users have asked in the past few years how they might \"force\"", " a MOTD update; this is provided by /usr/sbin/update-motd", " in the tiny update-motd package (already in main); recommend", " this package", "" ], "package": "pam", "version": "1.1.8-3.1ubuntu2", "urgency": "medium", "distributions": "vivid", "launchpad_bugs_fixed": [], "author": "Dustin Kirkland ", "date": "Tue, 11 Nov 2014 12:49:14 -0600" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include patch to autogenerated manpage file", " - debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - debian/patches-applied/extrausers.patch: Ship pre-generated man page", "" ], "package": "pam", "version": "1.1.8-3.1ubuntu1", "urgency": "low", "distributions": "vivid", "launchpad_bugs_fixed": [], "author": "Michael Vogt ", "date": "Mon, 27 Oct 2014 09:57:52 +0100" }, { "cves": [ { "cve": "CVE-2013-7041", "url": "https://ubuntu.com/security/CVE-2013-7041", "cve_description": "The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack.", "cve_priority": "low", "cve_public_date": "2014-05-08 14:29:00 UTC" }, { "cve": "CVE-2014-2583", "url": "https://ubuntu.com/security/CVE-2014-2583", "cve_description": "Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.", "cve_priority": "low", "cve_public_date": "2014-04-10 20:29:00 UTC" } ], "log": [ "", " * Non-maintainer upload by the Security Team.", " * Fix CVE-2013-7041: case-insensitive comparison used for verifying", " passwords in the pam_userdb module (closes: #731368).", " * Fix CVE-2014-2583: multiple directory traversal issues in the", " pam_timestamp module (closes: 757555)", "" ], "package": "pam", "version": "1.1.8-3.1", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Gilbert ", "date": "Sat, 09 Aug 2014 09:50:42 +0000" }, { "cves": [], "log": [ "", " * No-change rebuild to get debug symbols on all architectures.", "" ], "package": "pam", "version": "1.1.8-3ubuntu4", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [], "author": "Brian Murray ", "date": "Tue, 21 Oct 2014 12:32:23 -0700" }, { "cves": [], "log": [ "", " * debian/patches-applied/extrausers.patch:", " - Ship pre-generated man page", "" ], "package": "pam", "version": "1.1.8-3ubuntu3", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [], "author": "Michael Terry ", "date": "Tue, 22 Jul 2014 14:13:31 -0400" }, { "cves": [], "log": [ "", " * debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " * debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " * debian/rules: Make pam_extrausers_chkpwd sguid shadow", "" ], "package": "pam", "version": "1.1.8-3ubuntu2", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [], "author": "Michael Terry ", "date": "Fri, 18 Jul 2014 14:52:08 -0400" }, { "cves": [], "log": [ "", " [ Stéphane Graber ]", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include patch to autogenerated manpage file", " - debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", "", " [ Timo Aaltonen ]", " * pam-configs/mkhomedir: Added a config for pam_mkhomedir, disabled", " by default. (LP: #557013)", "" ], "package": "pam", "version": "1.1.8-3ubuntu1", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [ 557013 ], "author": "Stéphane Graber ", "date": "Fri, 02 May 2014 14:59:10 -0400" }, { "cves": [], "log": [ "", " * debian/rules: On hurd, link libpam explicitly with -lpthread since glibc", " will not dynamically switch between the libc stubs and the libpthread", " implementations on this architecture. Thanks to Samuel Thibault for the", " patch. Closes: #743891.", "" ], "package": "pam", "version": "1.1.8-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Apr 2014 17:49:38 -0700" }, { "cves": [], "log": [ "", " * Mark the libaudit-dev build-dependency linux-any, since it's not", " available on non-Linux archs. Closes: #737035.", "" ], "package": "pam", "version": "1.1.8-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 13 Feb 2014 15:02:00 -0800" }, { "cves": [], "log": [ "", " * debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", "" ], "package": "pam", "version": "1.1.8-1ubuntu2", "urgency": "medium", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Stéphane Graber ", "date": "Fri, 31 Jan 2014 22:11:02 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " * debian/patches-applied/pam_umask_usergroups_from_login.defs.patch: include", " patch to autogenerated manpage file", "" ], "package": "pam", "version": "1.1.8-1ubuntu1", "urgency": "medium", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 16 Jan 2014 02:40:41 +0000" }, { "cves": [], "log": [ "", " * New upstream release.", " - includes upstream changes to pam_exec. Closes: #670147.", " - adds support for newer hashing algorithms to pam_userdb.", " Closes: #671740.", " - fixes handling of 'quiet' argument to pam_listfile, to match the", " documentation. Closes: #592219.", " - fixes handling of @users@@hosts netgroup syntax in access.conf.", " Closes: #681223.", " - fixes installation of the /etc/security/namespace.d directory.", " Closes: #710998.", " - 027_pam_limits_better_init_allow_explicit_root: support for reading", " /proc/1/limits is upstream, this patch now only handles the policy", " of resetting limits by default and not applying glob limits to root.", " - debian/patches/fix-manpage-crud: drop, manpages now being generated", " upstream with a newer, fixed xsltproc.", " - debian/patches/pam_env-fix-overflow.patch, pam_env-fix-dos.patch,", " glibc-2_16-compilation-fix.patch, sys-types-include.patch: drop,", " included upstream.", " * Add build-dependency on pkg-config.", " * Ensure autogenerated files are after source files in all relevant patches,", " so that regenerating documentation doesn't cause build skew.", " * Drop the --disable-regenerate-docu argument, restoring the HTML manuals", " to the libpam-doc package. Closes: #700485.", " * No need to override dh_compress in debian/rules, it already handles .html", " files correctly.", " * debian/libpam-cracklib.prerm: use $DPKG_MAINTSCRIPT_PACKAGE_COUNT to avoid", " prematurely removing the PAM config when the package is installed for", " multiple architectures. Closes: #647428.", "" ], "package": "pam", "version": "1.1.8-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 16 Jan 2014 00:38:42 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " * Dropped changes, merged in Debian:", " - Disable libaudit for stage1 bootstrap.", "" ], "package": "pam", "version": "1.1.3-11ubuntu1", "urgency": "medium", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 13 Jan 2014 21:41:05 -0800" }, { "cves": [], "log": [ "", " [ Wookey ]", " * Disable libaudit for stage1 bootstrap.", "", " [ Steve Langasek ]", " * debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Ignore failure in user namespaces.", " * Use [linux-any] in build-deps, instead of hard-coding a list of", " non-Linux archs. Closes: #634516.", "" ], "package": "pam", "version": "1.1.3-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 14 Jan 2014 03:33:31 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Disable libaudit for stage1 bootstrap.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", "" ], "package": "pam", "version": "1.1.3-10ubuntu1", "urgency": "low", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 20 Oct 2013 18:21:34 -0700" }, { "cves": [], "log": [ "", " * Fix pam-auth-update handling of trailing blank lines in the fields of", " profiles. LP: #1160288.", " * Reintroduce libaudit support now that libaudit has been multiarched.", " Closes: #699159.", "" ], "package": "pam", "version": "1.1.3-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 1160288 ], "author": "Steve Langasek ", "date": "Sun, 20 Oct 2013 15:30:46 -0700" }, { "cves": [], "log": [ "", " * Revert libaudit support for now, because libaudit isn't multiarched yet", " in unstable so this regresses cross-installability. Reopens bug", " #699159.", " * Add an or'ed dependency on cdebconf, which also implements the", " xloadtemplatefile extension that prevents us from depending on just", " 'debconf-2.0'. Thanks to Régis Boudin for the info.", " Closes: #677278.", "" ], "package": "pam", "version": "1.1.3-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2013 23:06:30 +0000" }, { "cves": [], "log": [ "", " * Adjust debian/patches-applied/update-motd to write to /run/motd.dynamic,", " as sysvinit/ssh/login in Debian have been changed to use this file and", " no longer links /etc/motd to /var/run/motd.", "" ], "package": "pam", "version": "1.1.3-8ubuntu3", "urgency": "low", "distributions": "saucy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 18 May 2013 00:07:43 -0500" }, { "cves": [], "log": [ "", " * Disable libaudit for stage1 bootstrap (LP: #1126404)", "" ], "package": "pam", "version": "1.1.3-8ubuntu2", "urgency": "low", "distributions": "raring", "launchpad_bugs_fixed": [ 1126404 ], "author": "Wookey ", "date": "Fri, 15 Feb 2013 12:45:27 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH. LP: #110287.", "" ], "package": "pam", "version": "1.1.3-8ubuntu1", "urgency": "low", "distributions": "raring", "launchpad_bugs_fixed": [ 110287 ], "author": "Steve Langasek ", "date": "Mon, 11 Feb 2013 22:08:44 -0800" }, { "cves": [], "log": [ "", " * Confirm NMU for bug #611136; thanks to Michael Gilbert.", " - As a side effect, there will no longer be errors from reading the", " .pam_environment twice since we are now reading it 0 times.", " LP: #955032.", " * Adjust the pam_env documentation to match the module behavior resulting", " from the previous security upload. Closes: #693995.", " * debian/rules: never regenerate manpages at build time; this may cause", " build skew that breaks the world in a multiarch context. LP: #1095887.", " * debian/patches-applied/glibc-2_16-compilation-fix.patch: fix missing", " include causing build failure with eglibc 2.16. Thanks to Daniel", " Schepler . Closes: #693450.", " * Ditch autoconf patch in favor of a build-dependency on dh-autoreconf,", " which will let us keep up-to-date with newer autotools. In the present", " instance, this gets us aarch64 support.", " * Install pam_timestamp_check - and while we're at it, move the manpage", " to the correct binary package. Closes: #648695.", " * Update lintian overrides to suppress some noise about hardening and", " manpages.", " * Enable audit support, by popular demand. This should have no major", " impact unless you're also running auditd; but I reserve the right to", " disable this again in the event that this causes a performance hit or", " breaks upgrades (since the dependency is pulled into libpam, not just", " into pam_tty_audit). Closes: #699159, LP: #937005.", "" ], "package": "pam", "version": "1.1.3-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 955032, 1095887, 937005 ], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2013 05:36:29 +0000" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Fix cve-2010-4708: user-configurable .pam_environment allows", " administrator-level changes without root access (closes: #611136).", "" ], "package": "pam", "version": "1.1.3-7.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Gilbert ", "date": "Sun, 29 Apr 2012 02:23:26 -0400" }, { "cves": [], "log": [ "", " [ Nathan Williams ]", " * Add /usr/local/games to PATH. LP: #110287.", "" ], "package": "pam", "version": "1.1.3-7ubuntu3", "urgency": "low", "distributions": "quantal", "launchpad_bugs_fixed": [ 110287 ], "author": "Steve Langasek ", "date": "Tue, 03 Jul 2012 06:55:25 +0000" }, { "cves": [], "log": [ "", " * No-change rebuild with gzip 1.4-1ubuntu2 to get multiarch-clean", " compression of manpages. LP: #871083.", "" ], "package": "pam", "version": "1.1.3-7ubuntu2", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [ 871083 ], "author": "Steve Langasek ", "date": "Wed, 08 Feb 2012 17:15:39 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", "" ], "package": "pam", "version": "1.1.3-7ubuntu1", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 28 Jan 2012 11:36:07 -0800" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Danish, thanks to Joe Dalton (closes: #648382)", " - French, thanks to Jean-Baka Domelevo Entfellner ", " (closes: #649850)", " - Dutch, thanks to Jeroen Schot ", " (closes: #650755)", " - Russian, thanks to Yuri Kozlov (closes: #650867)", " - Portuguese, thanks to Pedro Ribeiro ", " (closes: #652493)", " - German, thanks to Sven Joachim (closes: #653407)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #654043)", " - Bulgarian, thanks to Damyan Ivanov (closes: #656518)", " - Slovak, thanks to Ivan Masár (closes: #656521)", " - Japanese, thanks to Kenshi Muto (closes: #656834)", " - Polish, thanks to Michał Kułach ", " (closes: #657476)", " - Catalan, thanks to Innocent De Marchi ", " (closes: #657489)", " - Czech, thanks to Miroslav Kure ", " (closes: #657578)", " - Swedish, thanks to Martin Bagge (closes: #651349)", "" ], "package": "pam", "version": "1.1.3-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 28 Jan 2012 10:57:49 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " * Dropped changes, included in Debian:", " - debian/patches-applied/update-motd: set a sane umask before calling", " run-parts, and restore the old mask afterwards, so /run/motd gets", " consistent permissions.", " - debian/patches-applied/update-motd: new module option for pam_motd,", " 'noupdate', which suppresses the call to run-parts /etc/update-motd.d.", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " * Build-depend on libfl-dev in addition to flex, for cross-building", " support.", "" ], "package": "pam", "version": "1.1.3-6ubuntu1", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Nov 2011 21:15:00 -0800" }, { "cves": [], "log": [ "", " * debian/patches-applied/hurd_no_setfsuid: we don't want to check all", " setre*id() calls; we know that there are situations where some of these", " may fail but we don't care. As long as the last setre*id() call in each", " set succeeds, that's the state we mean to be in.", " * debian/libpam0g.postinst: according to Kubuntu developers, kdm no longer", " keeps libpam loaded persistently at runtime, so it's not necessary to", " force a kdm restart on ABI bump. Which is good, since restarting kdm", " now seems to also log users out of running sessions, which we rather", " want to avoid. Closes: #632673, LP: #744944.", " * debian/patches-applied/update-motd: set a sane umask before calling", " run-parts, and restore the old mask afterwards, so /run/motd gets", " consistent permissions. LP: #871943.", " * debian/patches-applied/update-motd: new module option for pam_motd,", " 'noupdate', which suppresses the call to run-parts /etc/update-motd.d.", " LP: #805423.", " * debian/libpam0g.templates, debian/libpam0g.postinst: add a new question,", " libraries/restart-without-asking, that allows admins to accept the", " service restarts once for all so that they don't have to repeatedly", " say \"ok\". LP: #745004.", " * debian/libpam-runtime.templates, debian/local/pam-auth-update: add a", " new 'title' template, so pam-auth-update doesn't give a blank title", " when called outside of a maintainer script. LP: #882794.", "" ], "package": "pam", "version": "1.1.3-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 744944, 871943, 805423, 745004, 882794 ], "author": "Steve Langasek ", "date": "Sun, 06 Nov 2011 19:43:14 -0800" }, { "cves": [], "log": [ "", " * Rebuild with dpkg 1.16.1.1ubuntu2 to restore large file support.", "" ], "package": "pam", "version": "1.1.3-5ubuntu2", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 01 Nov 2011 16:59:55 -0400" }, { "cves": [ { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" } ], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - add debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " (Closes: #583958)", " * Dropped changes, included in Debian:", " - debian/patches-applied/CVE-2011-3148.patch", " - debian/patches-applied/CVE-2011-3149.patch", " - debian/patches-applied/update-motd: updated to use clean environment", " and absolute paths in modules/pam_motd/pam_motd.c.", " * debian/libpam0g.postinst: the init script for 'samba' is now named 'smbd'", " in Ubuntu, so fix the restart handling.", " * debian/patches-applied/update-motd: set a sane umask before calling", " run-parts, and restore the old mask afterwards, so /run/motd gets", " consistent permissions. LP: #871943.", " * debian/patches-applied/update-motd: new module option for pam_motd,", " 'noupdate', which suppresses the call to run-parts /etc/update-motd.d.", " LP: #805423.", "" ], "package": "pam", "version": "1.1.3-5ubuntu1", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [ 871943, 805423 ], "author": "Steve Langasek ", "date": "Sun, 30 Oct 2011 09:45:00 -0600" }, { "cves": [ { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" } ], "log": [ "", " [ Kees Cook ]", " * debian/patches-applied/pam_unix_dont_trust_chkpwd_caller.patch: use", " setresgid() to wipe out saved-gid just in case.", " * debian/patches-applied/008_modules_pam_limits_chroot:", " - fix off-by-one when parsing configuration file.", " - when using chroot, chdir() to root to lose links to old tree.", " * debian/patches-applied/022_pam_unix_group_time_miscfixes,", " debian/patches-applied/026_pam_unix_passwd_unknown_user,", " debian/patches-applied/054_pam_security_abstract_securetty_handling:", " improve descriptions.", " * debian/patches-applied/{007_modules_pam_unix,055_pam_unix_nullok_secure}:", " drop unneeded no-op change to reduce delta from upstream.", " * debian/patches-applied/hurd_no_setfsuid: check all set*id() calls.", " * debian/patches-applied/update-motd: correctly clear environment when", " building motd.", " * debian/patches-applied/pam_env-fix-overflow.patch: fix stack overflow", " in environment file parsing (CVE-2011-3148).", " * debian/patches-applied/pam_env-fix-dos.patch: fix DoS in environment", " file parsing (CVE-2011-3149).", "" ], "package": "pam", "version": "1.1.3-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 27 Oct 2011 21:33:57 -0700" }, { "cves": [], "log": [ "", " * Make sure shared library links are also installed to the multiarch", " directory, not just the .a files; otherwise the static libs get found", " first by the linker. Thanks to Russ Allbery for catching this.", " Closes: #642952.", "" ], "package": "pam", "version": "1.1.3-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 25 Sep 2011 22:33:55 +0000" }, { "cves": [], "log": [ "", " * Look for /etc/init.d/postgresql, not /etc/init.d/postgresql-8.{2,3},", " for service restarts; the latter are obsolete since squeeze.", " Closes: #631511.", " * Move debian/libpam0g-dev.install to debian/libpam0g-dev.install.in", " and substitute the multiarch path at build time, so our .a files go to", " the multiarch dir instead of to /usr/lib. Thanks to Riku Voipio for", " pointing out the bug.", " * debian/control: adjust the package descriptions, as the current ones", " use some awkward language that's gone unnoticed for a long time. Thanks", " to Martin Eberhard Schauer for pointing this", " out. Closes: #633863.", " * Build-depend on debhelper 8.9.4 and bump debian/compat to 9 for", " dpkg-buildflags integration, and drop manual setting of -g -O options in", " CFLAGS now that we can let dh do it for us", " * Don't set --sbindir when calling configure; upstream takes care of this", " for us", "" ], "package": "pam", "version": "1.1.3-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 24 Sep 2011 20:08:56 +0000" }, { "cves": [ { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: possible code execution via incorrect environment file", " parsing (LP: #874469)", " - debian/patches-applied/CVE-2011-3148.patch: correctly count leading", " whitespace when parsing environment file in modules/pam_env/pam_env.c.", " - CVE-2011-3148", " * SECURITY UPDATE: denial of service via overflowed environment variable", " expansion (LP: #874565)", " - debian/patches-applied/CVE-2011-3149.patch: when overflowing, exit", " with PAM_BUF_ERR in modules/pam_env/pam_env.c.", " - CVE-2011-3149", " * SECURITY UPDATE: code execution via incorrect environment cleaning", " - debian/patches-applied/update-motd: updated to use clean environment", " and absolute paths in modules/pam_motd/pam_motd.c.", " - CVE-2011-XXXX", "" ], "package": "pam", "version": "1.1.3-2ubuntu2.1", "urgency": "low", "distributions": "oneiric-security", "launchpad_bugs_fixed": [ 874469, 874565 ], "author": "Marc Deslauriers ", "date": "Tue, 18 Oct 2011 09:33:47 -0400" }, { "cves": [], "log": [ "", " * Merge with Debian to get bug fix for unknown kernel rlimits. Remaining", " changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - add debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " (Closes: #583958)", " * Dropped changes:", " - debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " no need to bump the hard limit for number of file descriptors any more", " since we read kernel limits directly now.", "" ], "package": "pam", "version": "1.1.3-2ubuntu1", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Kees Cook ", "date": "Thu, 18 Aug 2011 16:41:18 -0500" }, { "cves": [], "log": [ "", " [ Kees Cook ]", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " - only report about unknown kernel rlimits when \"debug\" is set", " (Closes: 625226, LP: #794531).", "", " [ Steve Langasek ]", " * Build for multiarch. Closes: #463420.", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " don't reset the process niceness for root; since it's root, they can", " still renice to a lower nice level if they need to and changing the", " nice level by default is unexpected behavior. Closes: #594377.", "" ], "package": "pam", "version": "1.1.3-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 794531 ], "author": "Steve Langasek ", "date": "Tue, 21 Jun 2011 11:41:12 -0700" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * debian/patches/pam_motd-legal-notice: use pam_modutil_gain/drop_priv", " common helper functions, instead of hand-rolled uid-setting code.", "", " [ Martin Pitt ]", " * debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " (LP: #253096, UbuntuSpec:umask-to-0002)", " * debian/local/pam-auth-update: Add the new md5sum of above files.", " * Add debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it from", " /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined there.", " This restores compatibility with the pre-PAM behaviour of login.", " (Closes: #583958)", "" ], "package": "pam", "version": "1.1.3-1ubuntu3", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [ 253096 ], "author": "Martin Pitt ", "date": "Fri, 24 Jun 2011 11:07:57 +0200" }, { "cves": [], "log": [ "", " * debian/patches-applied/update-motd-manpage-ref: refresh patch to apply", " cleanly against new upstream.", "" ], "package": "pam", "version": "1.1.3-1ubuntu2", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 04 Jun 2011 14:20:17 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " bump the hard limit for number of file descriptors, to keep pace with", " the changes in the kernel.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - New patch, lib_security_multiarch_compat, which lets us reuse the", " upstream --enable-isadir functionality to support a true path for", " module lookups; this way we don't have to force a hard transition to", " multiarch, but can support resolving modules in both the multiarch and", " non-multiarch directories.", " - build for multiarch, splitting our executables out of libpam-modules", " into a new package, libpam-modules-bin, so that modules can be", " co-installable between architectures.", " * Dropped changes:", " - bumping the service restart version in libpam0g.postinst to ensure", " servers don't fail to find the pam modules in the new paths; the min", " version requirement upstream is higher than this now.", "" ], "package": "pam", "version": "1.1.3-1ubuntu1", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 04 Jun 2011 14:04:19 -0700" }, { "cves": [ { "cve": "CVE-2010-3853", "url": "https://ubuntu.com/security/CVE-2010-3853", "cve_description": "pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3316", "url": "https://ubuntu.com/security/CVE-2010-3316", "cve_description": "The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pam_xauth PAM check.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3430", "url": "https://ubuntu.com/security/CVE-2010-3430", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3431", "url": "https://ubuntu.com/security/CVE-2010-3431", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3435", "url": "https://ubuntu.com/security/CVE-2010-3435", "cve_description": "The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" } ], "log": [ "", " * New upstream release.", " - Fixes CVE-2010-3853, executing namespace.init with an insecure", " environment set by the caller. Closes: #608273.", " - Fixes CVE-2010-3316 CVE-2010-3430 CVE-2010-3431 CVE-2010-3435.", " Closes: #599832.", " * Port hurd_no_setfsuid patch to new pam_modutil_{drop,restore}_priv", " interface; now possibly upstreamable", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " set a better default RLIMIT_MEMLOCK value for BSD kernels. Thanks to", " Petr Salinger for the fix. Closes: #602902.", " * bump the minimum version check in maintainer scripts for the restart", " handling.", "" ], "package": "pam", "version": "1.1.3-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 04 Jun 2011 03:10:50 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " bump the hard limit for number of file descriptors, to keep pace with", " the changes in the kernel.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - New patch, lib_security_multiarch_compat, which lets us reuse the", " upstream --enable-isadir functionality to support a true path for", " module lookups; this way we don't have to force a hard transition to", " multiarch, but can support resolving modules in both the multiarch and", " non-multiarch directories.", " - build for multiarch, splitting our executables out of libpam-modules", " into a new package, libpam-modules-bin, so that modules can be", " co-installable between architectures.", " - bumping the service restart version in libpam0g.postinst to ensure", " servers don't fail to find the pam modules in the new paths.", " * bump debhelper build-dep for final multiarch support.", "" ], "package": "pam", "version": "1.1.2-3ubuntu1", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 20 May 2011 12:53:24 -0700" }, { "cves": [], "log": [ "", " [ Kees Cook ]", " * 027_pam_limits_better_init_allow_explicit_root: load rlimit defaults", " from the kernel (via /proc/1/limits), instead of continuing to hardcode", " the settings internally. Fall back to internal defaults when the kernel", " rlimits are not found. Closes: #620302. (LP: #746655, #391761)", "", " * Updated debconf translations:", " - Vietnamese, thanks to Clytie Siddall ", " (closes: #601197)", " - Dutch, thanks to Eric Spreen (closes: #605592)", " - Danish, thanks to Joe Dalton (closes: #606739)", " - Catalan, thanks to Innocent De Marchi ", " (closes: #622786)", "" ], "package": "pam", "version": "1.1.2-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 746655, 391761 ], "author": "Steve Langasek ", "date": "Sun, 01 May 2011 01:49:11 -0700" }, { "cves": [], "log": [ "", " * Check if gdm is actually running before trying to reload it. (LP: #745532)", "" ], "package": "pam", "version": "1.1.2-2ubuntu8", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 745532 ], "author": "Stéphane Graber ", "date": "Mon, 11 Apr 2011 21:57:36 -0400" }, { "cves": [], "log": [ "", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " bump the hard limit for number of file descriptors, to keep pace with", " the changes in the kernel. Fortunately this shadowing should all go", " away next cycle when we can start to grab defaults directly from /proc.", " LP: #663090", "" ], "package": "pam", "version": "1.1.2-2ubuntu7", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 663090 ], "author": "Steve Langasek ", "date": "Tue, 05 Apr 2011 13:02:02 -0700" }, { "cves": [], "log": [ "", " * debian/libpam0g.postinst: according to Kubuntu developers, kdm no longer", " keeps libpam loaded persistently at runtime, so it's not necessary to", " force a kdm restart on ABI bump. Which is good, since restarting kdm", " now seems to also log users out of running sessions, which we rather", " want to avoid. LP: #744944.", "" ], "package": "pam", "version": "1.1.2-2ubuntu6", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 744944 ], "author": "Steve Langasek ", "date": "Tue, 29 Mar 2011 13:16:26 -0700" }, { "cves": [], "log": [ "", " * Force a service restart on upgrade to the new libpam0g, to ensure", " servers don't fail to find the pam modules in the new paths.", " * libpam-modules should also Pre-Depend: on the multiarch-aware libpam0g,", " for the same reason.", "" ], "package": "pam", "version": "1.1.2-2ubuntu5", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 22 Mar 2011 02:19:51 -0700" }, { "cves": [], "log": [ "", " * Build for multiarch; FFe LP: #733501.", " * Split our executables out of libpam-modules into a new package,", " libpam-modules-bin, so that modules can be co-installable between", " architectures.", " * New patch, lib_security_multiarch_compat, which lets us reuse the", " upstream --enable-isadir functionality to support a true path for module", " lookups; this way we don't have to force a hard transition to multiarch,", " but can support resolving modules in both the multiarch and", " non-multiarch directories.", " * Build-Depend on the multiarchified debhelper.", " * Add Pre-Depends: ${misc:Pre-Depends} for multiarch-support.", "" ], "package": "pam", "version": "1.1.2-2ubuntu4", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 733501 ], "author": "Steve Langasek ", "date": "Fri, 18 Mar 2011 00:12:26 -0700" }, { "cves": [], "log": [ "", " * Er, but let's get this patch applying cleanly.", "" ], "package": "pam", "version": "1.1.2-2ubuntu3", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 21 Feb 2011 16:10:11 -0800" }, { "cves": [], "log": [ "", " * debian/patches/update-motd-manpage-ref: patch the manpage too, not just", " the xml source.", "" ], "package": "pam", "version": "1.1.2-2ubuntu2", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 21 Feb 2011 15:47:27 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", "" ], "package": "pam", "version": "1.1.2-2ubuntu1", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 17 Feb 2011 16:15:47 -0800" }, { "cves": [], "log": [ "", " * debian/patches-applied/hurd_no_setfsuid: handle some new calls to", " setfsuid in pam_xauth that I overlooked, so that the build works again", " on non-Linux. Closes: #613630.", "" ], "package": "pam", "version": "1.1.2-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 16 Feb 2011 09:27:11 -0800" }, { "cves": [], "log": [ "", " * New upstream release.", " - Add support for NSS groups to pam_group. Closes: #589019,", " LP: #297408.", " - Support cross-building the package. Thanks to Neil Williams", " for the patch. Closes: #284854.", " * debian/rules: pass getconf LFS_CFLAGS so that we get a 64-bit rlimit", " interface. Closes: #579402.", " * Drop patches conditional_module,_conditional_man and", " mkhomedir_linking.patch, which are included upstream.", " * debian/patches/hurd_no_setfsuid: pam_env and pam_mail now also use", " setfsuid, so patch them to be likewise Hurd-safe.", " * Update debian/source.lintian-overrides to clean up some spurious", " warnings.", " * debian/libpam-modules.postinst: if any 'min=n' options are found in", " /etc/pam.d/common-password, convert them on upgrade to 'minlen=n' for", " compatibility with upstream.", " * debian/NEWS: document the disappearance of 'min=n', in case users have", " encoded this option elsewhere outside of /etc/pam.d/common-password.", " * debian/patches/007_modules_pam_unix: drop compatibility handling of", " 'max=' no-op; use of this option will now log an error, as warned three", " years ago.", " * Bump Standards-Version to 3.9.1.", " * Add lintian overrides for a few more spurious warnings.", " * debian/patches-applied/no_PATH_MAX_on_hurd: define PATH_MAX for", " compatibility when it's not already set. Closes: #552043.", " * debian/local/pam-auth-update: Don't try to pass embedded newlines to", " debconf; backslash-escape them instead and use CAPB escape.", " * debian/local/pam-auth-update: sort additional module options before", " writing them out, so that we don't wind up with a different config file", " on every invocation. Thanks to Jim Paris for the patch.", " Closes: #594123.", " * debian/libpam-runtime.{postinst,templates}: since 1.1.2-1 is targeted", " for post-squeeze, we don't need to support upgrades from 1.0.1-6 to", " 1.0.1-10 anymore. Drop the debconf error note about having configured", " your system with a lack of authentication, so that translators don't", " spend any more time on it.", " * Updated debconf translations:", " - Swedish, thanks to Martin Bagge (closes: #575875)", "" ], "package": "pam", "version": "1.1.2-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 297408 ], "author": "Steve Langasek ", "date": "Tue, 15 Feb 2011 23:21:41 -0800" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Italian, thanks to Nicole B. (closes: #602112)", "" ], "package": "pam", "version": "1.1.1-7", "urgency": "low", "distributions": "UNRELEASED", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 17 Nov 2010 16:53:46 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " * Dropped changes:", " - libpam-modules depend on base-files (>= 5.0.0ubuntu6): 5.0.0ubuntu20", " is in 10.04 LTS and this is an essential package, so no more need for", " the versioned dependency.", "" ], "package": "pam", "version": "1.1.1-6.1ubuntu1", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 15 Feb 2011 23:36:47 -0800" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Fix pending l10n issues. Debconf translations:", " - Czech (Miroslav Kure). Closes: #598329", " - Slovak (Ivan Masár). Closes: #600164", " - Japanese (Kenshi Muto). Closes: #600247", " - Finnish (Esko Arajärvi). Closes: #600641", "" ], "package": "pam", "version": "1.1.1-6.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Christian Perrier ", "date": "Tue, 19 Oct 2010 07:30:49 +0200" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Swedish, thanks to Martin Bagge (closes: #575875)", "" ], "package": "pam", "version": "1.1.1-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 05 Sep 2010 23:36:35 -0700" }, { "cves": [], "log": [ "", " * debian/rules: pass getconf LFS_CFLAGS so that we get a 64-bit rlimit", " interface. Closes: #579402.", " * Update debian/source.lintian-overrides to clean up some spurious", " warnings.", " * Bump Standards-Version to 3.9.1.", " * Add lintian overrides for a few more spurious warnings.", " * debian/patches-applied/no_PATH_MAX_on_hurd: define PATH_MAX for", " compatibility when it's not already set. Closes: #552043.", " * debian/local/pam-auth-update: Don't try to pass embedded newlines to", " debconf; backslash-escape them instead and use CAPB escape.", " * debian/local/pam-auth-update: sort additional module options before", " writing them out, so that we don't wind up with a different config file", " on every invocation. Thanks to Jim Paris for the patch.", " Closes: #594123.", "" ], "package": "pam", "version": "1.1.1-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 05 Sep 2010 12:42:34 -0700" }, { "cves": [ { "cve": "CVE-2010-0832", "url": "https://ubuntu.com/security/CVE-2010-0832", "cve_description": "pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to \"user file stamps\" and the motd.legal-notice file.", "cve_priority": "high", "cve_public_date": "2010-07-12 16:30:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: root privilege escalation via symlink following.", " - debian/patches-applied/pam_motd-legal-notice: drop privs for work.", " - CVE-2010-0832", "" ], "package": "pam", "version": "1.1.1-4ubuntu2", "urgency": "low", "distributions": "maverick-security", "launchpad_bugs_fixed": [], "author": "Kees Cook ", "date": "Mon, 25 Oct 2010 06:40:32 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", "" ], "package": "pam", "version": "1.1.1-4ubuntu1", "urgency": "low", "distributions": "maverick", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 16 Aug 2010 19:12:35 -0700" }, { "cves": [], "log": [ "", " * debian/patches/conditional_module,_conditional_man: if we don't have the", " libraries required for building pam_tty_audit, we shouldn't install the", " manpage either. LP: #588547.", " * Updated debconf translations:", " - Portuguese, thanks to Eder L. Marques ", " (closes: #581746)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #592172)", " - Galician, thanks to Jorge Barreiro ", " (closes: #592808)", " * Don't pass --version-script options when linking executables,", " only when linking libraries. Thanks to Julien Cristau", " for the fix. Closes: #582362.", "" ], "package": "pam", "version": "1.1.1-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 588547 ], "author": "Steve Langasek ", "date": "Sun, 15 Aug 2010 21:53:46 -0700" }, { "cves": [], "log": [ "", " * Trigger a rebuild, applying changes from 1.1.1-2ubuntu2 which", " were previously not committed to bzr", "" ], "package": "pam", "version": "1.1.1-3ubuntu2", "urgency": "low", "distributions": "maverick", "launchpad_bugs_fixed": [], "author": "Dustin Kirkland ", "date": "Thu, 13 May 2010 10:04:23 +0200" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " * Dropped changes:", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade - upgrades to maverick are", " only supported from lucid, so this delta can be dropped.", " - debian/patches-applied/ubuntu-no-error-if-missingok: 'missingok' option", " is obsoleted by 10.04 LTS and no longer needs to be supported for", " upgrades.", "" ], "package": "pam", "version": "1.1.1-3ubuntu1", "urgency": "low", "distributions": "maverick", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 13 May 2010 00:39:44 +0200" }, { "cves": [], "log": [ "", " * pam-auth-update: fix a bug in our handling of module options when the", " module name contains digits, caused by a buggy regexp. :/ Partially", " addresses LP #369575.", " * Install /sbin/pam_tally2 in the libpam-modules package; thanks to", " Olivier BONHOMME for reporting. Closes: #554010.", "" ], "package": "pam", "version": "1.1.1-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 25 Apr 2010 05:53:44 -0700" }, { "cves": [], "log": [ "", " * debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation,", " LP: #562566", " * debian/patches/update-motd-manpage-ref: add a reference in pam_mod(8)", " to update-motd(5), LP: #552175", "" ], "package": "pam", "version": "1.1.1-2ubuntu2", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [ 562566, 552175 ], "author": "Dustin Kirkland ", "date": "Tue, 13 Apr 2010 16:58:12 -0500" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.1.1-2ubuntu1", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Feb 2010 12:04:18 +0000" }, { "cves": [], "log": [ "", " * Document the new symbols added in 1.1.1 in debian/libpam0g.symbols, and", " raise the minimum version for the service restarting code.", " Closes: #568480.", "" ], "package": "pam", "version": "1.1.1-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 17 Feb 2010 23:21:23 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.1.1-1ubuntu1", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 01 Feb 2010 09:55:02 -0800" }, { "cves": [], "log": [ "", " * New upstream version.", " - restore proper netgroup handling in pam_access.", " Closes: #567385, LP: #513955.", " * Drop patches pam.d-manpage-section, namespace_with_awk_not_gawk, and", " pam_securetty_tty_check_before_user_check, which are included upstream.", " * debian/patches/026_pam_unix_passwd_unknown_user: don't return", " PAM_USER_UNKNOWN on password change of a user that has no shadow entry,", " upstream now implements auto-creating the shadow entry in this case.", " * Updated debconf translations:", " - French, thanks to Jean-Baka Domelevo Entfellner ", " (closes: #547039)", " - Bulgarian, thanks to Damyan Ivanov (closes: #562835)", " * debian/patches/sys-types-include.patch: fix pam_modutil.h so that it can", " be included directly, without having to include sys/types.h first.", " Closes: #556203.", " * Add postgresql-8.3 to the list of services in need of restart on upgrade.", " Closes: #563674.", " * And drop postgresql-{7.4,8.1} from the list, neither of which is present", " in stable.", " * debian/patches/007_modules_pam_unix: recognize that *all* of the password", " hashes other than traditional crypt handle passwords >8 chars in length.", " LP: #356766.", "" ], "package": "pam", "version": "1.1.1-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 513955, 356766 ], "author": "Steve Langasek ", "date": "Mon, 01 Feb 2010 02:04:33 -0800" }, { "cves": [], "log": [ "", " * Brown paper bag: remove the right patch from the series file.", "" ], "package": "pam", "version": "1.1.0-4ubuntu3", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 10 Dec 2009 23:09:03 -0800" }, { "cves": [], "log": [ "", " * \"Rebase\" Ubuntu patches to apply them last in the series.", " * Drop patch ubuntu-regression_fix_securetty, superseded by the more", " precise fix in pam_securetty_tty_check_before_user_check.", "" ], "package": "pam", "version": "1.1.0-4ubuntu2", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 10 Dec 2009 22:52:20 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.1.0-4ubuntu1", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 05 Nov 2009 21:33:15 -0800" }, { "cves": [], "log": [ "", " * debian/patches/pam_securetty_tty_check_before_user_check: new patch,", " to make pam_securetty always return success on a secure tty regardless", " of what username was passed. Thanks to Nicolas François", " for the patch. Closes: #537848", " * debian/local/pam-auth-update: only reset the seen flag on the template", " when there's new information; this avoids reprompting users for the same", " information on upgrade, regardless of the debconf priority used.", " Closes: #544805.", " * libpam0g no longer depends on libpam-runtime; packages that use", " /etc/pam.d/common-* must depend directly on libpam-runtime, and most do", " (including the Essential: yes ones), so let's break this circular", " dependency. Closes: #545086, LP: #424566.", "" ], "package": "pam", "version": "1.1.0-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 424566 ], "author": "Steve Langasek ", "date": "Mon, 14 Sep 2009 18:47:25 -0700" }, { "cves": [], "log": [ "", " * Bump debian/compat to 7, so we can use sane contents in debian/*.install", " * Switch all packages over to dh_install", " * Rename debian/*.lintian to debian/*.lintian-overrides and use dh_lintian", " * Move installation logic out of debian/rules into individual .install", " files", " * Drop superfluous options to dh_installchangelogs, dh_shlibdeps", " * Use debian/clean instead of rm -f'ing files in debian/rules clean target", " * Drop ./configure options that are no-ops", " * Drop the /lib/security/pam_unix_*.so symlinks, which have been deprecated", " now for 10 years and are not used at all if pam-auth-update is in play.", " * Drop the pam_rhosts_auth.so symlink as well, and document in NEWS.Debian", " that this is now obsolete.", " * Drop stale content from README.debian: some of this should have been in", " NEWS.Debian instead (but is so old it's not worth putting it there now),", " some of it is obsolete by the change in package VCS.", " * Convert debian/rules to debhelper 7 and add versioned build-dependencies", " on debhelper and quilt to suit.", " * Drop CFLAGS that we don't need anymore (-fPIC, -D_REENTRANT,", " -D_GNU_SOURCE).", " * Explicitly add -O0 to CFLAGS when noopt is set.", " * debian/patches/autoconf.patch: pull ltmain.sh in, to fix some spurious", " library linkage in the modules.", " * Move pam_cracklib manpage to the libpam-cracklib package, and add the", " requisite Replaces", " * Drop dh_makeshlibs -V; everything from lenny on should use the .symbols", " file instead, making the shlibs redundant so we don't need to care what", " version gets listed there.", "" ], "package": "pam", "version": "1.1.0-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Sep 2009 18:47:45 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", " * Changes merged in Debian:", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.1.0-2ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 04 Sep 2009 01:11:48 -0700" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * debian/patches/pam_unix_dont_trust_chkpwd_caller.patch: fix this patch", " to call setregid() instead of always returning an error on username", " mismatch in unix_chkpwd, needed in the SELinux case and in some corner", " cases with the broken_shadow option. Thanks to Michael Spang for the", " analysis. Closes: #543589.", " * fix the PAM mini-policy to not tell app maintainers that they don't need", " to depend on libpam-modules if they reference modules from there.", " * make libpam-runtime depend on libpam-modules (>= 1.0.1-6) - nothing else", " guarantees that we have pam_unix available for use by pam-auth-update.", " * Use /bin/sh instead of /bin/bash for libpam0g.postinst, since we've", " confirmed there are no longer any bashisms there. Closes: #519973.", " * Clean up the libpam0g postinst a bit; invoke-rc.d has been a guaranteed", " interface for two stable release cycles now", " * debian/patches/namespace_with_awk_not_gawk: fix the sample", " namespace.init script's dependency on non-POSIX features of gawk, since", " we don't use gawk by default. Closes: #518908.", " * Updated debconf translations:", " - German, thanks to Sven Joachim (closes: #544464)", "", " [ Kees Cook ]", " * debian/local/common-password, debian/pam-configs/unix: switch from \"md5\"", " to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.1.0-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 31 Aug 2009 14:21:27 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", " * Dropped changes, superseded upstream:", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf.", "" ], "package": "pam", "version": "1.1.0-1ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 26 Aug 2009 00:40:14 -0700" }, { "cves": [], "log": [ "", " * New upstream version.", " - pam_access no longer does DNS lookups when we know we're comparing", " with a tty name or a service name. Closes: #376209.", " - fixes for manpage spelling. Closes: #488690.", " - fix evaluation of or'ed list of users in time.conf and group.conf.", " Closes: #326407, #514423.", " * Drop patches pam_unix_thread-safe_save_old_password.patch,", " pam_env_ignore_garbage.patch, dont_freeze_password_chain,", " pam_1.0.4_mindays, pam_mail-fix-quiet, pam_unix-chkpwd-wait, and", " cve-2009-0887-libpam-pam_misc.patch, which are included upstream.", " * Trim pam.d-manpage-section patch, which was mostly but not completely", " applied upstream.", " * Update debian/libpam0g.symbols for new extension.", " * Bump the shlibs version as well, for our dpkg-shlibdeps fallback.", " * And bump the version checks in the libpam-modules {pre,post}inst, so that", " the necessary services get restarted for any modules that need the new", " symbols.", " * Add /sbin/mkhomedir_helper to libpam-modules.", " * Document that pam_cracklib no longer checks /etc/security/opasswd.", " Closes: #263767.", " * debian/patches/007_modules_pam_unix: drop divergence from upstream", " that treats \"0\" as a special value in various fields in /etc/shadow,", " and document this in debian/NEWS. Thanks to Nicolas François", " for the detailed analysis.", " Closes: #308229.", " * Updated debconf translations:", " - French, thanks to Jean-Baka Domelevo Entfellner ", " (closes: #521266)", " * Build with LDFLAGS=-Wl,-z,defs to guard against the possibility of", " any undefined symbols (due to typos or otherwise) at build time.", " Closes: #102311.", " * On upgrade from versions before 1.1.0-1, if", " /etc/pam.d/common-session-noninteractive has not been created (because", " the user declined use of pam-auth-update), create it by copying", " /etc/pam.d/common-session. Closes: #543401.", " * debian/patches/fix-man-crud: new patch, fix \"undefined macro\" errors in", " manpages caused by oddities of toolchain used when generating them", " upstream.", "" ], "package": "pam", "version": "1.1.0-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 25 Aug 2009 20:35:26 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " * debian/local/pam-auth-update: prune some more md5sums from intrepid", " pre-release versions, reducing the Ubuntu delta some", " * debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.0.1-11ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 23 Aug 2009 20:14:58 -0700" }, { "cves": [], "log": [ "", " * debian/libpam-runtime.postinst: bump the --force version check to", " 1.0.1-11, to allow for a new common-session-noninteractive config file;", " and include md5sum checking logic that will work the same with old", " unmanaged and new managed /etc/pam.d/common-* files.", " * debian/local/common-{auth,account,session,password}.md5sums: document", " the known md5sums for the new managed files.", " * debian/local/common-session-noninteractive{,.md5sums},", " debian/local/pam-auth-update: split out a session-noninteractive include", " file, so that we can at last distinguish between interactive and", " non-interactive PAM sessions at a policy level. Closes: #169930,", " LP: #287715.", " * debian/local/pam-auth-update: prune md5sums for unsupported upgrade", " paths (intrepid pre-release -> karmic/squeeze)", " * Clean up the PAM mini-policy, which hasn't been touched in a number of", " years and was looking a bit crufty", " * debian/libpam-runtime.templates: correctly tag the URL as a", " non-translatable string.", " * Updated debconf translations:", " - Swedish, thanks to Martin Bagge (closes: #541399)", " - Portuguese, thanks to Américo Monteiro ", " (closes: #541108)", " - Russian, thanks to Yuri Kozlov (closes: #541094)", "" ], "package": "pam", "version": "1.0.1-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 287715 ], "author": "Steve Langasek ", "date": "Sun, 23 Aug 2009 18:07:11 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", "" ], "package": "pam", "version": "1.0.1-10ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 07 Aug 2009 09:50:02 +0100" }, { "cves": [ { "cve": "CVE-2009-0887", "url": "https://ubuntu.com/security/CVE-2009-0887", "cve_description": "Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.", "cve_priority": "low", "cve_public_date": "2009-03-12 15:20:00 UTC" } ], "log": [ "", " [ Steve Langasek ]", " * Updated debconf translations:", " - Finnish, thanks to Esko Arajärvi (closes: #520785)", " - Russian, thanks to Yuri Kozlov (closes: #521874)", " - German, thanks to Sven Joachim (closes: #521530)", " - Basque, thanks to Piarres Beobide ", " (closes: #524285)", " * When no profiles are chosen in pam-auth-update, throw an error message", " and prompt again instead of letting the user end up with an insecure", " system. This introduces a new debconf template. Closes: #519927,", " LP: #410171.", "", " [ Kees Cook ]", " * Add debian/patches/pam_1.0.4_mindays: backport upstream 1.0.4 fixes", " for MINDAYS-Field regression (closes: #514437).", " * debian/control: add missing misc:Depends for packages that need it.", "", " [ Sam Hartman ]", " * Remove conflicts information for transitions prior to woody release", " * Fix lintian overrides for libpam-runtime", " * Overrides for lintian finding quilt patches", " * pam_mail-fix-quiet: patch from Andreas Henriksson", " applied upstream to fix quiet option of pam_mail, Closes: #439268", "", " [ Dustin Kirkland ]", " * debian/patches/update-motd: run the update-motd scripts in pam_motd;", " render update-motd obsolete, LP: #399071", "", " [ Sam Hartman ]", " * cve-2009-0887-libpam-pam_misc.patch: avoid integer signedness problem", " (CVE-2009-0887) (Closes: #520115)", "" ], "package": "pam", "version": "1.0.1-10", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [ 410171, 399071 ], "author": "Steve Langasek ", "date": "Thu, 06 Aug 2009 17:54:32 +0100" }, { "cves": [], "log": [ "", " * Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", "" ], "package": "pam", "version": "1.0.1-9ubuntu3", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 15 Jul 2009 23:55:50 -0700" }, { "cves": [], "log": [ "", " [ Dustin Kirkland ]", " * debian/patches/update-motd: run the update-motd scripts in pam_motd;", " render update-motd obsolete, LP: #399071", " * debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", "" ], "package": "pam", "version": "1.0.1-9ubuntu2", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [ 399071 ], "author": "Steve Langasek ", "date": "Wed, 15 Jul 2009 20:41:52 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.0.1-9ubuntu1", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 20 Mar 2009 19:12:10 -0700" }, { "cves": [], "log": [ "", " * Move the pam module packages to section 'admin'.", " * 027_pam_limits_better_init_allow_explicit_root: defaults need to be", " declared as LIMITS_DEF_DEFAULT instead of LIMITS_DEF_ALL, otherwise", " global limits will fail to be applied. LP: #314222.", "" ], "package": "pam", "version": "1.0.1-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 314222 ], "author": "Steve Langasek ", "date": "Fri, 20 Mar 2009 19:48:47 -0700" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Bulgarian, thanks to Damyan Ivanov (closes: #518121)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #518214)", " - Swedish, thanks to Martin Bagge (closes: #518324)", " - Vietnamese, thanks to Clytie Siddall ", " (closes: #518329)", " - Japanese, thanks to Kenshi Muto (closes: #518335)", " - Slovak, thanks to Ivan Masár (closes: #518341)", " - Czech, thanks to Miroslav Kure (closes: #518992)", " - Portuguese, thanks to Américo Monteiro ", " (closes: #519204)", " - Galician, thanks to Marce Villarino ", " (closes: #519447)", " - Romanian, thanks to Eddy Petrișor ", " (closes: #520552)", " * 027_pam_limits_better_init_allow_explicit_root: set the RLIMIT_MEMLOCK", " limit correctly to match the kernel default, which is not RLIM_INFINITY.", " Closes: #472629.", "" ], "package": "pam", "version": "1.0.1-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 20 Mar 2009 18:15:07 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " * Dropped changes, merged in Debian:", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " - New patch dont_freeze_password_chain, cherry-picked from upstream:", " don't always follow the same path through the password stack on", " the PAM_UPDATE_AUTHTOK pass as was used in the PAM_PRELIM_CHECK", " pass; this Linux-PAM deviation from the original PAM spec causes a", " number of problems, in particular causing wrong return values when", " using the refactored pam-auth-update stack. LP: #303515, #305882.", " - debian/patches/027_pam_limits_better_init_allow_explicit_root:", " Add documentation to the patch showing how to set limits for root.", " * Bump the libpam-cracklib dependency on libpam-runtime to 1.0.1-6,", " reducing the delta with Debian.", " * Drop upgrade handling code from libpam-runtime.postinst that's only", " needed when upgrading from 1.0.1-2ubuntu1, a superseded intrepid", " pre-release version of the package.", " * pam-auth-update: swap out known md5sums from intrepid pre-release versions", " with the md5sums from the released intrepid version", " * pam-auth-update: drop some md5sums that will only be seen on upgrade from", " pre-intrepid versions; skipping over the 8.10 final release is not", " supported, and upgrading via 8.10 means those config files will be", " replaced so the old md5sums will never be seen again.", "" ], "package": "pam", "version": "1.0.1-7ubuntu1", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [ 303515, 305882 ], "author": "Steve Langasek ", "date": "Tue, 03 Mar 2009 17:34:19 -0800" }, { "cves": [], "log": [ "", " * 027_pam_limits_better_init_allow_explicit_root:", " - fix the patch so that our limit resets are actually *applied*,", " which has apparently been broken for who knows how long!", " - shadow the finite kernel defaults for RLIMIT_SIGPENDING and", " RLIMIT_MSGQUEUE as well, so that the preceding change doesn't", " suddenly expose systems to DoS or other issues.", " - include documentation in the patch, giving examples of how to set", " limits for root. Thanks to Jonathan Marsden.", " * pam-auth-update: swap out known md5sums from intrepid pre-release", " versions with the md5sums from the released intrepid version", " * pam-auth-update: set the umask, so we don't accidentally mark", " /etc/pam.d/common-* unreadable. Thanks to Martin Krafft for catching.", " Closes: #518042.", "" ], "package": "pam", "version": "1.0.1-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 03 Mar 2009 17:18:42 -0800" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Vietnamese, thanks to Clytie Siddall ", " * New patch dont_freeze_password_chain, cherry-picked from upstream:", " don't always follow the same path through the password stack on", " the PAM_UPDATE_AUTHTOK pass as was used in the PAM_PRELIM_CHECK", " pass; this Linux-PAM deviation from the original PAM spec causes a", " number of problems, in particular causing wrong return values when", " using the refactored pam-auth-update stack. LP: #303515, #305882.", " * debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", "" ], "package": "pam", "version": "1.0.1-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 303515, 305882 ], "author": "Steve Langasek ", "date": "Sat, 28 Feb 2009 13:36:57 -0800" }, { "cves": [], "log": [ "", " * New patch dont_freeze_password_chain, cherry-picked from upstream:", " don't always follow the same path through the password stack on", " the PAM_UPDATE_AUTHTOK pass as was used in the PAM_PRELIM_CHECK", " pass; this Linux-PAM deviation from the original PAM spec causes a", " number of problems, in particular causing wrong return values when", " using the refactored pam-auth-update stack. LP: #303515, #305882.", "" ], "package": "pam", "version": "1.0.1-5ubuntu2", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [ 303515, 305882 ], "author": "Steve Langasek ", "date": "Fri, 27 Feb 2009 16:20:24 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " * Bump the version numbers referenced in the config files, again, as pam", " has revved in Debian and moved the bar.", " * pam-auth-update: If /var/lib/pam/seen is absent, treat this the same", " as a present but empty file; thanks to Greg Price for the patch.", " LP: #294513.", " * pam-auth-update: Ignore removed profiles when detecting an empty set", " of currently-enabled modules. Thanks to Greg Price for this as well.", " * debian/control: libpam-runtime needs a versioned dependency on", " debconf, because it uses the x_loadtemplatefile extension that's ", " not supported by debconf versions before hardy. LP: #295135.", " * pam-auth-update: trim leading whitespace from multiline fields when", " parsing PAM profiles. LP: #295441.", " * pam-auth-update: factor out the duplicate code used for returning", " the lines for a given module", "", " [ Jonathan Marsden ]", " * debian/patches/027_pam_limits_better_init_allow_explicit_root:", " Add to patch, documenting how to set limits for root user.", " Include an example. Alters limits.conf, limits.conf.5.xml,", " and limits.conf.5 . (LP: #65244)", "" ], "package": "pam", "version": "1.0.1-5ubuntu1", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [ 294513, 295135, 295441, 65244 ], "author": "Steve Langasek ", "date": "Thu, 08 Jan 2009 20:26:25 +0000" }, { "cves": [], "log": [ "", " * Build-conflict with libxcrypt-dev, which otherwise pulls libxcrypt in as", " a dependency of libpam-modules if it's installed during the build.", " Thanks to Larry Doolittle for catching.", " * Don't refer to gnome-screensaver in the debconf template; it isn't", " actually affected by the libpam symbol issue because it forks a separate", " process to display the screensaver dialog.", " * Have libpam-modules Pre-Depend on ${misc:Depends}, so that we can", " warn users about needing to disable xscreensaver and xlockmore", " before libpam-modules is unpacked. Closes: #502140, LP: #256238.", " * Updated debconf translations for the new template:", " - Italian, thanks to David Paleino ", " - Simplified Chinese, thanks to Deng Xiyue", " (closes: #510371)", " - Portuguese, thanks to Américo Monteiro ", " - Swedish, thanks to Martin Bagge (closes: #510379)", " - Japanese, thanks to Kenshi Muto (closes: #510380)", " - Finnish, thanks to Esko Arajärvi (closes: #510382)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #510389)", " - Galician, thanks to Marce Villarino ", " - Slovak, thanks to helix84 (closes: #510412)", " - Bulgarian, thanks to Damyan Ivanov ", " - Czech, thanks to Miroslav Kure <", " (closes: #510608)", " - French, thanks to Steve Petruzzello ", " - German, thanks to Sven Joachim (closes: #510617)", " - Basque, thanks to Piarres Beobide ", " (closes: #510699)", " - Russian, thanks to Yuri Kozlov (closes: #510701)", " - Turkish, thanks to Mert Dirik (closes: #510707)", "" ], "package": "pam", "version": "1.0.1-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 256238 ], "author": "Steve Langasek ", "date": "Tue, 06 Jan 2009 00:05:13 -0800" }, { "cves": [], "log": [ "", " * No-change upload to jaunty to fix publication on armel.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.4", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 18 Nov 2008 14:09:00 +0000" }, { "cves": [], "log": [ "", " * No-change upload of 1.0.1-4ubuntu5.1 to -updates. -proposed package was", " copied while some ports were not built yet.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.3", "urgency": "low", "distributions": "intrepid-updates", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Tue, 11 Nov 2008 14:50:12 +0100" }, { "cves": [], "log": [ "", " * No-change rebuild because the archive admin (me) copied the package", " to jaunty too soon.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.2", "urgency": "low", "distributions": "intrepid-proposed", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 05 Nov 2008 20:28:11 +0000" }, { "cves": [], "log": [ "", " * Allow passwords to change on expired accounts, by passing", " new_authtok_reqd return codes immediately (LP: #291091).", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.1", "urgency": "low", "distributions": "intrepid-proposed", "launchpad_bugs_fixed": [ 291091 ], "author": "Kees Cook ", "date": "Wed, 05 Nov 2008 09:31:45 -0800" }, { "cves": [], "log": [ "", " * debian/libpam0g.postinst: change 'cupsys' to 'cups' in the list of", " default desktop services that are ignored in deciding whether to prompt", " for service restarts on upgrade. Partially addresses LP #278117.", " * debian/libpam0g.postinst: also filter out samba, which may be installed", " on the desktop to enable filesharing.", " * debian/libpam-cracklib.prerm, debian/libpam-runtime.prerm: add the", " ubiquitous debhelper tokens (currently a no-op)", " * pam-auth-update: Use -Initial only for the first profile, even when", " there's no explicit -Initial config for that first profile", " * fix common-session/common-password to use the same overall stack", " structure as auth/account, so that we get the correct behavior when", " all password modules fail. LP: #272232.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 272232 ], "author": "Steve Langasek ", "date": "Wed, 15 Oct 2008 18:11:13 -0700" }, { "cves": [], "log": [ "", " * Fix a bug in the parser that caused spewing of errors when there", " were more lines in the config file following the managed block.", " LP: #270328.", "" ], "package": "pam", "version": "1.0.1-4ubuntu4", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 270328 ], "author": "Steve Langasek ", "date": "Tue, 23 Sep 2008 06:34:56 +0000" }, { "cves": [], "log": [ "", " * Fix up the code that saves state to /var/lib/pam, so that it matches", " what's expected by the code which later compares the saved and active", " profiles in the case that there are both primary and additional", " modules present.", "" ], "package": "pam", "version": "1.0.1-4ubuntu3", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 16 Sep 2008 06:49:56 +0000" }, { "cves": [], "log": [ "", " * Brown paper bag bug: fix a missing comma in pam-auth-update.", "" ], "package": "pam", "version": "1.0.1-4ubuntu2", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 13 Sep 2008 08:55:32 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " * Bump the version numbers referenced in the config files, again, as pam", " has revved in Debian and moved the bar.", " * debian/pam-config/*: refine the password profiles to use a 'primary'", " block, to better parallel the auth structure.", " * Drop '-Final' from the field names in /usr/share/pam-configs, supporting", " these field names for backwards compatibility only", " * Bump the dependency version requirement to 1.0.1-4ubuntu1 for the above", " change", "" ], "package": "pam", "version": "1.0.1-4ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 13 Sep 2008 08:55:19 +0000" }, { "cves": [], "log": [ "", " * High-urgency upload for RC bugfix.", "", " [ Julien Cristau ]", " * pam_unix-chkpwd-wait: don't assume that the unix_chkpwd process exits", " normally; if it was killed by a signal, we don't want to accept the", " password. Closes: #495879.", "", " [ Steve Langasek ]", " * 007_modules_pam_unix: update the manpage at the same time as the xml", " source (grr, autogenerated files in source packages). Closes: #495804.", " * 055_pam_unix_nullok_secure: also don't call the helper at all from", " _unix_blankpasswd when we can detect that null passwords are disallowed,", " to avoid causing spammy logs on successful authentications.", " Closes: #496620.", " * debian/rules: call chgrp *before* calling chmod, lest the sgid bit", " on unix_chkpwd be cleared during the build when using -rsudo.", " Closes: #496983.", "" ], "package": "pam", "version": "1.0.1-4", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 28 Aug 2008 22:59:23 -0700" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * Never remove the .pam-old files; just avoid creating them if --force isn't", " set.", " * Add a manpage for pam-auth-update.", " * Automatically upgrade the boilerplate for /etc/pam.d/common-* if we", " detect that they have not been locally modified.", "", " [ Kees Cook ]", " * debian/local/common-password, debian/pam-configs/unix: switch from \"md5\"", " to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.0.1-3ubuntu5", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 26 Aug 2008 06:33:07 +0000" }, { "cves": [], "log": [ "", " * If two profiles have the same Priority, sort by the profile name to", " ensure a complete sort so we can filter out all the duplicates from the", " list and not write out broken configs. LP: #260371.", "" ], "package": "pam", "version": "1.0.1-3ubuntu4", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 260371 ], "author": "Steve Langasek ", "date": "Fri, 22 Aug 2008 17:33:14 +0000" }, { "cves": [], "log": [ "", " * s/pam-auth-config/pam-auth-update/ in the source, I can't seem to get", " this name consistent to save my life - I'm starting to think I named it", " wrong...", " * Fix the regex used when suppressing jump counts when reading the saved", " config, so that we don't clobber module options with numbers in them.", " * If the target doesn't already exist, don't try to copy it.", " * Filter the config list to exclude configs that no longer exist.", " LP: #260122.", " * Avoid unnecessary sort/grep in the case where we already have a sorted", " list.", " * Implement pam-auth-update --remove, for use in package prerms when called", " with \"remove\".", "" ], "package": "pam", "version": "1.0.1-3ubuntu3", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 260122 ], "author": "Steve Langasek ", "date": "Thu, 21 Aug 2008 15:38:37 -0700" }, { "cves": [], "log": [ "", " * debian/local/common-session: the session stack needs to be handled the", " same way as the password stack, with the possibility of zero primary", " modules; required to fix build failures on the Ubuntu buildds due to", " su not being able to open sessions by default. LP: #259867.", " * debian/libpam-runtime.postinst: when upgrading from the broken", " 1.0.1-2ubuntu1 version, manually edit /etc/pam.d/common-session to", " recover.", "" ], "package": "pam", "version": "1.0.1-3ubuntu2", "urgency": "high", "distributions": "intrepid", "launchpad_bugs_fixed": [ 259867 ], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 13:27:10 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " * Remove spurious 'conflict' with a non-existent module, which was added", " just as an example", "" ], "package": "pam", "version": "1.0.1-3ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 11:58:35 -0700" }, { "cves": [], "log": [ "", " * 055_pam_unix_nullok_secure: don't call _pammodutil_tty_secure with a NULL", " tty argument, since this will cause our helper to segfault instead of", " returning a useful value. Thanks to Troy Davis for the report.", " Closes: #495806.", "" ], "package": "pam", "version": "1.0.1-3", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 11:55:47 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam-runtime.postinst,", " debian/local/common-{auth,password}{,.md5sums}:", " Use the new 'missingok' option by default for pam_smbpass in case", " libpam-smbpass is not installed (LP: #216990); must use \"requisite\"", " rather than \"required\" to prevent \"pam_smbpass migrate\" from firing in", " the event of an auth failure; md5sums updated accordingly.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " * debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", "" ], "package": "pam", "version": "1.0.1-2ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 216990 ], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 09:17:28 +0000" }, { "cves": [], "log": [ "", " * 007_modules_pam_unix: update the documentation to correctly document", " the default minimum password length is 6, not 1.", " * Look for cups instead of cupsys as an init script name when restarting", " services; thanks to Stephen Olander-Waters for pointing this out.", " Closes: #492977.", " * Update the Debian PAM mini-policy to remove references to the", " long-obsolete pam_pwdb, and clarify the relationship between pam_stack", " and @include.", " * Drop various bits of unused cruft from the debian/ directory.", " * Drop libpam-runtime.preinst, only used for upgrades from woody to sarge", " to deal with modified conffiles.", " * Build-Conflict with libdb4.2-dev, which satisfies the libdb-dev", " build-dependency but causes pam_userdb to be silently omitted.", " Closes: #493574.", " * 054_pam_security_abstract_securetty_handling: move the warning log about", " an insecure tty back to pam_securetty proper; we don't want to generate", " log messages every time pam_unix is called as non-root.", " Closes: #493283. As a side-effect, pam_unix no longer logs any warnings", " about NULL password + insecure tty, but I don't think this is critical.", "" ], "package": "pam", "version": "1.0.1-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 08 Aug 2008 10:47:26 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Dropped changes:", " - Linux-PAM/modules/pam_selinux/pam_selinux.8: Ubuntu pam_selinux manpage", " is 2 years newer than Debian's, contains a number of character escaping", " fixes plus content updates", " - debian/patches-applied/ubuntu-pam_selinux_seusers: patch pam_selinux to", " correctly support seusers (backported from changes in PAM 0.99.8). ", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Bound RLIMIT_NICE", " from below as well as from above. Fix off-by-one error when converting", " RLIMIT_NICE to the range of values used by the kernel.", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam-runtime.postinst,", " debian/local/common-{auth,password}{,.md5sums}:", " Use the new 'missingok' option by default for pam_smbpass in case", " libpam-smbpass is not installed (LP: #216990); must use \"requisite\"", " rather than \"required\" to prevent \"pam_smbpass migrate\" from firing in", " the event of an auth failure; md5sums updated accordingly.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " * Refresh patch ubuntu-no-error-if-missingok for the new upstream version.", " * Change Vcs-Bzr to point at the new Ubuntu branch.", "" ], "package": "pam", "version": "1.0.1-1ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 216990 ], "author": "Steve Langasek ", "date": "Mon, 28 Jul 2008 20:58:26 +0000" }, { "cves": [], "log": [ "", " * New upstream version.", " - pam_limits: bound RLIMIT_NICE from below. Closes: #403718.", " - pam_mail: set the MAIL variable even when .hushlogin is set.", " Closes: #421010.", " - new minclass option introduced for pam_cracklib. Closes: #454237.", " - fix a failure to check the string length when matching usernames in", " pam_group. Closes: #444427.", " - fix setting shell security context in pam_selinux. Closes: #451722.", " - use --disable-audit, to avoid libaudit being linked in", " accidentally", " - pam_unix now supports SHA-256 and SHA-512 password hashes.", " Closes: #484249, LP: #245786.", " - pam_rhosts_auth is dropped upstream (closes: #382987); add a compat", " symlink to pam_rhosts to support upgrades for a release, and give a", " warning in NEWS.Debian.", " - new symbol in libpam.so.0, pam_modutil_audit_write; shlibs bump, and", " do another round of service restarts on upgrade.", " - pam_unix helper is now called whenever an unprivileged process", " tries and fails to query a user's account status. Closes: #367834.", " * Drop patches 006_docs_cleanup, 015_hurd_portability,", " 019_pam_listfile_quiet, 024_debian_cracklib_dict_path, 038_support_hurd,", " 043_pam_unix_unknown_user_not_alert, 046_pam_group_example,", " no_pthread_mutexes, limits_wrong_strncpy, misc_conv_allow_sigint.patch,", " pam_tally_audit.patch, 057_pam_unix_passwd_OOM_check, and", " 065_pam_unix_cracklib_disable which have been merged upstream.", " * Patch 022_pam_unix_group_time_miscfixes: partially merged upstream;", " now is really just \"pam_group_miscfixes\".", " * Patch 007_modules_pam_unix partially superseded upstream; stripping", " hpux-style expiry information off of password fields is now supported.", " * New patch pam_unix_thread-safe_save_old_password.patch, to make sure all", " our getpwnam() use in pam_unix is thread-safe (fixes an upstream", " regression)", " * New patch pam_unix_fix_sgid_shadow_auth.patch, fixing an upstream", " regression which prevents sgid shadow apps from being able to authenticate", " any more because the module forces use of the helper and the helper won't", " allow authentication of arbitrary users. This change does mean we're", " going to be noisier for the time being in an SELinux environment, which", " should be addressed but is not a regression on Debian.", " * New patch pam_unix_dont_trust_chkpwd_caller.patch, rolling back an", " upstream change that causes unix_chkpwd to assume that setuid(getuid())", " is sufficient to drop permissions and attempt any authentication on", " behalf of the user.", " * The password-changing helper functionality for SELinux systems has been", " split out into a separate unix_update binary, so at long last we can", " change unix_chkpwd to be sgid shadow instead of suid root.", " Closes: #155583.", " - Update the lintian override to match.", " * Install the new unix_update helper into libpam-modules.", " * Use a pristine upstream tarball instead of repacking; requires various", " changes to debian/rules and debhelper files.", " * Replace the Vcs-Svn field with a Vcs-Bzr field; jumping ship from svn,", " and how!", " * Debconf translations:", " - Romanian, thanks to Igor Stirbu ", " (closes: #491821)", " * Add libpam0g.symbols, for finer-grained package dependencies with", " dpkg-gensymbols.", " * Fix debian/copyright to list the known copyright holders", " * Fix up the doc-base sections for the libpam-doc documentation, \"Apps\"", " should not be part of the section name", " * Also fix up whitespace issues in the doc-base abstracts", " * Fix a typo in the libpam0g-dev description.", " * 027_pam_limits_better_init_allow_explicit_root: RLIM_INFINITY is also", " invalid for RLIMIT_NOFILE, so when resetting the limits for a new session,", " use the kernel default of 1024 instead. Closes: #404836.", " * Create /etc/environment on initial install of libpam-modules (or on", " upgrade from an old version), to quell warnings in the logs about it", " being missing. Closes: #442049.", " * 026_pam_unix_passwd_unknown_user: drop a redundant, and broken, check for", " the NSS source of our user; this was preventing password changes for NIS", " users, which otherwise should have worked. Closes: #203222, LP: #9224.", " * New patch do_not_check_nis_accidentally: respect the 'nis' option", " (set or unset) when looking up the user's password entry for password", " changes. Thanks to Quentin Godfroy for the", " patch. Closes: #469635.", " * Drop patch 049_pam_unix_sane_locking, which upon review is not needed;", " it reduces the length of time we hold the lock, but at the expense of", " being able to enforce minimum times between password changes.", " * debian/watch: upstream has hit 1.0, so we're no longer in a \"pre\"", " directory. Fix up the regex for uscan.", " * Fix the libpam0g-dev examples directory to not include a gratuitous", " .cvsignore file.", " * New patch, pam.d-manpage-section, to fix the manpage references to", " point to section 5 instead of section 8.", " * Update patch PAM-manpage-section to fix the references to pam(7) from", " other manpages. Closes: #470137.", " * Add debian/README.source documenting that this package uses quilt.", " * Bump Standards-Version to 3.8.0.", " * Fix a bug in the uid-restoring code in the hurd_no_setfsuid patch; thanks", " to Tomas Mraz for indirectly bringing this to my", " attention", "" ], "package": "pam", "version": "1.0.1-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 245786, 9224 ], "author": "Steve Langasek ", "date": "Mon, 28 Jul 2008 13:56:26 -0700" }, { "cves": [], "log": [ "", " * Medium-urgency upload for RC bugfix", " * Debconf translations:", " - Italian, thanks to David Paleino (closes: #483913)", " - Slovak, thanks to Ivan Masár (closes: #488908)", " - Turkish, thanks to Mert Dirik (closes: #490880)", " - Basque, thanks to Piarres Beobide ", " (closes: #473975)", " * Drop the 'XS' from Vcs-Svn/Vcs-Browser, since these are now officially", " recognized fields.", " * Add a Homepage field. Closes: #473338.", " * Drop -DCRACKLIB_DICTS from CFLAGS, since the referenced define is no", " longer provided by cracklib2-dev 2.8 and above. This requires a", " build-dependency on the corresponding version of libcrack2-dev.", " Closes: #490236.", "" ], "package": "pam", "version": "0.99.7.1-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 21 Jul 2008 11:49:59 -0700" }, { "cves": [], "log": [ "", " * debian/libpam-modules.postinst: revert addition of ~/bin to the end of the", " default PATH set in /etc/environment as it was pointed out by Colin", " Watson that getenv() does not properly expand '~'", "" ], "package": "pam", "version": "0.99.7.1-6ubuntu2", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Jamie Strandboge ", "date": "Tue, 24 Jun 2008 06:29:40 -0400" }, { "cves": [], "log": [ "", " * Merge from debian unstable", " * Dropped changes:", " - Linux-PAM/modules/pam_limits/README,", " Linux-PAM/modules/pam_selinux/README: Ubuntu versions had some", " insignificant character differences, dropping in favor of Debian", " versions; pam_selinux documentation has dropped \"multiple\", and added", " \"select_context\", and \"use_current_range\" as options.", " - debian/control, debian/local/common-session{,md5sums}: use", " libpam-foreground for session management.", " - Build using db4.5 instead of db4.6.", " * Remaining changes:", " - Linux-PAM/modules/pam_selinux/pam_selinux.8: Ubuntu pam_selinux manpage", " is 2 years newer than Debian's, contains a number of character escaping", " fixes plus content updates; (should send to Debian).", " - debian/control: Maintainer updated.", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf; add ~/bin to PATH", " (LP: #64064); (should send to Debian).", " - debian/libpam-runtime.postinst,", " debian/local/common-{auth,password}{,.md5sums}:", " Use the new 'missingok' option by default for pam_smbpass in case", " libpam-smbpass is not installed (LP: #216990); must use \"requisite\"", " rather than \"required\" to prevent \"pam_smbpass migrate\" from firing in", " the event of an auth failure; md5sums updated accordingly.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running (LP: #141309).", " - debian/applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-pam_selinux_seusers: patch pam_selinux to", " correctly support seusers (backported from changes in PAM 0.99.8). ", " Without this patch login will not get correct security context when ", " using libselinux >= 1.27.2 (LP: #187822).", " - debian/patches-applied/ubuntu-regression_fix_securetty: securetty's", " earlier behavior would correctly prompt for password on bad usernames", " (LP: #139075).", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits. Bound", " RLIMIT_NICE from below as well as from above. Fix off-by-one error when", " converting RLIMIT_NICE to the range of values used by the kernel.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " * Alphabetized this merge changelog entry by filename (easier reading", " against Ubuntu patch).", "" ], "package": "pam", "version": "0.99.7.1-6ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 64064, 216990, 141309, 187822, 139075 ], "author": "Dustin Kirkland ", "date": "Fri, 20 Jun 2008 10:32:00 -0500" }, { "cves": [], "log": [ "", " * Debconf translations:", " - Updated Vietnamese, thanks to Clytie Siddall ", " (closes: #444437)", " - Updated Spanish, thanks to Javier Fernández-Sanguino Peña", " (closes: #444479)", " - Updated German, thanks to Sven Joachim ", " (closes: #444566)", " - Galician, thanks to Jacobo Tarrio (closes: #444758)", " - Updated Czech, thanks to Miroslav Kure ", " (closes: #445022)", " - French, thanks to Cyril Brulebois ", " (closes: #445869)", " - Japanese, thanks to Kenshi Muto (closes: #446584)", " - Dutch, thanks to Bart Cornelis (closes: #448930)", " - Basque, thanks to Piarres Beobide (closes: #457042)", " - Updated Finnish, thanks to Esko Arajärvi (closes: #458264)", " - Swedish, thanks to Christer Andersson ", " (closes: #457674)", " * Make sure the \"audit\" option is specified in octal instead of in decimal,", " so that it doesn't randomly set other options. Thanks to Corey Wright", " for the catch. Closes: #446327.", "" ], "package": "pam", "version": "0.99.7.1-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 16 Mar 2008 02:06:28 -0700" }, { "cves": [], "log": [ "", " * debian/libpam-modules.postinst: Add ~/bin to the end of the default PATH", " set in /etc/environment (LP: #64064).", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu8", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 64064 ], "author": "Dustin Kirkland ", "date": "Thu, 19 Jun 2008 12:52:48 -0500" }, { "cves": [], "log": [ "", " * debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " * debian/local/common-{auth,password}, debian/libpam-runtime.postinst:", " Use the new 'missingok' option by default for pam_smbpass, to", " correct the problem of very loud logging introduced in the previous", " upload when libpam-smbpass is not installed. LP: #216990.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu7", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 216990 ], "author": "Steve Langasek ", "date": "Tue, 22 Apr 2008 18:53:37 +0000" }, { "cves": [], "log": [ "", " * debian/local/common-{auth,password}, debian/libpam-runtime.postinst:", " Add pam_smbpass as an optional module in the stack, to keep NTLM", " passwords (for filesharing) in sync with the main system passwords on a", " best-effort basis. LP: #208419.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu6", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [ 208419 ], "author": "Steve Langasek ", "date": "Tue, 08 Apr 2008 18:21:40 +0000" }, { "cves": [], "log": [ "", " * debian/local/common-session: Drop libpam-foreground. It's gone for good,", " and we do not want this in the PAM config for new installations, since it", " just spams syslog with error messages. (LP: #198714)", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu5", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [ 198714 ], "author": "Martin Pitt ", "date": "Tue, 11 Mar 2008 11:22:11 +0100" }, { "cves": [], "log": [ "", " * ubuntu-pam_selinux_seusers: patch pam_selinux to correctly support", " seusers (backported from changes in PAM 0.99.8). Without this patch", " login will not get correct security context when using libselinux", " >= 1.27.2 (LP: #187822).", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu4", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [ 187822 ], "author": "Caleb Case ", "date": "Wed, 30 Jan 2008 06:39:48 -0500" }, { "cves": [], "log": [ "", " * Temporarily reenable libpam-foreground in common-session again, until", " dbus' at_console policy works with ConsoleKit.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu3", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Thu, 29 Nov 2007 15:17:54 +0100" }, { "cves": [], "log": [ "", " * debian/local/common-session{,.md5sums}, debian/control: Drop", " libpam-foreground, superseded by ConsoleKit integration into hal.", " * debian/control: Build against libdb4.6 again. This drops this Debian delta", " and 4.6 is our target version in Hardy.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu2", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Thu, 22 Nov 2007 18:56:47 +0100" }, { "cves": [], "log": [ "", " * Resynchronise with Debian. Remaining changes:", " - debian/control, debian/local/common-session{,md5sums}: use", " libpam-foreground for session management.", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf.", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits. Bound", " RLIMIT_NICE from below as well as from above. Fix off-by-one error when", " converting RLIMIT_NICE to the range of values used by the kernel.", " (Originally patch 101; converted to quilt.)", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - debian/patches-applied/ubuntu-regression_fix_securetty: securetty's", " earlier behavior would correctly prompt for password on bad usernames", " (LP: #139075).", " - Build using db4.5 instead of db4.6.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running (LP: #141309).", " * debian/libpam0g.postinst: don't display a debconf warning about display", " managers that need restarting when update-manager is running, instead", " signal to update-notifier if a reboot is required.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu1", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 139075, 141309 ], "author": "Steve Langasek ", "date": "Fri, 28 Sep 2007 23:45:24 -0700" }, { "cves": [], "log": [ "", " * More lintian overrides, related to debconf prompting in the postinst", " * Debconf translations:", " - Brazilian Portuguese, thanks to Eder L. Marques ", " (closes: #440385)", " - Russian, thanks to Yuri Kozlov ", " (closes: #440390, #440953, #444039)", " - Bulgarian, thanks to Damyan Ivanov ", " (closes: #441863)", " - Finnish, thanks to Esko Arajärvi (closes: #443720)", " - Simplified Chinese, thanks to Ming Hua", " (closes: #443924)", " - Updated Portuguese, thanks to Américo Monteiro ", " - Updated Vietnamese, thanks to Clytie Siddall ", " (closes: #440800)", " - Updated German, thanks to Sven Joachim ", " - Updated Spanish, thanks to Javier Fernández-Sanguino Peña", " ", " - Updated Czech, thanks to Miroslav Kure ", " (closes: #441325)", " * Further cleanups of 007_modules_pam_unix -- don't use a global variable", " for pass_min_len, don't gratuitously move the length checking into the", " \"obscure\" checks, and internationalize the error strings.", " * Stop overriding the built-in default minimum password length in", " /etc/pam.d/common-password, and also drop the \"max\" option which has now", " been obsoleted.", " * Fix up the comments in /etc/pam.d/common-password to make it clear that", " the options are specific to pam_unix. Closes: #414559.", " * Patch 038: fix another thinko in the getline handling. Closes: #442276.", " * If there are active X logins, don't restart kdm, wdm, and xdm by default;", " instead, display a debconf error if they haven't been restarted.", " Closes: #441843.", " * Drop the local patch for Linux capabilities in pam_limits; Linux", " capabilities are not generally useful in a PAM context, and the PAM", " capabilities patch has been broken through much of its life.", " Closes: #440130.", " * -Wl,-z,defs was never enabled correctly, drop it since upstream is", " already using -no-undefined", " * Pass --build and --host args to ./configure as necessary, for", " cross-building support.", "" ], "package": "pam", "version": "0.99.7.1-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 28 Sep 2007 00:17:00 -0700" }, { "cves": [], "log": [ "", " * debian/libpam0g.postinst: call \"reload\" for all display managers", " (LP: #139065).", " * debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running (LP: #141309).", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu4", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 139065, 141309 ], "author": "Kees Cook ", "date": "Mon, 24 Sep 2007 15:01:29 -0700" }, { "cves": [], "log": [ "", " * ubuntu-regression_fix_securetty: securetty's earlier behavior would", " correctly prompt for password on bad usernames (LP: #139075).", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu3", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 139075 ], "author": "Kees Cook ", "date": "Wed, 12 Sep 2007 15:20:09 -0700" }, { "cves": [], "log": [ "", " * Build using db4.5 (instead of db4.6). One db4.x version less on the CD.", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu2", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Wed, 12 Sep 2007 17:44:25 +0200" }, { "cves": [], "log": [ "", " * Resynchronise with Debian (LP: #43169, #14505, #80431). Remaining changes:", " - debian/control, debian/local/common-session{,md5sums}: use", " libpam-foreground for session management.", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf.", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits. Bound", " RLIMIT_NICE from below as well as from above. Fix off-by-one error when", " converting RLIMIT_NICE to the range of values used by the kernel.", " (Originally patch 101; converted to quilt.)", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " * Dropped:", " - debian/rules: bashism fixes (merged upstream).", " - debian/control: Conflict on ancient nis (expired with Breezy).", " - debian/libpam-runtime.postinst: check for ancient pam (expired with", " Breezy).", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu1", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 43169, 14505, 80431 ], "author": "Kees Cook ", "date": "Wed, 05 Sep 2007 15:18:36 -0700" }, { "cves": [], "log": [ "", " * libpam0g.postinst, libpam0g.templates: gdm doesn't need to be restarted", " to fix the library skew, only reloaded; special-case this daemon in the", " postinst and remove the mention of it from the debconf template, also", " tightening the language of the debconf template in the process.", " Closes: #440074.", " * Add courier-authdaemon to the list of services that need to be", " restarted; thanks to Micah Anderson for reporting.", " * New patch pam_env_ignore_garbage.patch: fix pam_env to really skip over", " garbage lines in /etc/environment and log an error, instead of failing", " with an obscure error; and ignore any PAM_BAD_ITEM values returned", " by pam_putenv(), since this is the expected error return when trying", " to delete a non-existent var. Closes: #439984.", " * Yet another thinko in hurd_no_setfsuid and in", " 029_pam_limits_capabilities; this code should really be Hurd-safe at", " last...", " * getline() returns -1 on EOF, not 0; check this appropriately, to fix", " an infinite loop in pam_rhosts_auth. Thanks to Stephan Springl", " for the fix. Closes: #440019.", " * Use ${misc:Depends} for libpam0g, so we get a proper dependency on", " debconf.", " * 019_pam_listfile_quiet: per discussion with upstream, don't suppress", " errors about missing files or files with wrong permissions; these are", " real errors that should not be buried.", " * Drop the remainder of 061_pam_issue_double_free, not required for the", " original bugfix.", " * Drop patch 064_pam_unix_cracklib_dictpath, which is not needed now that", " we define CRACKLIB_DICTS in debian/rules.", " * Drop patch 063_paswd_segv, superseded by a different upstream fix", " * Split 047_pam_limits_chroot_string_value up between", " 008_modules_pam_limits_chroot and 029_pam_limits_capabilites", " * Updates to patch 007_modules_pam_unix: restore the same built-in min", " password len of 6 that upstream uses; fix a typo panlindrome ->", " palindrome.", " * The 'max=' option was never intended to be used to limit maximum password", " length for users, only to declare what the number of significant", " characters /is/ for a password. But we don't need a config option to", " tell us that, we know the answer based on which crypt type we're using,", " so drop this as a config file option. Closes: #389197.", " * Debconf translations:", " - Spanish, thanks to Javier Fernández-Sanguino Peña ", " - Vietnamese, thanks to Clytie Siddall ", " - German, thanks to Sven Joachim (closes: #440355)", " - Czech, thanks to Miroslav Kure ", " (closes: #440362)", " - Portuguese, thanks to Américo Monteiro ", " (closes: #440368)", "" ], "package": "pam", "version": "0.99.7.1-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 31 Aug 2007 17:11:05 -0700" }, { "cves": [], "log": [ "", " * New patch limits_wrong_strncpy: fix unnecessary manipulations of string", " buffers, including an illegal use of strncpy(). Thanks to Paul Hampson", " for reporting. Closes: #331278.", " * New patch misc_conv_allow_sigint.patch: allow SIGINT to be handled by the", " application, instead of blocking it when misc_conv is in use and", " preventing users from being able to ^C at any PAM prompt. Closes: #1708.", " * 024_debian_cracklib_dict_path: default to NULL instead of a specific", " dictionary path when none is defined for consistency with the new upstream", " version of cracklib, and define our path in debian/rules.", " * 055_pam_unix_nullok_secure: document the pam_unix \"nullok_secure\" option,", " a prereq for forwarding this patch upstream. Closes: #325974.", " * Create /etc/security/opasswd on new installs or on upgrades from", " 0.99.7.1-2 or below, so that users that enable the remember= option to", " pam_unix aren't left unable to change passwords. Closes: #95324.", " * Fix a couple of thinkos in hurd_no_setfsuid, that were preventing the code", " from compiling on the Hurd still. Thanks to Michael Banck for the catch.", " * Fix a memory leak in the pam_limits capabilities patch: always", " cap_free() the cap_t before returning from pam_sm_open_session().", " Closes: #153157.", " * libpam0g.postinst, libpam0g.templates: on upgrades from versions", " prior to 0.99.7.1-3, restart known PAM-using services so that they", " get the new libpam symbols, since otherwise the newer PAM modules", " will fail to load. Postinst taken from libssl0.9.8; thanks to", " Christoph Martin for the fine example! Closes: #439835.", " * Build-depend on po-debconf to support l10n of the debconf questions", " from the above.", "" ], "package": "pam", "version": "0.99.7.1-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 28 Aug 2007 06:33:33 -0700" }, { "cves": [ { "cve": "CVE-2005-2977", "url": "https://ubuntu.com/security/CVE-2005-2977", "cve_description": "The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unix_chkpwd, which does not log failed guesses or delay its responses.", "cve_priority": "medium", "cve_public_date": "2005-11-01 12:47:00 UTC" } ], "log": [ "", " * New upstream release; thanks to Roger Leigh and Jan Christoph Nordholz", " for their extensive work in helping to prepare for this update in Debian.", " Closes: #360460.", " - now uses autoconf for library detection, so SELinux should not be", " unconditionally enabled on non-Linux archs. Closes: #333141.", " - pam_mail notice handling has been completely reworked, so there should", " no longer be missing spaces in the messages. Closes: #119689.", " - with libtool and autoconf, now behaves \"sensibly\" on unknown", " platforms. Closes: #165067.", " - the source now builds without warnings. Closes: #212165.", " - uses automake instead of hand-rolled makefiles with indentation", " bugs. Closes: #241661, #328084.", " - pam_mkhomedir now creates directories recursively as needed.", " Closes: #178225.", " - pam_listfile now supports being used as a session module too.", " Closes: #416665.", " - misspelled pam_userdb log message has been corrected. Closes: #305058.", " - the current pam_strerror manpage no longer mentions \"Unknown", " Linux-PAM error\". Closes: #220157.", " - the text documentation no longer uses ANSI bold sequences.", " Closes: #181451.", " - pam_localuser now supports being used as a session module.", " Closes: #412484.", " - package no longer fails to build with dash as /bin/sh.", " Closes: #331208.", " - All modules should now be documented in the system administrator", " guide. Closes: #350620.", " - pam_userdb now logs an error instead of segfaulting when no db=", " option is provided. Closes: #436005.", " - pam_time now warns on a missing tty instead of erroring out,", " making it possible to use the module with non-console services.", " Closes: #127931.", " - upstream changelog is now 'ChangeLog' instead of 'CHANGELOG'; install", " accordingly", " - bump the shlibs", " - the 'test.c' example no longer exists", " - add /usr/share/locale to libpam-runtime.", " - CVE-2005-2977: only uid=0 is allowed to invoke unix_chkpwd with an", " arbitrary username, and then only when SELinux is active.", " Closes: #336344.", " * Mark myself as primary maintainer as previously discussed with Sam, and", " add Roger as an uploader.", " * Refactor to use quilt.", " * Update to Standards-Version 3.7.2.", " * Drop unnecessary build-dependency on patch, which is", " build-essential (and no longer invoked directly).", " * Drop patches 002_debian_no_ldconfig_call, 010_pam_cplusplus,", " 018_man_fixes, 030_makefile_link_against_libpam,", " 037_pam_issue_ttyname_can_be_null, 044_configure_supports_bsd,", " 050_configure_in_gnu and 052_pam_unix_no_openlog, which have been", " superseded upstream.", " * Drop patches 005_pam_limits_099_6,", " 012_pam_group_less_restrictive_charset, 023_pam_env_limits_miscfixes,", " 048_pam_group_colon_valid_char, 058_pam_env_enable, 059_pam_userdb_segv,", " 060_pam_tally_segv and 062_c++_safe_headers, which have been integrated", " upstream.", " * Patch 057: SELinux support is merged upstream, leaving only an", " unrelated OOM check for pam_unix_passwd. Rename as", " 057_pam_unix_passwd_OOM_check.", " * Patches 006, 008, 036: update for the switch from SGML to XML.", " * Patch 007: update for the switch from SGML to XML; drop some log", " messages that were already added upstream; update for the pam_modutil", " changes; tighten the flag handling of the 'obscure' option; drop bogus", " check in unix_chkpwd for null passwords. Also fix a grammar error", " along the way. Closes: #362855.", " * Patch 024: CRACKLIB_DICTPATH is no longer set in configure.in, so patch", " pam_cracklib.c instead to use the default dictpath already available", " from crack.h; and patch configure.in to use AC_CHECK_HEADERS instead", " of AC_CHECK_HEADER, so crack.h is actually included. Also remove", " unnecessary string copies, which break on the Hurd due to PATH_MAX.", " * Patch 038: partially merged/superseded upstream; also add new Hurd", " fix for pam_xauth.", " * Patch 061: partially merged upstream", " * Use ${binary:Version} instead of ${Source-Version} in", " debian/control.", " * Remove empty maintainer scripts debian/libpam0g-dev.{postinst,prerm},", " debian/libpam0g.{postinst,prerm}, and", " debian/libpam-modules.{postinst,prerm}; debhelper can autogenerate these", " just fine without our help.", " * Build-Depend on xsltproc, libxml2-utils, docbook-xml, docbook-xsl", " and w3m instead of on linuxdoc-tools, linuxdoc-tools-latex, tetex-extra,", " groff, and opensp.", " * Also build-depend on flex for libfl.a.", " * Updates for documentation handling:", " - move debian/local/pam-*-guide to debian/libpam-doc.doc-base.foo-guide,", " and invoke dh_installdocs instead of installing these by hand.", " - drop libpam-doc.{postinst,prerm}, which are no longer needed.", " - add an install target to debian/rules, and have binary-indep depend on", " it instead of trying to install doc files individually from the source", " tree", " - consequently, drop libpam-doc.dirs as well which is no longer needed", " and no longer accurate", " - add debian/libpam-doc.install for moving the docs to the right place,", " and also replace libpam-runtime.files with libpam-runtime.install;", " for the moment this means we're using both dh_movefiles and", " dh_install...", " - libpam0g.docs: install the Debian-PAM-MiniPolicy from here, further", " cleaning up debian/rules", " * Drop debian/libpam0g.links, no longer needed because upstream now has a", " working install target which creates the library symlinks", " * Add libpam-modules.links: create pam_unix_{acct,auth,passwd,session}.so", " symlinks by hand, no longer provided upstream.", " * debian/patches-applied/PAM-manpage-section: \"PAM\" is not a daemon, manpage", " belongs in section 7, not in section 8.", " * Actually ship the pam, pam.conf, and pam.d manpages in libpam-runtime.", " * debian/patches-applied/autoconf.patch: move all changes to autotools", " generated files into a single patch at the end of the stack.", " - don't touch configure in debian/rules, the quilt patch takes care", " of this for us.", " * New patch 064_pam_unix_cracklib_dictpath: correctly define", " CRACKLIB_DICTS, since this is not defined by configure. Thanks to Jan", " Christoph Nordholz.", " * New patch 065_pam_unix_cracklib_disable: Debian-specific patch to disable", " cracklib support in pam_unix. Thanks to Christoph Nordholz.", " * debian/rules:", " - Rename OS_CFLAGS to CFLAGS.", " - kill off references to unused variables", " - make binary-arch also depend on the install target, and streamline the", " rules", " - fix up the clean target to not ignore errors; thanks to Roger Leigh", " - drop the local module_check target in favor of using -Wl,-z,defs", " in LDFLAGS to enforce correct linkage of all objects at build time", " * Drop debian/local/unix_chkpwd.8 in favor of the upstream manpage.", " * libpam-modules.files: /usr/sbin/pam_tally has moved to /sbin/pam_tally", " for consistency.", " * Update to debhelper V5.", " * Don't ship Makefiles as part of the libpam0g-dev examples.", " * libpam-modules.manpages, libpam-runtime.manpages, libpam0g-dev.manpages:", " put all the manpages in the correct packages. Closes: #411812,", " #62193, #313486, #300773, #330545, #184270.", " * Drop libpam{0g,0g-dev,-modules,-runtime}.dirs, not needed for anything", " because we aren't trying to ship empty directories in the packages", " * Build-Conflict with fop, to avoid unreproducible builds of pdf", " documentation from a tool in contrib.", " * libpam-cracklib should depend on a real wordlist package, per policy;", " use wamerican as the default.", " * Drop local/pam-undocumented.7 from the package, since we no longer have", " a reason to ship it", " * Add lintian overrides for known false-positives", " * Conflicts/Replaces/Provides libpam-umask, now included upstream.", " Closes: #436222.", " * Upstream no longer marks unix_chkpwd suid-root for us, so set the perms", " by hand in debian/rules. In the process, unix_chkpwd is now writable", " by the owner, as expected by policy. Closes: #368100.", " * Migrate from db4.3 to db4.6; once again, no administrator action should", " be needed for upgrading on-disk database formats. Closes: #354309.", " * Add XS-Vcs-Svn and XS-Vcs-Browser fields to debian/control; thanks to", " Laurent Bigonville for the hint. Closes: #439038.", " * Add a watch file for use with uscan; thanks to Laurent Bigonville for", " this patch as well. Closes: #439040.", " * Rewrite of 031_pam_include, fixing a memory leak and letting us drop", " patch 056_no_label_at_end; thanks to Jan Christoph Nordholz", " for this much-improved version!", " * New patch no_pthread_mutexes: don't use pthread mutexes in", " pam_modutil functions, they're not needed because pam handles", " themselves should not be used concurrently by multiple threads and", " using pthreads causes problems for portable linking.", " * New patch hurd_no_setfsuid: if we don't have sys/fsuid.h, work around", " using setreuid instead.", "" ], "package": "pam", "version": "0.99.7.1-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 26 Aug 2007 19:15:09 -0700" }, { "cves": [], "log": [ "", " * Remove /usr/bin/X11 from default PATH (new installs only).", "" ], "package": "pam", "version": "0.79-4ubuntu2", "urgency": "low", "distributions": "feisty", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Wed, 20 Dec 2006 16:14:37 +0000" }, { "cves": [], "log": [ "", " * Resynchronise with Debian. Remaining changes:", " - Patch 100 (renumbered from 060): Look at ~/.pam_environment too, with", " the same format as /etc/security/pam_env.conf.", " - Patch 101 (renumbered from 061): Explicitly initialise RLIMIT_NICE", " rather than relying on the kernel limits. Bound RLIMIT_NICE from below", " as well as from above. Fix off-by-one error when converting", " RLIMIT_NICE to the range of values used by the kernel.", " - Add PATH to /etc/environment if it's not present there or in", " /etc/security/pam_env.conf.", " - debian/rules: Fix a bashism.", " - Install unix_chkpwd setgid shadow instead of setuid root. The nis", " package handles overriding this as necessary.", " - Use pam_foreground in the default session.", " - Linux-PAM/libpamc/test/regress/test.libpamc.c: Use standard u_int8_t", " type rather than __u8.", "" ], "package": "pam", "version": "0.79-4ubuntu1", "urgency": "low", "distributions": "feisty", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 19 Dec 2006 10:32:47 +0000" }, { "cves": [], "log": [ "", " * Medium-urgency upload; at least one RC bugfix, but also a", " significant number of changes, hence not urgency=high.", " * Move libpam-modules and libpam0g to Section: libs and libpam-runtime", " to section: admin, to match the overrides in the archive.", " * Move old changelog entries (well, entry) that don't follow the current", " format to debian/changelog.old, since there's no way to figure out a", " timestamp for an 8-year-old upload, and this is the most effective", " way to clear a glut of lintian warnings.", " * Fix the formatting of the libpam-cracklib package description.", " * Patch 010: remove parts of the patch that aren't necessary for C++", " compatibility.", " * Patch 060: fix a segfault in pam_tally caused by misuse of", " pam_get_data(); already fixed upstream. Closes: #335273.", " * Patch 061: fix a double free in pam_issue, caused by overuse (and misuse)", " of strdup (similar to patch 059). Already fixed upstream.", " Closes: #327272.", " * Don't build-depend on libselinux1-dev and libcap-dev on kfreebsd archs.", " Closes: #352329.", " * Patch 005: sync pam_limits with upstream:", " - support \"-\" (unlimited) for all limit types except process priority.", " - support the additional aliases \"-1\", \"unlimited\", and \"infinity\" for", " clearing the limits; closes: #122400, #149027.", " - restrict the range of process priority, login count, and system login", " count settings to (INT_MIN,INT_MAX) (heh).", " - special-case RLIM_INFINITY when applying multipliers to values from", " the config.", " - document maxsyslogins in the default limits.conf; closes: #149883.", " - use the current process priority as a default instead of resetting to", " 0; closes: #241663.", " - add support for (and document) new RLIMIT_NICE and RLIMIT_RTPRIO", " settings in Linux 2.6.12 and above; closes: #313542, #313588.", " - allow imposing limits on uid=0.", " * Patch 027: only set RLIM_INFINITY as the default for the limits where", " we know this is sensible, so that recompiling in an environment with new", " limits doesn't create a security hole -- as happened with RLIMIT_NICE and", " RLIMIT_RTPRIO! Thanks to Ville Hallik for the initial patch.", " Closes: #388431.", " * Patch 029, 047: Fix up the broken pam_limits capabilities patch so it", " actually works -- which may well be a first... Closes: #318452.", "" ], "package": "pam", "version": "0.79-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 23 Oct 2006 05:36:08 -0700" }, { "cves": [], "log": [ "", " * Non-maintainer upload to fix important bug, that makes passwd segfault", " when CTRL-D is pressed at the password prompt. Applied the patch", " provided by Dann Frazier. (Closes: #360657)", "" ], "package": "pam", "version": "0.79-3.2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Margarita Manterola ", "date": "Sat, 5 Aug 2006 02:11:22 -0300" }, { "cves": [], "log": [ "", " * Resynchronise with Debian.", "" ], "package": "pam", "version": "0.79-3.1ubuntu1", "urgency": "low", "distributions": "edgy", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 29 Jun 2006 17:27:34 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Linux-PAM/libpamc/include/security/pam_client.h,", " Linux-PAM/libpamc/pamc_converse.c: Apply patch from", " latest upstream version to remove redefinition of internal", " glibc/libstdc++ types. Closes: #344447.", "" ], "package": "pam", "version": "0.79-3.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Roger Leigh ", "date": "Sun, 5 Feb 2006 21:46:59 +0000" }, { "cves": [], "log": [ "", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: Protect use of", " RLIMIT_NICE in init_limits() with an #ifdef.", "" ], "package": "pam", "version": "0.79-3ubuntu14", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Fri, 12 May 2006 17:42:40 +0100" }, { "cves": [], "log": [ "", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: Set soft and hard", " nice limits to 20 (= userland nice value 0) rather than unlimited by", " default. Correct off-by-one error (the same error as in Linux 2.6.12,", " but fixed in 2.6.13) in user<->kernel translation of nice limit.", "" ], "package": "pam", "version": "0.79-3ubuntu13", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 11 May 2006 11:29:58 +0100" }, { "cves": [], "log": [ "", " * debian/control: Add libpam-foreground dependency to libpam-runtime, since", " the default /etc/pam.d/common-session refers to it. Closes: LP#35142", "" ], "package": "pam", "version": "0.79-3ubuntu12", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Mon, 10 Apr 2006 14:42:40 +0200" }, { "cves": [], "log": [ "", " [ Dana Olson ]", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: removed glibc", " workaround now that glibc is aware of rlimits.", "", " [ Martin Pitt ]", " * debian/rules: Fix bashisms.", "" ], "package": "pam", "version": "0.79-3ubuntu11", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Thu, 6 Apr 2006 15:03:37 +0200" }, { "cves": [], "log": [ "", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: Support \"nice\" and", " \"rtprio\" rlimits, new in Linux 2.6.12. Backported from upstream thanks", " to Dana Olson and others (closes: Malone #17348).", "" ], "package": "pam", "version": "0.79-3ubuntu10", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 23 Feb 2006 16:22:12 +0000" }, { "cves": [], "log": [ "", " * Fix operator precedence in libpam-modules.postinst.", "" ], "package": "pam", "version": "0.79-3ubuntu9", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 16 Feb 2006 15:23:04 +0000" }, { "cves": [], "log": [ "", " * Make pam_env be quiet if it can't find the user's configuration file,", " since it's optional.", "" ], "package": "pam", "version": "0.79-3ubuntu8", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Sat, 4 Feb 2006 16:44:12 +0100" }, { "cves": [], "log": [ "", " * Add the PATH on initial install for real this time.", "" ], "package": "pam", "version": "0.79-3ubuntu7", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Thu, 2 Feb 2006 20:33:42 +0100" }, { "cves": [], "log": [ "", " * Changes from Roger Leigh:", "", " * Linux-PAM/libpamc/include/security/pam_client.h,", " Linux-PAM/libpamc/pamc_converse.c: Apply patch from", " latest upstream version to remove redefinition of internal", " glibc/libstdc++ types. Closes: #344447.", " * Linux-PAM/libpamc/test/regress/test.libpamc.c: Also switch to standard", " types; not taken from upstream.", " " ], "package": "pam", "version": "0.79-3ubuntu6", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Reinhard Tartler ", "date": "Wed, 1 Feb 2006 13:14:24 +0000" }, { "cves": [], "log": [ "", " * Add pam_foreground to /etc/pam.d/common-session", "" ], "package": "pam", "version": "0.79-3ubuntu5", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Matthew Garrett ", "date": "Tue, 24 Jan 2006 02:26:19 +0000" }, { "cves": [], "log": [ "", " * Add PATH on initial install, too.", "" ], "package": "pam", "version": "0.79-3ubuntu4", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Mon, 23 Jan 2006 15:55:40 +0100" }, { "cves": [], "log": [ "", " * Add PATH to /etc/environment if it's not present there or in", " /etc/security/pam_env.conf and we are upgrading from a version which", " didn't add it.", "" ], "package": "pam", "version": "0.79-3ubuntu3", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Tue, 17 Jan 2006 15:54:01 +0100" }, { "cves": [], "log": [ "", " * Look at ~/.pam_environment too. Same format as", " /etc/security/pam_env.conf. The patch is recorded as", " patches-applied/060_pam_env_per_user", "" ], "package": "pam", "version": "0.79-3ubuntu2", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Tue, 17 Jan 2006 15:32:55 +0100" }, { "cves": [], "log": [ "", " * Resynchronise with Debian.", "" ], "package": "pam", "version": "0.79-3ubuntu1", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Mon, 21 Nov 2005 12:15:44 +0000" }, { "cves": [], "log": [ "", " * Patch 059", " - Fix a segfault in pam_userdb when the new \"crypt=\" option", " is unset, as will be the case for all existing users; already fixed", " upstream. Closes: #330829.", " - Fix a memory leak in the same code due to gratuitous strdup()s.", " * Further regression in pam_env: don't treat a missing /etc/environment", " as a fatal error, either. Amend patch 058 accordingly. Closes: #330852.", "" ], "package": "pam", "version": "0.79-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 30 Sep 2005 01:17:53 -0700" }, { "cves": [], "log": [ "", " The \".c.o: rm -rf $@\" release", " * Fix debian/rules so that make clean doesn't remove ./configure when the", " timestamp on configure.in is newer (!).", " * Switch pam_userdb from db3 to db4.3, which according to the libdb", " maintainers should require no manual intervention for upgrading on-disk", " database formats. Closes: #165068.", " * Patch 058: yes, of course we want to read /etc/environment by", " default. Grr! Revert upstream change which disables this for no", " apparent reason (closes: #330458).", " * Tweak selinux rootok code to use the version of the function call that", " doesn't pollute namespace", "" ], "package": "pam", "version": "0.79-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 27 Sep 2005 02:44:36 -0700" }, { "cves": [], "log": [ "", " * New upstream version (closes: #284954, #300775).", " - includes some fixes for typos (closes: #319026).", " - pam_unix should now be LSB 3.0-compliant (closes: #323982).", " - fixes segfaults in libpam on config file syntax errors", " (closes: #330097).", " * Drop patches 000_bootstrap, 004_libpam_makefile_static_works,", " 011_pam_access, 013_pam_filter_termio_to_termios, 017_misc_fixes,", " 025_pam_group_conffile_name, 028_pam_mail_delete_only_when_set,", " 033_use_gcc_not_ld, 034_pam_dispatch_ignore_PAM_IGNORE,", " 035_pam_unix_security, 039_pam_mkhomedir_no_maxpathlen_required,", " 041_call_bootstrap, 042_pam_mkhomedir_dest_not_source_for_errors,", " 051_32_bit_pam_lastlog_ll_time, and", " 053_pam_unix_user_known_returns_user_unknown which have been", " integrated upstream.", " * Merge one last bit of patch 053 into patch 043, where it should have", " been in the first place", " * Patch 057: SELinux support:", " - add support to pam_unix for copying SELinux security contexts when", " writing out new passwd/shadow files and creating lockfiles", " - support calling unix_chkpwd if opening /etc/shadow fails due to", " SELinux permissions", " - allow unix_chkpwd to authenticate for any user when in an SELinux", " context (hurray!); we depend on SELinux policies to prevent the", " helper's use as a brute force tool", " - also support querying user expiration info via unix_chkpwd", " - misc cleanup: clean up file descriptors when invoking unix_chkpwd", " (closes: #248310)", " - make pam_rootok check the SELinux passwd class permissions, not just", " the uid", " - add new pam_selinux module (closes: #249499)", " * Build-depend on libselinux1-dev.", " * Fix pam_getenv, so that it can read the actual format of /etc/environment", " instead of trying to read it using the syntax of", " /etc/security/pam_env.conf; thanks to Colin Watson for the patch.", " Closes: #327876.", " * Set LC_COLLATE=C when using alphabetic range expressions in", " debian/rules; bah, so *that's* what kept happening to my README file", " when trying to build out of svn! Closes: #295296.", " * Add a reference to the text of the GPL to debian/copyright.", "" ], "package": "pam", "version": "0.79-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 25 Sep 2005 22:08:20 -0700" }, { "cves": [], "log": [ "", " * Fix Gcc 3.4 compilation, Closes: #259634", " * Note that pam.conf is not read if /etc/pam.d exists, Closes: #248928", " * Fix typo in pam_env.conf, Closes: #277633", "" ], "package": "pam", "version": "0.76-23", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 10 Jul 2005 16:42:25 -0400" }, { "cves": [], "log": [ "", " * Fix pam_getenv, which never worked:", " - Parse /etc/security/pam_env.conf using its own syntax, and then", " /etc/environment using its own syntax rather than the syntax of", " /etc/security/pam_env.conf.", " - 'my $val' was used in an incorrect scope; fixed.", " - Exit non-zero if the requested environment variable is not found.", "" ], "package": "pam", "version": "0.76-22ubuntu3", "urgency": "low", "distributions": "breezy", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Mon, 12 Sep 2005 18:32:54 +0100" }, { "cves": [], "log": [ "", " * debian/rules: Install unix_chkpwd setgid shadow instead of setuid root.", " This only breaks when using NIS lookups, therefore the new nis package", " dpkg-statoverrides it back to setuid root while being installed.", " (Debian #155583, http://udu.wiki.ubuntu.com/ProactiveSecurityRoadmap)", " * debian/control: Added conflict to nis (<< 3.13-3ubuntu1): This is the", " version that corrects the permissions for usage with NIS.", "" ], "package": "pam", "version": "0.76-22ubuntu2", "urgency": "low", "distributions": "breezy", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Fri, 17 Jun 2005 12:34:23 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS with gcc-3.4 (closes: #259634). Ubuntu 9037.", "" ], "package": "pam", "version": "0.76-22ubuntu1", "urgency": "low", "distributions": "breezy", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Wed, 4 May 2005 18:14:51 +0200" }, { "cves": [], "log": [ "", " * Add uploaders", " * Document location of repository", " * Fix options containing arguments in pam_unix, Closes: #254904", "" ], "package": "pam", "version": "0.76-22", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 28 Jun 2004 14:28:08 -0400" }, { "cves": [], "log": [ "", " * Fix patch 055 again because -20 was broken and didn't actually fix the", " problem.", "" ], "package": "pam", "version": "0.76-21", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 4 May 2004 21:37:38 -0400" }, { "cves": [], "log": [ "", " * Update to patch 55 to only check securetty when we are sure the", " password is null, Closes: #243698", " * Medium urgency because the version now in testing has confusing and", " verbose log messages.", " * Include pam_getenv script which hopefully will be used by some people", " somewhere for some purpose", "" ], "package": "pam", "version": "0.76-20", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 28 Apr 2004 22:51:18 -0400" }, { "cves": [], "log": [ "", " * Oops, too busy testing the upgrade from woody to make sure the upgrade", " from -16 to -18 worked. Thanks to all those who reported,", " Closes: #243413", "" ], "package": "pam", "version": "0.76-19", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 13 Apr 2004 16:08:54 -0400" }, { "cves": [], "log": [ "", " * Manipulate conffiles to avoid unnecessary prompt in woody to sarge", " upgrade, Closes: #218318", "" ], "package": "pam", "version": "0.76-18", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 10 Apr 2004 18:10:35 -0400" }, { "cves": [], "log": [ "", " * common-password now includes length restrictions and cracklib", " examples, Closes: #227681, #237537", " * Patch 054: abstract out the logic from pam_securetty to determine if a", " tty is in /etc/securetty into a library function", " * Patch 55: Add nullok_secure option to pam_unix. If set, then null", " passwords are accepted from terminals in /etc/securetty.", " * common-auth now includes nullok_secure, Closes: #228114", "", "" ], "package": "pam", "version": "0.76-17", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 4 Apr 2004 23:10:11 -0400" }, { "cves": [], "log": [ "", " * Patch 51 from the x86-64 folks to support 32-bit ll_time in", " pam_lastlog even if time_t is 64-bits", " * Don't call openlog in pam_unix (patch 52), Closes: #213566", " * Return PAM_USER_UNKNOWN for unknown users in pam_unix (patch 53), Closes: #204506", "" ], "package": "pam", "version": "0.76-16", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 23 Mar 2004 22:26:04 -0500" }, { "cves": [], "log": [ "", " * Fix description of libpam-runtime, Closes: #209755", " * Fix description of libpam-cracklib, Closes: #210014", " * Depend on libc6-dev|libc-dev not libc6-dev, Closes: #212354", " * Clean up binaries, Thanks Russell, Closes: #212158", " * Depend on sufficiently new cracklib2-dev, Closes: #214092", " * Treate GNU/* as GNU for OS variable to make pam_limits compile,", " (patch 050) Closes: #220980", " * No longer build-depend on latex2html, Closes: #221318", " * Allow : in tty specification for pam_group, (patch 048) Closes: #220439", " * Pull in locking patch from Linux-PAM CVS; this ended up causing", " 021_pam_nis_locking to be reworked and that patch now no longer", " contains locking fixes, but just NIS cleanup in general. See", " 049_pam_unix_sane_locking for the locking changes, Closes: #220158", "" ], "package": "pam", "version": "0.76-15", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 12 Jan 2004 02:23:59 -0500" }, { "cves": [], "log": [ "", " * Pull in NMU diff from 13.1, Closes: #186011", " * Split out common-password into its own file, Closes: #207497", " * Make other a conffile again and update to @include stuff", " * Add missing symlink, Closes: #196605", " * Remove undocumented manpages", " * Update PAM mini-policy", "" ], "package": "pam", "version": "0.76-14", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 1 Sep 2003 18:08:54 -0400" }, { "cves": [], "log": [ "", " * NMU with maintainer's permission.", " * Add three new config files (/etc/pam.d/common-{auth,account,session})", " to libpam-runtime. Other packages which depend on libpam-runtime", " can now @include these files from their own PAM configs.", " * Convert /etc/pam.d/other from a conffile to a non-conffile config", " file. Closes: #186011.", " * Remove empty libpam-runtime.prerm script (debhelper will autocreate if needed)", "" ], "package": "pam", "version": "0.76-13.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 19 Aug 2003 19:41:03 -0500" }, { "cves": [], "log": [ "", " * Nope, that dependency didn't work, so let's remove it. If we run into other module versioning issues, I now have an arm build environment to debug with. Closes: #198618", "" ], "package": "pam", "version": "0.76-13", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 7 Jul 2003 00:22:34 -0400" }, { "cves": [], "log": [ "", " * Fix group.conf example, (patch 046) Closes: #197080", " * Ignore module return value in jumps, (patch 045) Closes: #176693", " * Accept string value for chroot limit, thanks Andrei Pelinescu-Onciul,", " Patch (047), Closes: #196903", " * Depend on libpam-modules instead of conflicting with older versions.", " This creates a circular dependency between libpam0g and", " libpam-modules. James says this works fine; we hope he's right.", " Closes: #196949" ], "package": "pam", "version": "0.76-12", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 21 Jun 2003 17:19:29 -0400" }, { "cves": [], "log": [ "", " * Don't allow db4 to satisfy build-depends because it doesn't actually", " work, and sometimes building with it would be wrong.", " * Don't depend on libpcap-dev on Debian BSD", " * Conflict with old libpam-modules, Closes: #191906", " * Incorrect username should not be logged at alert (patch 43),", " Closes: #175900", " * Patch to support FreeBSD (patch 44, thanks Robert), Closes: #191906", "" ], "package": "pam", "version": "0.76-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 31 May 2003 19:55:26 -0400" }, { "cves": [], "log": [ "", " * Don't double list conffiles, Closes: #190954", " * Only install example sources not executables, Closes: #185286", " * Display correct directory in error message for pam_mkhomedir, patch", " 042 thanks to Akira TAGOH, Closes: #165240", " * Don't log EPERM when setting NOFILE limit as Linux doesn't let you", " set that to -1, Closes: #180310", " * Add newline to end of distributed time.conf, Closes: #172229", " * Up our standards version and support noopt in DEB_BUILD_OPTIONS", "" ], "package": "pam", "version": "0.76-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 3 May 2003 22:28:37 -0400" }, { "cves": [], "log": [ "", " * Fix pam_rhosts hurd patch so it actually works, Closes: #172914", " * Fix patch 040 not to clobber errno when logging the error fails,", " Closes: #172186", " * Fix dependency for linuxdoc-tools, Closes: #173097", "" ], "package": "pam", "version": "0.76-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 15 Dec 2002 17:10:58 -0500" }, { "cves": [], "log": [ "", " * Have makefile appropriately depend on bootstrap-libpam", " * Install pam minipolicy, Closes: #167798", " * Don't segfault if ttyname is null; this avoids the segfault but does", " not actually make pam_issue useful for ssh. I believe the way", " pam_issue works is fundamentally incompatible with what sshd expects", " from PAM (patch 037), Closes: #153152", " * We actually fixed passwords containing , in 0.76-6, but failed to", " document it. They do work, Closes: #164713", " * Note that /etc/pam.d/other is a fall back for each service", " * Patches from Michal 'hramrach' Suchanek\" to", " make HURD work, Closes: #165066 (patch 038 and 039)", " * Don't depend on gs and other doc prep tools for build-depends, just", " build-depends-indep, Closes: #165065", " * Patch from Eric Anderson to log failures of", " setrlimit (patch 040), Closes: #169836", " * Build pam_limits on hurd, Closes: #165190", "" ], "package": "pam", "version": "0.76-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 24 Nov 2002 22:04:28 -0500" }, { "cves": [], "log": [ "", " * Fix handling of pam_ignore in case where we're skipping modules;", " update to patch 034", "" ], "package": "pam", "version": "0.76-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 20 Oct 2002 21:49:22 -0400" }, { "cves": [], "log": [ "", " * The \"No, I don't think I actually want any of what upstream is", " smoking\" release", " * If this were already in testing, this would be an severity emergency", " upload", " * pam_unix currently treats * in shadow file as no password not", " disabled; major security issue; fixed in upstream CVS, (patch 035) Closes: #164659", " * OK, I think this actually fixes the rest of the manpage symlinks,", " Closes: #163839, #164298", " * You don't want to use getlogin for pam_wheel because utmp may be wrong or for xterm have no entry, pull forward patch from the 0.72 packages (patch 036), Closes: #163787", "" ], "package": "pam", "version": "0.76-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 15 Oct 2002 10:44:56 -0400" }, { "cves": [], "log": [ "", " * Fix library links from 0.75 to 0.76", " * Ignore PAM_IGNORE in _pam_dispatch_aux (patch 34), Closes: #163841", " * Fix man page symlinks, Closes: #163839", "" ], "package": "pam", "version": "0.76-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 11 Oct 2002 01:08:06 -0400" }, { "cves": [], "log": [ "", " * Upstream correctly states that one should use gcc not ld when", " linking and then hapilly proceeds to actually use ld, fixed, Closes: #163711", "", " * Remove experimental warning from readme, Closes: 163742", "" ], "package": "pam", "version": "0.76-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 7 Oct 2002 23:45:53 -0400" }, { "cves": [], "log": [ "", " * Oops, let's try building -fpic. This currently builds everything", " -fpic which is somewhat wrong, but doing more than that requires", " significant build system hacking (touch every makefile for dynamic", " objects), so it will wait, Closes: #163600", "" ], "package": "pam", "version": "0.76-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 6 Oct 2002 23:33:12 -0400" }, { "cves": [], "log": [ "", " * Link against appropriate libraries so we find the symbols we need,", " Closes: #162175", " * The if everyone's going to complain when I upload broken software to", " experimental release, I might as well upload to unstable and give them", " something worth actually complaining about release.", " * Also the remove the scourge of dbs release", " * Include patch 034 from the 0.72 packages, meaning that we've included", " all the patches we need before release", " * Reject the patch to pam_wheel as I cannot find out what reasonable", " thing it was trying to do and it seemed broken", " * libpam-cracklib should depend on wordlist so it actually works;", " thanks Olaf Meeuwissen,", " Closes: #112965", " * Merge build-depends and build-depends-indep because I'm a bad person", " and was too lazy to make docs build in a separate pass. I'll deal in", " a few versions.", "" ], "package": "pam", "version": "0.76-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 6 Oct 2002 18:52:13 -0400" }, { "cves": [], "log": [ "", " * New upstream version", " * Upstream includes fix to not break cron, Closes: 160566", " * New Upstream correctly handles priority < 0 for pam_limits, Closes: #126251", " * .cvsignores removed, Closes: #159961", "" ], "package": "pam", "version": "0.76-1", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 22 Sep 2002 16:11:35 -0400" }, { "cves": [], "log": [ "", " * Apply patch 027 pam_limits so that we initialize to wide open not", " current limits.", " * In pam_mail, don't complain about deleting environment variable if", " we never set it, Closes: #58429", " * Don't set default max procs limit in pam_limits, Closes: #116874", " * libpam-runtime now arch all since it has no arch-specific files,", " Closes: #132545", " * Update mini policy to reflect confusion on debian-devel", "" ], "package": "pam", "version": "0.75-3", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 16 Jul 2002 09:30:50 -0400" }, { "cves": [], "log": [ "", " * Fix pam_userdb to build and to build against db3, fixes patch 020", " * Fix upstream makefile so pam_group has valid configuration, closes: #148657", " * time.conf reference to logoutd removed, closes: #143801", " * The static library contains all the appropriate symbols in this", " version. You may find the complete lack of PAM modules somewhat", " frustrating; currently the static pam library is only useful if you", " register your own modules. Fixing this would require annoying hacking", " on the upstream build system, closes: #103495", " * unix_chkpwd.8 typo fixes thanks to dancer@anthill.echidna.id.au,", " Closes: #139949", " * Since we're working on the new upstream version, we also have the new docs, closes: #147763", " * Patch from Martin Schwenke to only change", " passwords in pam_unix when they exist in the password file; hopefully", " does not break NIS, closes: #135990", " * Another patch from Martin to return PAM_USER_UNKNOWN if we ever", " actually do get into the password changing routine only to find that", " we have no password to change, closes: #135604", " * .cvsignore no longer installed, closes: #120795", " * We're using debhelper 3, just in time to be obselete, Closes: #93414", "" ], "package": "pam", "version": "0.75-2", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 8 Jun 2002 18:04:40 -0400" }, { "cves": [], "log": [ "", " * Preliminary test packages", " * New upstream version", " * Hopefully works mostly the same as 0.72 except for upstream bug", " fixes and for the fact that pam_limits is fairly broken right now.", " * If it breaks you are lucky if you get to keep both pieces release.", "" ], "package": "pam", "version": "0.75-1", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 25 May 2002 22:57:57 -0400" }, { "cves": [], "log": [ "", " * Fix like_auth to make libpam-krb5 and libpam-heimdal actually useful,", " patch from RISKO Gergely , closes: #126251", "" ], "package": "pam", "version": "0.72-35", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 21 Jan 2002 15:20:22 -0500" }, { "cves": [], "log": [ "", " * Note that HOME may not be useful in pam_environment, closes: #109281", " * Don't smash case domains (groups/users) in pam_limits, closes: #119893", " * Remove double the from description, closes: #107705", " * Fix typo on mail message, closes: #119689", " * Medium since these are small fixes that should go into woody", "" ], "package": "pam", "version": "0.72-34", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 23 Nov 2001 21:24:20 -0500" }, { "cves": [], "log": [ "", " * Fix pam_mail to look in /var/mail not /var/spool/mail, thanks mjb.", "" ], "package": "pam", "version": "0.72-33", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 11 Oct 2001 15:44:32 -0400" }, { "cves": [], "log": [ "", " * This should probably get into testing before freeze; medium.", " * Patch from Volker Stolz to fix bug in previous pam_group patch,", " closes: #111854", "" ], "package": "pam", "version": "0.72-32", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 22 Sep 2001 06:32:29 -0400" }, { "cves": [], "log": [ "", " * Add support for credential reinitialization in pam_group, closes: #108697", "" ], "package": "pam", "version": "0.72-31", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 31 Aug 2001 13:16:39 -0400" }, { "cves": [], "log": [ "", " * Include patch from robbe@orcus.priv.at to build pam_limits on hurd,", " closes: #103556", " * Start installing limits.conf for hurd (may not work quite right)", "" ], "package": "pam", "version": "0.72-30", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 16 Jul 2001 09:35:51 -0400" }, { "cves": [], "log": [ "", " * Correctly declare uint32 type for ia64, closes: #104584", "" ], "package": "pam", "version": "0.72-29", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 14 Jul 2001 01:30:39 -0400" }, { "cves": [], "log": [ "", " * Fix scanf string so pam_limits chroot works, closes: #100812", " * Only log unknown user at warning, not alert, closes: #95220", " * By default do complete matches not substring matches for pam_time.", " You can include explicit wildcard for substring, closes: #66152", "" ], "package": "pam", "version": "0.72-28", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 3 Jul 2001 17:31:45 -0400" }, { "cves": [], "log": [ "", " * Fix typo in last patch", "" ], "package": "pam", "version": "0.72-27", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 25 Jun 2001 18:27:42 -0400" }, { "cves": [], "log": [ "", " * Block SIGCHLD when calling unix password verification program, patch from mdz@debian.org, fixes pam part of #97977", "" ], "package": "pam", "version": "0.72-26", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 25 Jun 2001 08:47:12 -0400" }, { "cves": [], "log": [ "", " * Depend on opensp, working around #89063, closes: #100125", " * This is urgency medium to get docs back into testing.", "" ], "package": "pam", "version": "0.72-25", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 8 Jun 2001 11:44:12 -0400" }, { "cves": [], "log": [ "", " * New NIS double locking and root password patch from Philippe Troin", " , fixes bug in unreleased patch submitted for", " 0.72-23. Also improves changing root password so it does something;", " ongoing discussion on whether this is right.", "" ], "package": "pam", "version": "0.72-24", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 21 May 2001 08:06:05 -0400" }, { "cves": [], "log": [ "", " * Patch from Benoit Gaussen , Don't trim from , to end", " of string in user input, only trim from salt", " grabbed from passwd file, closes: #96779", " * Fix NIS double locking, closes: #96736", "" ], "package": "pam", "version": "0.72-23", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 16 May 2001 15:46:34 -0400" }, { "cves": [], "log": [ "", " * Fix pam.8 to be pam.7, closes: #92874", "" ], "package": "pam", "version": "0.72-22", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 17 Apr 2001 23:04:04 -0400" }, { "cves": [], "log": [ "", " * Don't depend on libcap for hurd, closes: #91998", " * Don't list scurity/limits.conf as a conffile for hurd", "" ], "package": "pam", "version": "0.72-21", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 9 Apr 2001 12:30:18 -0400" }, { "cves": [], "log": [ "", " * Install pam-undocumented in -runtime not -dev, closes: #93063", " * Mark pam-runtime as replacing files from -dev in case you installed", " -19 and have pam-undocumented in the wrong place", "" ], "package": "pam", "version": "0.72-20", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 6 Apr 2001 06:38:15 -0400" }, { "cves": [], "log": [ "", " * New maintainer, closes: #92353", " * Install pam-undocumented; somehow it was not installed in -18", "" ], "package": "pam", "version": "0.72-19", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 4 Apr 2001 21:32:17 -0400" }, { "cves": [], "log": [ "", " * pam_securetty: log failed tty checks. Normally this was only done if", " the \"debug\" option was on...do it regardless now, closes: #89390", " * Get rid of log message for when \"root\" is not applied to group checks.", " closes: #88825", " * Add quiet option to pam_listfile, closes: #84428", " * pam(8) should be pam(7), pam.conf(8) should be pam.conf(5), closes:", " #89322", " * Added groff to Build-Depends-Indep, closes: #88794", "" ], "package": "pam", "version": "0.72-18", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 25 Mar 2001 21:40:32 -0500" }, { "cves": [], "log": [ "", " * Fixed login in pam_limits where the max logins could be ignored.", "" ], "package": "pam", "version": "0.72-17", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 9 Mar 2001 09:14:48 -0500" }, { "cves": [], "log": [ "", " * New pam limits cap patch from Topi Miettinen", " , closes: #88401, #88406, #88525, #88399,", " #86197", " * pwdb no longer used, closes: #59917", " * fix patch 023 for gethostbyname build failure, closes: #86156", " * Make sure unix_chkpwd gets installed as suid root, closes: #88519", " * Fix whatis parse of manpages, closes: #86203", " * pam_listfile, fix arg parsing when arg does not contain '=', closes:", " #86070", "" ], "package": "pam", "version": "0.72-16", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 4 Mar 2001 22:45:58 -0500" }, { "cves": [], "log": [ "", " * Doh, added build-depends for libcap, closes: #85352", " * Change section of libpam-cracklib from admin to libs to match", " overrides.", "" ], "package": "pam", "version": "0.72-15", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 9 Feb 2001 09:06:40 -0500" }, { "cves": [], "log": [ "", " * Added fix to pam_access for gethostname decleration. closes: #82100", " * Just name the lib/security directory instead of all the modules", " seperately for dh_movefiles. closes: #76119", " * Fix pam_env corruption, closes: #66849, #77229", " * Add patch to allow recursive /etc/skel copy in pam_mkhomedir, closes:", " #67211", " * remove dh_suidregister call, added conflict for old suidregister", " package", " * Applied patch for Linux capabilities in pam_limits, closes: #74176", " * pam_issue.so works for me, without segv, and even with escapes. This", " is with login. Note, things like pam_issue do not work with ssh simply", " because ssh is not able to work in that way (does not support", " arbiitrary conversations). So if you want it to work there, file a bug", " on ssh, not on libpam-modules. closes: #77228", " * unix_chkpwd: check for NULL password, closes: #69960", "" ], "package": "pam", "version": "0.72-14", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 8 Feb 2001 11:06:03 -0500" }, { "cves": [], "log": [ "", " * Fix grammar in pam_source.sgml, closes: #78959", " * pam_undocumented.7: Fix escaped 's, closes: #75987", " * Fix build ordering, closes: #71442, #80397, #77017", " * Applied Hurd patch, closes: #76119", " * Use gcc for linking, not ld. closes: #71941", " * Pretty sure this was fixed, closes: #67172", " * Applied spealang fixes to Debian-mini-policy. closes: #80249", " * Applied patch to allow devfs style terminal devices with pam_group,", " closes: #77661", " * Could not reproduce, even using md5 passwords. User, if you still have", " * this problem, you need to tell me with what service (login, which I", " tested, sshd, telnet, etc...) and also send me the entire pam.d file", " for that service. closes: #76087", " * Fixed awhile back, closes: #72858", " * Closing this since I am not going to include any modules in this", " package that aren't in upstream. If someone else wants to package", " these modules seperately, they can do so. closes: #69550", " * For correct usage, pam_wheel.so should be used with \"sufficient\" and", " not \"required\". This is documented. If you use \"required\", then you", " must also use the \"trust\" option, but that doesn't give you the", " results you want. closes: #76236", "" ], "package": "pam", "version": "0.72-13", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 31 Dec 2000 05:38:23 -0500" }, { "cves": [], "log": [ "", " * Recompile against db2 for glibc change", " * Add db2 to build-deps", "" ], "package": "pam", "version": "0.72-12", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 27 Sep 2000 12:08:11 -0400" }, { "cves": [], "log": [ "", " * Removed all traces of pwdb in packages. libpwdb has been removed from", " the archive. This means that the pam_pwdb and pam_radius modules are", " no longer available (from the libpam-pwdb package).", " * doc/modules/pam_wheel.sgml: Really spell out that being a member of a", " group meands the user is listed in /etc/group, closes: #69242", " * doc/*: s/PAM_AUTHOK_RECOVERY_ERR/PAM_AUTHOK_RECOVER_ERR/g,", " closes: #64473", " * pam_wheel: PAM does not distinguish it, the libc calls make the", " distinction. The users gid is returned in their passwd info, while", " getgrent() returns only the members of the group listed in /etc/group.", " This is ok, because if it's really that important, you can actually", " have it in both places. The fact that it's documented should suffice", " in making this clear, closes: #69236", " * Sorry, but seperate modules generally need to be packaged seperately.", " I don't want to overload this package with everyone's pet module, so I", " have to put my foot down, closes: #61759", " * Actually, I'm going to move in Woody to make packages depend more on", " the defaults in /etc/pam.d/other, so that admins have less to", " maintain. For one, all packages should not have a password service", " listed, closes: #70000 (YAY! I got the 70k rollover bug number!)", " * Sorry, I can't include this. \",\" is a legitimate char in a password", " salt/hash. If you can code up something that is super intelligent", " about lenghts of the field, I can go for it, maybe, closes: #59459", " * modules/pam_limits: Added chroot feature patch, closes: #61090", " * modules/pam_access: Allow last field to contain ':', closes: #67291", " * modules/pam_limits: Allow explicit limits for root, closes: #62448", " * modules/pam_unix: Do not zero old/new password fields, libpam does", " this itself, and doing so in the module breaks stacking,", " closes: #66270", " * modules/pam_group: Allow alpha *and* numeric in tty field (duh),", " closes: #63752", " * modules/pam_access: Enable NIS, closes: #64854", " * libpam0g-dbg: removed, useless anyway", "" ], "package": "pam", "version": "0.72-11", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 30 Aug 2000 18:39:32 -0400" }, { "cves": [], "log": [ "", " * Update build depends", " * Fixed logic for showing non-existent user names when auth failed in", " pam_unix.so, closes: #67786 (thanks to Jim Breton for being patient in", " helping track this down). It would sometimes show them, even if we", " didn't want to.", "" ], "package": "pam", "version": "0.72-10", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 27 Jul 2000 09:17:08 -0400" }, { "cves": [], "log": [ "", " * pam_unix: do not call obscure_msg() of pass_old is NULL,", " closes: #65321", " * pam_access: check for from[0] == '\\0' so that tty logic is actually", " used, closes: #65401", "" ], "package": "pam", "version": "0.72-9", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 14 Jun 2000 11:38:35 -0400" }, { "cves": [], "log": [ "", " * Build depends added in previous version, closes: #60817, #61439", " * Allow use of \":0\" in group.conf, closes: #61966", " * Added syslog entry to notify that a user succesfully changed their", " password, closes: #61724", " * Make pam_unix compatible with HP-UX style NIS+ password information,", " patch from ldaffner@rsn.hp.com, closes: #61942", " * If \"audit\" is not enabled, don't let pam_unix print the names of", " unknown users for auth attempts, closes: #61942", " * Fixed ttyname() parsing in pam_access to match that of the old shadow", " access.conf s,/dev/,, closes: #61644", " * Set some sane defaults for pam_limits.so instead of carrying over", " potentially bad defaults, patch from Peter Paluch", " closes: #63230", " * Allow explicit (e.g. specified specifically for) limits for root,", " patch from Topi Miettinen , closes: #62448", " * Added information to time.conf about logoutd, which is now enabled via", " this file.", " * cracklib maintainer claims this isn't a bug, closes: #54180", " * fixed control syntax handling which was causing segfaults, closes: #62237", "" ], "package": "pam", "version": "0.72-8", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 29 Apr 2000 11:39:59 -0400" }, { "cves": [], "log": [ "", " * pam_limits: fix parsing of users which explicitly removes limits,", " closes: #59911, #60287", " * Added build-depends", "" ], "package": "pam", "version": "0.72-7", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 20 Mar 2000 16:06:28 -0500" }, { "cves": [], "log": [ "", " * Remove conflict for libpam0g-util from libpam0g and put it in", " libpam-runtime. This should fix a problem with upgrades that apt", " experiences, closes: #58677", "" ], "package": "pam", "version": "0.72-6", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 28 Feb 2000 14:05:28 -0500" }, { "cves": [], "log": [ "", " * Added obscure password checks to pam_unix. Required for shadow to be", " able to emulate the pre-PAM setup (referenced in a bug on passwd).", " * Applied patch from #57800 to fix NIS/NIS+ shadow accounting checks,", " closes: #57800, #58164", " * Fixed two typos in the PAM System Administrators Guide,", " closes: #56578, #56587", "" ], "package": "pam", "version": "0.72-5", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 28 Feb 2000 10:58:09 -0500" }, { "cves": [], "log": [ "", " * unix_chkpwd: check for NULL on stdin aswell as 0 reads, closes: #56375", " * pam_unix/Makefile: removed bashism, closes: #56370", " * fixed in shadow upload, closes: #49832", "" ], "package": "pam", "version": "0.72-4", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 29 Jan 2000 00:27:28 -0500" }, { "cves": [], "log": [ "", " * Added cpluplus wraps in all the headers, closes: #53653", "" ], "package": "pam", "version": "0.72-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 2 Jan 2000 15:15:40 -0500" }, { "cves": [], "log": [ "", " * Well, this is an odd one. A recompile fixes it. So it must have been a", " problem from linking with 0.71 when this is version 0.72. All of this", " build daemons seem to have compiled the latest 0.72, so this should be", " resolved after this gets recompiled on all of them, closes: #51619, #49584", " * This is from a very old version (0.56) of libpam0. It is not relevant", " to the latest version, closes: #47162", "" ], "package": "pam", "version": "0.72-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 26 Dec 1999 09:10:13 -0500" }, { "cves": [], "log": [ "", " * New upstream source release, lots of patches merged upstream (thanks", " Andrew).", " * libpam-doc: now provides pam-doc, closes: #45631", " * cleanups to the build system", " * shlibs.local: bumped shlib deps", "" ], "package": "pam", "version": "0.72-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 14 Dec 1999 11:17:36 -0500" }, { "cves": [], "log": [ "", " * Debian-PAM-MiniPolicy: new document describing how PAM is implemented", " in Debian", "" ], "package": "pam", "version": "0.71-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 26 Nov 1999 17:26:40 -0500" }, { "cves": [], "log": [ "", " * pam_listfile: lstat -> stat, closes: #49833", " * pam_tally: install the pam_tally program, closes: #50314", " * debian/control: libpam-modules, replaces libpam0g-util, closes: #50716", "" ], "package": "pam", "version": "0.71-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 25 Nov 1999 21:02:23 -0500" }, { "cves": [], "log": [ "", " * New upstream release, merges lots of patches from the Debian source,", " also merges the pam_{motd,mkhomedir,issue} modules into the main", " source. Lots of minor bugs fixed, and compiler warnings", " * pam_mail: Reimplemented the authentication handlers, so now this works", " as both (changes nothing in Debian, but was required to get the patch", " accepted upstream)", " * general: Lots of small edits to fix compiler warnings", " * pam_userdb: fixed potential usage of an unitialized value as", " PAM_AUTHTOK, doesn't look particularly exploitable, but better safe", " than sorry", "" ], "package": "pam", "version": "0.71-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 8 Nov 1999 19:21:52 -0500" }, { "cves": [], "log": [ "", " * pam_wheel/pam_wheel.c: change to use getpwuid(getuid()) by default, so", " avoid the problems associated with getlogin()", "" ], "package": "pam", "version": "0.70-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 1 Nov 1999 13:33:10 -0500" }, { "cves": [], "log": [ "", " * Applied patch from Herbert Xu to enable PAM_CONV_AGAIN support in", " pam_ftp, closes: #47288", "" ], "package": "pam", "version": "0.70-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 13 Oct 1999 13:25:21 -0400" }, { "cves": [], "log": [ "", " * 100_pam_pwdb_security_fix: new patch fixes security problem with", " regard to NIS accounts", "" ], "package": "pam", "version": "0.70-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 13 Oct 1999 11:42:41 -0400" }, { "cves": [], "log": [ "", " * New upstream release", " * Seems there were a lot of fixes merged/matches upstream, looks good,", " (maybe it's time I start sending my patches in, since the maintainer", " is active again).", " * libpamc: new library (libpam client library), this actually used to be", " in the Debian packages for a few versions, but it was removed upstream.", " Guess what, it's back :)", "" ], "package": "pam", "version": "0.70-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 10 Oct 1999 01:07:43 -0400" }, { "cves": [], "log": [ "", " * {pwdb,unix}_chkpwd.8: fixed format to get rid of \"no whatis\" warnings", " from mandb, closes: #47004", " * pam_unix.sgml: new file, documents the pam_unix.so module,", " closes: #46511", "" ], "package": "pam", "version": "0.69-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 9 Oct 1999 12:41:58 -0400" }, { "cves": [], "log": [ "", " * libpam/pam_item.c: fixed debug message being in wrong place", " * 013_pam_issue: new patch, provides issue file parsing for PAM", " applications (helps to replace lost functionality in login).", "" ], "package": "pam", "version": "0.69-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 6 Oct 1999 20:30:17 -0400" }, { "cves": [], "log": [ "", " * Fix typo in pam_mail.so module's \"no\" return", "" ], "package": "pam", "version": "0.69-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 3 Oct 1999 15:08:56 -0400" }, { "cves": [], "log": [ "", " * docs/modules/pam_mkhomedir.sgml: Fixed module name", " * changed build system structure", " * libpam/Makefile: add -lcrypt to the linked libs, closes: #46104", " * increase shlib deps to 0.69-7, closes: #45801", " * pam_motd.c: close motd file after reading, closes: #46122", " * pam_motd.c: fix setting \\0 in the wrong place when motd file is", " zero length, closes: #45686, #45632", " * pam_unix_acct.c: allow '0' to denote disabled for some expiry fields", " since chage(1) documents it this way, closes: #45446", " * pam_mail.c|modules/pam_mail.sgml: added 2 options, one \"standard\" to", " give the old style \"You have ...\" response and \"quiet\" which only", " reports new mail for both formats, documented both options,", " closes: #45670", " * with the new pam_unix module, this bug is fixed, closes: #42230", " * pam_limits.c: make sure that we not only ignore limits on root, we", " also remove them just in case we are su'ing from a limited user to", " the root account (since as root they can remove the limits anyway),", " closes: #35302", "" ], "package": "pam", "version": "0.69-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 3 Oct 1999 12:07:28 -0400" }, { "cves": [], "log": [ "", " * debian/rules: fixed module_check", " * pam_env/pam_env.c: fixed env parsing to include values wrapped in ''", " and also allow continued lines with a trailing '\\'.", " * pam_motd,pam_mail: converted to session modules, so that they could", " be ordered with the lastlog module", " * updated default pam.d/login to reflect above change (now login looks", " the same as the non-PAM version, lastlog, then motd, and then mail", " check)", " * pam_motd: removed extraneous \\n from output", " * modules/pam_limits/pam_limits.c: Fixed parsing of lines with only", " \"domain -\", which was documented as being able to get rid of limits", " for that user or group.", " * debian/control: (libpam-cracklib) Added depends for cracklib-runtime,", " closes: #45488", " * modules/pam_env.c: Fixed /etc/environment parsing causing segfaults on", " long lines, closes: #45408", "" ], "package": "pam", "version": "0.69-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 19 Sep 1999 13:50:40 -0400" }, { "cves": [], "log": [ "", " * Install unix_chkpwd suid root, it's needed for NIS to work without", " modification to the binary.", " * modules/pam_limits/pam_limits.c: hmm, some how I got a strange broken", " patch left over from the source upgrade...removed all but the pwdb", " purging, closes: #45088", " * modules/pam_env/pam_env.c: Changed to a debug message, instead of a", " syslog message when /etc/environment does not exist.", "" ], "package": "pam", "version": "0.69-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 15 Sep 1999 04:25:21 -0400" }, { "cves": [], "log": [ "", " * Removed libpam0g's preinst check for full paths in the pam.d files,", " this should really be a lintian check at build (i think the old libpam", " could not work like this, but hey...things change for the better some", " times. This PAM works fine like that). closes: #45001", " +NOTE: Debian packages should not reference modules by the full path", " so they don't break if I ever decide to move the modules to a different", " default directory. Only the admin should reference full paths and only", " for locally installed modules. I have submitted a request to check for", " this in lintian along with a few other devious things.", " * debian/patches/008_pam_mkhomedir: Fix title of sgml doc", " * modules/pam_userdb/Makefile: added patch for building against glibc 2.0", " (request from Roman Hodek), closes: #45064", "" ], "package": "pam", "version": "0.69-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 14 Sep 1999 06:12:34 -0400" }, { "cves": [], "log": [ "", " * Link all dynamic modules with libpam. For some reason, alpha doesn't", " like it when we don't", "" ], "package": "pam", "version": "0.69-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 13 Sep 1999 06:01:40 -0400" }, { "cves": [], "log": [ "", " * doc/modules/pam_cracklib.sgml: changed to correct path for", " cracklib_dict reference.", " * modules/pam_env/pam_env.c: now groks bash style env's from", " /etc/environment to be compatible with other programs that use it.", " * modules/pam_securetty/pam_securetty.c: don't just plain fail when", " root isn't allowed to login, fake a password request just like any", " good auth module would. Keeps us from letting them know that they", " are doing something bad :)", " * modules/pam_{motd,mkhomedir}: merged these two modules into this", " source, also wrote corresponding sgml files for libpam-doc,", " closes: #40754", " * debian/control: Moved libpam0g, libpam-modules and libpam-runtime", " to base with required priority since login depends on them and", " policy will require this", "" ], "package": "pam", "version": "0.69-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 11 Sep 1999 08:06:02 -0400" }, { "cves": [], "log": [ "", " * Modified build so that it uses libs and headers in the build tree", " rather than on the local system. This involved changint the build", " order slightly and should make it easier to compile on new archs.", " * Modified pam_limits so that it was invoked during pam_sm_setcred()", " instead of during pam_sm_session_open() so that it will work with", " shadow's su.", " * Fixed missing symbols in libpam.so, they were caused by it thinking", " it was supposed to have static modules built in.", " * Fixed problem where libpam was getting built with -DDEBUG", " * pam_unix_passwd.c: Changed the perms on shadow to be 0.42 and 0640", " instead of 0.0 and 0600", " * unix_chkpwd: fix it not being sgid shadow", "" ], "package": "pam", "version": "0.69-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 9 Sep 1999 13:52:01 -0400" }, { "cves": [], "log": [ "", " * New upstream source", " - Now with a new and improved pam_unix module, closes: #38631", " - Lot's of documentation cleanups", " * Converted build system to dbs (doogie's build system, aka Adam Heath)", " * Fixed libpam.so compilation so that it did not link with any of the", " modules (this was causing lot's of problems, closes; #43913, #40739", " * modules/pam_ftp/pam_ftp.c: Fixed sizeof, to use strlen,", " closes: #44054, #41845, #44142, #39129, #39871, #44412", " * Postscript pages are now generated correctly, closes: #41608", " * Moved to FHS compliance (including use of debhelper 2.0.40),", " this also raises the policy version to 3.0.1.1", " * Don't check the paths in /etc/pam.d files anymore. This is old", " and causes nothing but complaints, closes: #39747", " * Build libpam0g-dbg with debuggable static and shared libraries, also", " enabled the internal DEBUG_REL compile flag for these so that the", " debugging messages will also be output", "" ], "package": "pam", "version": "0.69-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 7 Sep 1999 17:45:20 -0400" }, { "cves": [], "log": [ "", " * Added ability for pam_env to parse /etc/environment and updated", " docs to reflect it", " * Applied patch for pwdb_chkpwd man page, closes: #38976", " * Merged pam_unix_*.so modules into one pam_unix.so with symlinks", " for backward compatibility. This helps centralize this module the", " same way the pam_pwdb.so is and the way pam_unix.so is on other", " operating systems (commercial ones specifically).", " * Closed by pam-apps upload, closes: #38632", " * Fixed `sgml2latex' syntax, closes: #39119", " * Added doc-base support, closes: #37627", "" ], "package": "pam", "version": "0.66-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 16 Jun 1999 01:20:23 -0400" }, { "cves": [], "log": [ "", " * SPARC NMU to fix chown symbols when compiling with glibc 2.1.1", "" ], "package": "pam", "version": "0.66-9.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 11 May 1999 13:33:33 +0000" }, { "cves": [], "log": [ "", " * Changed the debian/rules to not mess with the library symlinks (ie", " running ldconfig in the lib dir) and all is well, closes: #36169", "" ], "package": "pam", "version": "0.66-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 18 Apr 1999 09:09:51 -0400" }, { "cves": [], "log": [ "", " * Compiled with libpam_client.so now (seperate lib in libpam0g)", " * Made regex for libpam0g postinst a little more specific so it", " didn't flag false problems. closes: #34626", " * Applied patch to fix pam_ftp, closes: #35388", " * Modified pam_mail and pam_lastlog to honor PAM_SILENT in order to", " enable apps to use hushlogin/PAM_SILENT", " * Fixed problem with libpam_client.so being static", "" ], "package": "pam", "version": "0.66-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 15 Mar 1999 20:54:23 -0500" }, { "cves": [], "log": [ "", " * Fixed XCASE in pam_filter.c (not really in glibc 2.1 by default)", "" ], "package": "pam", "version": "0.66-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 6 Mar 1999 18:46:56 -0500" }, { "cves": [], "log": [ "", " * Removed empty /lib/security/ from libpam0g (is created in", " libpam-runtime)", " * Added a depends for libpam-runtime to libpam0g (was supposed to be", " there, must have deleted it)", " * Removed empty /usr/bin from libpam-runtime (old directory where", " upperLOWER was)", "" ], "package": "pam", "version": "0.66-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 24 Feb 1999 13:14:25 -0500" }, { "cves": [], "log": [ "", " * Removed harcoded libc6 dependency from libpam0g-dev and changed it to", " libc6-dev. closes: #33615", " * Added md5 flag for pam_unix_passwd.so", " * Removed upperLOWER program since it is just an example. Moved it's", " source to the examples directory in libpam-modules", " * Fixed documentation of pam_strerror() and examples. closes #31142", " * Made pam_unix_passwd.so leave /etc/shadow mode 640 and root.shadow", " after changes", " * Fixed problem in pam_unix_auth that didn't let you su from a normal", " user to another normal user (ie. neither one was root)", " * Closing misc fixed bugs. closes #32809, #32274 (have been fixed,", " just need closing)", " * Tested lockvc with pam support, works for normal users (pam_pwdb)", " closes: #31150", " * Changed /var/log/wtmp in pam_lastlog docs to reflect correct", " /var/log/lastlog file. closes: #26544", " * Added -ldl to libpam.so, so apps don't have to", "" ], "package": "pam", "version": "0.66-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 19 Feb 1999 18:47:30 -0500" }, { "cves": [], "log": [ "", " * Changed pwdb_chkpwd to sgid shadow instead of suid root since it only", " needs read permissions to /etc/shadow and not write.", " * Moved a lot of files arouns to get rid of libpam-runtime dependencies", " * Put libpam-pwdb into it's own package", " * Removed -lpwdb links for modules since libpwdb is somewhat buggy (or", " alteast it's interaction with libpam is)", " * Fixed bug in pam_unix_passwd.so that caused it to never authenticate", " the correct passwd, making it so you couldn't change the passwd", "" ], "package": "pam", "version": "0.66-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 16 Feb 1999 15:50:28 -0500" }, { "cves": [], "log": [ "", " * Fixed defaults in /etc/pam.d/other to be pam_unix_*.so modules instead", " of the accidental pam_pwdb.so module", " * Fixed suid of pwdb_chkpwd (had to move dh_fixperms after", " dh_suidregister)", " * Added Replaces: libpam0g-util in order to help dpkg upgrade from", " older packages", " * Applied glibc 2.1 patch from Christian Meder. closes: #32809", " * Moved libpam-doc to Section doc. closes: #32274", "" ], "package": "pam", "version": "0.66-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 12 Feb 1999 02:01:43 -0500" }, { "cves": [], "log": [ "", " * Removed all of the versioned module stuff. Modules are now in", " /lib/security and stay there. Seems after discussion, that modules may", " not change as often as thought", " * Fixed suidregister for pwdb_chkpwd", " * Fixed incomplete descriptions in control file", " * This is a kludge to close some bugs since the last upload was yanked", " before being installed in the archive, closes: #16882, #30862, #7725,", " #10234, #10406, #12210, #14291, #15528, #15529, #20660, #25330,", " #29868, #31088, #31128, #9131, #9919, #19383, #5132, #14533, #25915,", " #28075, #31548, #31191", "" ], "package": "pam", "version": "0.66-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 2 Feb 1999 12:47:25 -0500" }, { "cves": [], "log": [ "", " * New maintainer", " * New upstream release. closes: #16882, #30862, #7725", " * Created a better split of the main lib and the runtime to kill the", " circular dependencies and make it possible to have two .so version of", " the library installed for upgrades. closes: #10234, #10406, #12210,", " bug #14291, #15528, #15529, #20660, #25330, #29868, #31088, #31128,", " bug #9131, #9919.", " * Harcoded modules directory prefixed with the .so version, and", " used alternatives to create the symlink to the 'default' modules", " directory. libpam will use the full path when specified, but use the", " versioned modules directory for relative names.", " * Put libpam0g-cracklib modules back in (own package). This means that", " cracklib support is _not_ in the static libpam.a, also cracklib", " support is _not_ in pam_unix_passwd.o, but only in pam_cracklib.so", " by itself.", " * Fixed a few typos in the source causing compile errors", " * Fixed source #include's so that pam _didn't_ have to be installed", " in order to compile the source ( changed from <> to \"\" )", " * Removed empty directories from built packages", " * Opted not to build examples, only going to put *.c files in examples", " directory for libpam0g-dev", " * Moved *.sgml files for modules into their own directory (looks like", " that is what the original maintainer wanted to do, but it didn't go)", " * Moved doc build to arch-indep build in rules so that it doesn't get", " built when specifying -B with debuild/dpkg-buildpackage.", " * Moved `touch .quiet...' to build-stamp in order to have -B builds not", " ask about pam.conf", " * Split out non-standard modules to their own package, so as to make the", " base install smaller (planning for base inclusion here)", " * Created small manpage for pwdb_chkpwd. closes: #10941", " * The Copright file in /usr/doc/*/ was already named copright and not", " compressed. closes: #14533", " * Package is now lintian clean. closes #19383, #5132", " * There is a maintainer now and the patch for #25915 is still included", " so.... closes: #25915", " * Added check for editor backup files in /etc/pam.d (*~). closes: #28075", " * Applied patch for md5.h in pam_pwdb module. closes: #31548", " * Added support for dhelp in libpam-doc. closes: #31191", "" ], "package": "pam", "version": "0.66-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 20 Jan 1999 07:09:15 -0500" }, { "cves": [], "log": [ "", " * Marked PAM as orphaned, given that there has been no maintainer upload", " in almost two years.", " * [defs/debian.defs] Removed superflous cracklib2 dependency.", " (Urgent as cracklib still has release-critical bugs).", " (Fixes #30862).", "" ], "package": "pam", "version": "0.65-0.8", "urgency": "high", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Wed, 20 Jan 1999 09:34:35 +0100" }, { "cves": [], "log": [ "", " * Fixed security vulnerability in the pam_unix and pam_tally modules", " (reported by Michal Zalewski on bugtraq; patch", " A000-SECURITY-PATCH-0.65-and-below.gz by Andrey V. Savochkin).", "" ], "package": "pam", "version": "0.65-0.7", "urgency": "high", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Tue, 29 Dec 1998 16:20:18 +0100" }, { "cves": [], "log": [ "", " * Fixed distribution of files over the various packages, which was", " severely messed up.", " * Added appropriate Replaces: to ensure upgrading from both the hamm", " version and previous slink versions.", " * Fixed debug libraries, PAM module loading.", " * Added examples.", " * Added a \"pam-undocumented\" manpage pointing to libpam-doc, and", " made links for functions without a manpage to that.", "" ], "package": "pam", "version": "0.65-0.6", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Sun, 11 Oct 1998 19:29:40 +0200" }, { "cves": [], "log": [ "", " * Rewritten the preinst warning text (it still mentioned the search path).", "" ], "package": "pam", "version": "0.65-0.5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Fri, 9 Oct 1998 14:23:18 +0200" }, { "cves": [], "log": [ "", " * It looks like I misunderstood DEFAULT_MODULE_PATH: Linux-PAM does not", " currently seem to be easily configured to look for modules in more than", " one directory. With this version, it's configured to look only in", " /lib/security .", "" ], "package": "pam", "version": "0.65-0.4", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Fri, 9 Oct 1998 11:43:34 +0200" }, { "cves": [], "log": [ "", " * Moving the PAM modules to /lib/security broke netatalk.", " Added a preinst script to detect /etc/pam.d files with explicit paths to", " PAM modules, give a warning about them, and offer to abort the install", " (Fixes #27514).", "" ], "package": "pam", "version": "0.65-0.3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Tue, 6 Oct 1998 20:10:43 +0200" }, { "cves": [], "log": [ "", " * Argh. The tools didn't recognise -0.1 as a new upstream release, so", " my previous upload was rejected due to a missing .orig.tar.gz .", "" ], "package": "pam", "version": "0.65-0.2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Sun, 4 Oct 1998 17:15:09 +0200" }, { "cves": [], "log": [ "", " * New upstream version.", " * Non-maintainer upload.", " * Major package overhaul; now uses debhelper.", " * In experimental for now. *Please* provide feedback; if the feedback is", " positive, we can put this in slink.", " * Dropped libc5 support.", " * [libpam/pam_static.c] Fixed compilation: \"pamh\" was undefined; use \"NULL\".", " is this the correct fix?", " * [defs/debian.defs] New.", " * [Makefile]", " * Exit when a make in a subdirectory fails.", " * Compile statically too.", " * New variables: LC, LP, LPLIBS, DEFAULT_MODULE_PATH .", " * [libpam/Makefile]", " * Use DEFAULT_MODULE_PATH if nonempty.", " * Link libpam against LPLIBS.", " * [modules/*/Makefile]", " * Link the dynamic security objects against libpam and libc", " (LP and LC).", " * [modules/pam_pwdb/Makefile]", " * Link dynamic security objects against libcrypt and libnsl.", " * [conf/install_conf] Allow for non-interactive install (as the other", " install_conf scripts already did).", " * Automatically determine the list of /etc/security/* conffiles.", " * Moved libpam to /lib, and PAM modules to /lib/security as they will", " become part of the base system in the future.", " * Built without cracklib support, to keep the base system smaller.", " * /sbin/pwdb_chkpwd is undocumented, as is upperLOWER.", "" ], "package": "pam", "version": "0.65-0.1", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Fri, 2 Oct 1998 20:23:27 +0200" }, { "cves": [], "log": [ "", " * Non maintainer upload", " My previous upload had removed the libc5 stuff from the controlfile", " messing up things. Change 'Architecture: any' to 'i386 m68k' for those", " .deb's instead.", "" ], "package": "pam", "version": "0.57b-0.4", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Turbo Fredriksson ", "date": "Thu, 20 Aug 1998 20:06:50 -0400" }, { "cves": [], "log": [ "", " * Non maintainer upload", " On a glibc2.1 system, XCASE is only defined in the ", " _IF_ '__USE_MISC' or '__USE_UNIX98' is defined.", "" ], "package": "pam", "version": "0.57b-0.3", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Turbo Fredriksson ", "date": "Sun, 16 Aug 1998 22:13:45 -0400" }, { "cves": [], "log": [ "", " * Yet another non-maintainer release.", " * Zero changes; simply a re-upload due to a rm-trigger happy release", " ``manager''.", "" ], "package": "pam", "version": "0.57b-0.2", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "James Troup ", "date": "Tue, 17 Mar 1998 19:55:16 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer release.", " * debian/control (Standards-Version): Updated to 2.4.0.0.", " * debian/control (libpam0g-dev): Also conflict with libpam-dbg.", " * debian/postinst: use case statement instead of if.", " * debian/rules (COMPAT_ARCHES): removed sparc.", " * debian/rules (binary-libc6-dev, binary-libc5-altdev): strip static libraries with", " --strip-debug, not --strip-unneeded.", " * debian/rules: each package now has it's own doc directory under", " /usr/doc/, containing at least the copyright file (Policy 5.6).", " * debian/rules: install files with `install -m 644' not `cp -p' to avoid", " read-only files.", " * debian/rules (binary-libc6-util): strip /usr/lib/*/security/*.so with", " --strip-unneeded.", " * debian/rules (binary-libc5-util): ditto.", " * debian/rules (binary-libc5): don't depend on binary-libc5.", "" ], "package": "pam", "version": "0.57b-0.1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "James Troup ", "date": "Sat, 7 Mar 1998 18:04:19 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer release.", " * New upstream version.", " * Doesn't use pristine upstream source as the upstream tar ball is broken.", " * Added libc6 libraries libpam0g, libpam0g-dev, libpam0g-dbg and", " libpam0g-util. [#11697]", " * libpam-dev becomes libpam0-altdev, libpam-util -> libpam0-altutil and", " libpam-dbg is removed.", " * libpam0 depends on libpam0g because libpam0g contains the pam conffile.", " * libpam0-util depends on libpam0g-util because libpam0g contains the binary.", " * Compiled with -D_REENTRANT and link with -lc.", " * Fixed permissions on shared libraries.", " * Corrected syntax of /etc/pam.d/other. [#10497, #10758, #12030]", " * Fixed typos in postinst. [#10474, #11365]", " * Made /etc/pam.conf a conffile.", " * Updated URL in copyright file.", " * Removed over-zelaously installed README* files from libpam-doc.", "" ], "package": "pam", "version": "0.57b-0", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "James Troup ", "date": "Sat, 22 Nov 1997 17:54:30 +0100" }, { "cves": [], "log": [ "", " * Added /etc/pam.d/other with policy 'deny'.", " * Add manual pages for PAM security modules.", "" ], "package": "pam", "version": "0.56-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Klee Dienes ", "date": "Sat, 15 Mar 1997 22:33:22 -0500" }, { "cves": [], "log": [ "", " * New upstream release.", " * Converted to new packaging format.", " * Reorganization of package structure (-dev, -dbg, etc).", "" ], "package": "pam", "version": "0.56-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Klee Dienes ", "date": "Sat, 8 Mar 1997 01:21:17 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam0g", "from_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.6", "version": "1.5.3-5ubuntu5.6" }, "to_version": { "source_package_name": "pam", "source_package_version": "1.5.3-5ubuntu5.7", "version": "1.5.3-5ubuntu5.7" }, "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" }, { "cve": "CVE-2024-10963", "url": "https://ubuntu.com/security/CVE-2024-10963", "cve_description": "A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.", "cve_priority": "medium", "cve_public_date": "2024-11-07 16:15:00 UTC" }, { "cve": "CVE-2025-6020", "url": "https://ubuntu.com/security/CVE-2025-6020", "cve_description": "A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.", "cve_priority": "medium", "cve_public_date": "2025-06-17 13:15:00 UTC" }, { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" }, { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" }, { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" }, { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" }, { "cve": "CVE-2015-3238", "url": "https://ubuntu.com/security/CVE-2015-3238", "cve_description": "The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.", "cve_priority": "low", "cve_public_date": "2015-08-24 14:59:00 UTC" }, { "cve": "CVE-2013-7041", "url": "https://ubuntu.com/security/CVE-2013-7041", "cve_description": "The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack.", "cve_priority": "low", "cve_public_date": "2014-05-08 14:29:00 UTC" }, { "cve": "CVE-2014-2583", "url": "https://ubuntu.com/security/CVE-2014-2583", "cve_description": "Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.", "cve_priority": "low", "cve_public_date": "2014-04-10 20:29:00 UTC" }, { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2010-3853", "url": "https://ubuntu.com/security/CVE-2010-3853", "cve_description": "pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3316", "url": "https://ubuntu.com/security/CVE-2010-3316", "cve_description": "The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pam_xauth PAM check.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3430", "url": "https://ubuntu.com/security/CVE-2010-3430", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3431", "url": "https://ubuntu.com/security/CVE-2010-3431", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3435", "url": "https://ubuntu.com/security/CVE-2010-3435", "cve_description": "The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-0832", "url": "https://ubuntu.com/security/CVE-2010-0832", "cve_description": "pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to \"user file stamps\" and the motd.legal-notice file.", "cve_priority": "high", "cve_public_date": "2010-07-12 16:30:00 UTC" }, { "cve": "CVE-2009-0887", "url": "https://ubuntu.com/security/CVE-2009-0887", "cve_description": "Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.", "cve_priority": "low", "cve_public_date": "2009-03-12 15:20:00 UTC" }, { "cve": "CVE-2005-2977", "url": "https://ubuntu.com/security/CVE-2005-2977", "cve_description": "The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unix_chkpwd, which does not log failed guesses or delay its responses.", "cve_priority": "medium", "cve_public_date": "2005-11-01 12:47:00 UTC" } ], "launchpad_bugs_fixed": [ 2164901, 2087827, 2064360, 2064350, 2059859, 2055453, 1953201, 1953201, 1916509, 1860826, 772121, 1860826, 1935972, 1927796, 1659719, 1856703, 1855092, 1192719, 1192719, 1538284, 1081323, 1571864, 1487103, 1558114, 557013, 1160288, 1126404, 110287, 955032, 1095887, 937005, 110287, 871083, 744944, 871943, 805423, 745004, 882794, 871943, 805423, 874469, 874565, 794531, 253096, 746655, 391761, 745532, 663090, 744944, 733501, 297408, 588547, 562566, 552175, 513955, 356766, 424566, 287715, 410171, 399071, 399071, 314222, 303515, 305882, 303515, 305882, 303515, 305882, 294513, 295135, 295441, 65244, 256238, 291091, 272232, 270328, 260371, 260122, 259867, 216990, 216990, 245786, 9224, 64064, 216990, 141309, 187822, 139075, 64064, 216990, 208419, 198714, 187822, 139075, 141309, 139065, 141309, 139075, 43169, 14505, 80431 ], "changes": [ { "cves": [], "log": [ "", " * SECURITY UPDATE: account lockout bypass in pam_faillock account", " management phase (LP: #2164901)", " - debian/patches/lp-2164901.patch: skip clearing user's failed", " attempt in modules/pam_faillock/pam_faillock.8.xml,", " modules/pam_faillock/pam_faillock.c.", " - No CVE number", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.7", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [ 2164901 ], "author": "Shafayat Hossain Majumder ", "date": "Wed, 26 Aug 2026 15:28:35 -0400" }, { "cves": [ { "cve": "CVE-2026-54411", "url": "https://ubuntu.com/security/CVE-2026-54411", "cve_description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.", "cve_priority": "medium", "cve_public_date": "2026-06-14 18:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: password recovery via timing discrepancy in pam_userdb", " module string comparisons", " - debian/patches/CVE-2026-54411-pre1.patch: libpam: add helper to compare", " strings in constant time in libpam/include/pam_inline.h.", " - debian/patches/CVE-2026-54411.patch: pam_userdb: fix password comparison", " timing leak in libpam/include/pam_inline.h,", " modules/pam_userdb/pam_userdb.c.", " - CVE-2026-54411", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 16 Jul 2026 09:44:01 -0400" }, { "cves": [ { "cve": "CVE-2024-10963", "url": "https://ubuntu.com/security/CVE-2024-10963", "cve_description": "A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.", "cve_priority": "medium", "cve_public_date": "2024-11-07 16:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: pam_access hostname confusion", " - debian/patches/CVE-2024-10963.patch: add \"nodns\" option to disallow", " resolving of tokens as hostname in", " modules/pam_access/access.conf.5.xml,", " modules/pam_access/pam_access.8.xml,", " modules/pam_access/pam_access.c.", " - CVE-2024-10963", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.5", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 15 Sep 2025 08:37:15 -0400" }, { "cves": [ { "cve": "CVE-2025-6020", "url": "https://ubuntu.com/security/CVE-2025-6020", "cve_description": "A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.", "cve_priority": "medium", "cve_public_date": "2025-06-17 13:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: privilege escalation via pam_namespace", " - debian/patches/pam_namespace_170.patch: sync pam_namespace module to", " version 1.7.0.", " - debian/patches/pam_namespace_post170-*.patch: add post-1.7.0 changes", " from upstream git tree.", " - debian/patches/pam_namespace_revert_abi.patch: revert ABI change to", " prevent unintended issues in running daemons.", " - debian/patches/CVE-2025-6020-1.patch: fix potential privilege", " escalation.", " - debian/patches/CVE-2025-6020-2.patch: add flags to indicate path", " safety.", " - debian/patches/CVE-2025-6020-3.patch: secure_opendir: do not look at", " the group ownership.", " - debian/patches/pam_namespace_o_directory.patch: removed, included in", " patch cluster above.", " - CVE-2025-6020", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.4", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 12 Jun 2025 10:45:28 -0400" }, { "cves": [], "log": [ "", " * d/p/031_pam_include: fix loading from /usr/lib/pam.d (LP: #2087827)", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2087827 ], "author": "Simon Chopin ", "date": "Mon, 26 May 2025 16:34:46 +0200" }, { "cves": [], "log": [ "", " [ Sam Hartman ]", " * Correct Build depends for docbook5 (LP: #2064360)", " * Depend on libdb-dev again, bringing back pam_userdb (LP: #2064350)", "" ], "package": "pam", "version": "1.5.3-5ubuntu5.1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2064360, 2064350 ], "author": "Dan Bungert ", "date": "Thu, 02 May 2024 16:20:13 -0600" }, { "cves": [], "log": [ "", " * d/p/pam_env-remove-deprecation-notice-for-user_readenv.patch: drop", " deprecation warning about user_readenv from pam_env (LP: #2059859)", "" ], "package": "pam", "version": "1.5.3-5ubuntu5", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2059859 ], "author": "Andreas Hasenack ", "date": "Wed, 10 Apr 2024 16:19:22 -0300" }, { "cves": [ { "cve": "CVE-2024-3094", "url": "https://ubuntu.com/security/CVE-2024-3094", "cve_description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.", "cve_priority": "critical", "cve_public_date": "2024-03-29 17:15:00 UTC" } ], "log": [ "", " * No-change rebuild for CVE-2024-3094", "" ], "package": "pam", "version": "1.5.3-5ubuntu4", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 31 Mar 2024 00:03:23 +0000" }, { "cves": [], "log": [ "", " * No-change rebuild against libdb5.3t64", "" ], "package": "pam", "version": "1.5.3-5ubuntu3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 02 Mar 2024 20:36:06 +0000" }, { "cves": [], "log": [ "", " * Fix FTBFS when built with -Werror=implicit-function-declaration", " (LP: #2055453)", "" ], "package": "pam", "version": "1.5.3-5ubuntu2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2055453 ], "author": "Dan Bungert ", "date": "Thu, 29 Feb 2024 11:53:08 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager", " when there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", "" ], "package": "pam", "version": "1.5.3-5ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Dan Bungert ", "date": "Thu, 29 Feb 2024 10:25:41 -0700" }, { "cves": [], "log": [ "", " * Revert renaming libpam0g to libpam0t64 for time_t transition: apt", " sometimes removes libpam0g rather than simply letting libpam0t64", " replace libpam0g (and deconfiguring libpam0g), leaving a system where", " essential packages are broken, Closes: #1065017", " * Since libpam0t64 is going away, we do not need dpkg-diversions for it.", " * As a consequence libpam_misc has an ABI break without a package name", " change. We believe nothing in the archive depends on this ABI, and at", " least until we come up with a better solution this is the least bad option.", " * For now remove libdb-dev so that libdb-dev can undergo time_t", " transition. That means this version of pam does not include", " pam_userdb, which makes pam unsuitable for release. ", " * Replace/break libpam0t64", "" ], "package": "pam", "version": "1.5.3-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 29 Feb 2024 09:46:54 -0700" }, { "cves": [ { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" } ], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0t64.postinst: only ask questions during update-manager", " when there are non-default services running.", " - debian/libpam0t64.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " * Dropped changes, included in Debian:", " - SECURITY UPDATE: pam_namespace local denial of service", " - debian/patches/CVE-2024-22365.patch: use O_DIRECTORY to", " prevent local DoS situations in modules/pam_namespace/pam_namespace.c.", " - CVE-2024-22365", " - Install into /usr/{lib,sbin} instead of /{lib,sbin}. Assumes", " usrmerge aliasing symlinks are in place since bookworm to keep", " compatibility with PAM modules still installing into /lib.", " (DEP17 M2) (Closes: #1060160).", " - Mitigate /usr-move file loss. (Closes: #1062802)", " - Update lintian override for setgid binary.", "" ], "package": "pam", "version": "1.5.3-4ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Dan Bungert ", "date": "Wed, 28 Feb 2024 21:07:18 -0700" }, { "cves": [], "log": [ "", " * Upload to unstable", " * Revert 1.5.2-9.1 changes to debian/rules now that we use", " debian/patches properly.", "" ], "package": "pam", "version": "1.5.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 27 Feb 2024 21:30:52 -0700" }, { "cves": [], "log": [ "", " [ Helmut Grohne ]", " * Mitigate /usr-move file loss. (Closes: #1062802)", "" ], "package": "pam", "version": "1.5.3-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Helmut Grohne ", "date": "Sat, 03 Feb 2024 12:18:52 +0100" }, { "cves": [ { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" } ], "log": [ "", " * Rename libpam0g to libpamt64 for time_t transition", " * New Swedish Translations, Thanks Martin Bagge / brother, Closes: #1057775", " * pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS", " situations (CVE-2024-22365) (Closes: #1061097)", "" ], "package": "pam", "version": "1.5.3-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 02 Feb 2024 11:27:45 -0700" }, { "cves": [], "log": [ "", " [ Sam Hartman ]", " * New upstream version", " * Since we no longer build with NIS support, drop Debian patches related", " to NIS", " [ Debian Janitor]", " * Update lintian override info to new format:", " + debian/libpam-runtime.lintian-overrides: line 5, 7, 9-13", " + debian/libpam-modules.lintian-overrides: line 5-10, 14", " * Trim trailing whitespace.", " * Move source package lintian overrides to debian/source.", " * Update renamed lintian tag names in lintian overrides.", " * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository-Browse.", " * Drop unnecessary dependency on dh-autoreconf.", " * Update standards version to 4.6.2, no changes needed.", "", " [ Andreas Henriksson ]", " * debian/rules: use --enable-usergroups configure flag (Closes: #583958)", " * Use pam_umask.so in common-session{-noninteractive} (Closes: #711104)", "", " [ Debian Janitor ]", " * Apply multi-arch hints. + libpam-doc: Add Multi-Arch: foreign.", "", " [ Sam Hartman ]", " * Drop NIS patches and rearrange other patches.", " * Update patch to move pam manpage to section 7: docbook tools now take", " the man page output name from the xml so we need to update the", " Makefile. ", " * Now PAM.7 is actually installed as pam.7 so update packaging", " * pam-auth-update: Session-Interactive-Only set to anything other than", " yes counts as undefined/no, thanks Lucas Nussbaum, Closes: #982309", " * Use logind instead of utmp in pam_issue and pam_timestamp; utmp is not", " y2038-safe.", "", " [ Sam Hartman ]", " * Add new common-session-* templates to pam-auth-update.", "", " [ Chris Hofstaedtler ]", " * Install into /usr/{lib,sbin} instead of /{lib,sbin}. Assumes", " usrmerge aliasing symlinks are in place since bookworm to keep", " compatibility with PAM modules still installing into /lib.", " (DEP17 M2) (Closes: #1060160).", " * Update lintian override for setgid binary.", " " ], "package": "pam", "version": "1.5.3-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 15 Jan 2024 15:45:50 -0700" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Install into /usr/{lib,sbin} instead of /{lib,sbin}. Assumes", " usrmerge aliasing symlinks are in place since bookworm to keep", " compatibility with PAM modules still installing into /lib.", " (DEP17 M2) (Closes: #1060160).", " * Update lintian override for setgid binary.", "", " [ Helmut Grohne ]", " * Mitigate /usr-move file loss. (Closes: #1062802)", "" ], "package": "pam", "version": "1.5.2-9.1ubuntu3", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Thu, 22 Feb 2024 13:24:31 +0100" }, { "cves": [ { "cve": "CVE-2024-22365", "url": "https://ubuntu.com/security/CVE-2024-22365", "cve_description": "linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.", "cve_priority": "medium", "cve_public_date": "2024-02-06 08:15:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: pam_namespace local denial of service", " - debian/patches-applied/CVE-2024-22365.patch: use O_DIRECTORY to", " prevent local DoS situations in modules/pam_namespace/pam_namespace.c.", " - CVE-2024-22365", "" ], "package": "pam", "version": "1.5.2-9.1ubuntu2", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 17 Jan 2024 12:28:44 -0500" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " * debian/update-motd.5: fix a typo; thanks to David", " Collantes .", "" ], "package": "pam", "version": "1.5.2-9.1ubuntu1", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 20 Nov 2023 06:39:20 -0800" }, { "cves": [], "log": [ "", " * Non-maintainer upload acked by Sam Hartman.", " * Really fix quilt-related FTBFS: (Closes: #1054505)", " pam is a 3.0 (quilt) source package and has a .pc directory after unpack", " despite having no debian/patches. Even when setting QUILT_PATCH_DIR or", " QUILT_PATCHES, quilt is now mislead to using the non-existent", " debian/patches and this makes dh_quilt_unpatch fail, so we delete that", " directory unless it corresponds to the real debian/patches-applied that we", " want to be used.", "" ], "package": "pam", "version": "1.5.2-9.1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Helmut Grohne ", "date": "Tue, 24 Oct 2023 19:38:53 +0200" }, { "cves": [], "log": [ "", " * Revert 1.5.2-8 upload; as far as I can tell the change is incorrect,", " Closes: #1054493", " " ], "package": "pam", "version": "1.5.2-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 24 Oct 2023 09:19:43 -0600" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * Drop reference to stale package version in libpam-modules.postinst;", " thanks, Gioele Barabucci .", "", " [ Sam Hartman ]", " * Fix pam-auth-update --disable logic error, Closes: #1039873", " * Set myself as maintainer; thanks Steve for past and future work.", " * Fix watch file, thanks Daniel Lewart, Closes: #1040310", " * Install upstream NEWS file as main upstream changelog; detailed", " CHANGELOG only in libpam-doc, Closes: #1040315", " * Updated Turkish Debconf translations, Thanks Atila KOÇ, Closes: #1029002", "" ], "package": "pam", "version": "1.5.2-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 16 Aug 2023 17:22:53 -0600" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", "" ], "package": "pam", "version": "1.5.2-6ubuntu1", "urgency": "medium", "distributions": "mantic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 15 May 2023 15:17:53 -0700" }, { "cves": [], "log": [ "", " * Update debian/copyright, Thanks Bastian Germann, Closes: #460232", " * When pam-auth-update is called with --root, use", " /usr/share/pam-configs from the root not from the host system, Thanks", " Johannes Schauer Marin Rodrigues, Closes: #1022952", " * Build-depend on libcrypt-dev, Closes: #1024645", " * Add pam-auth-udpate --disable, Closes: #1004000", " * Add autopkgtests", "" ], "package": "pam", "version": "1.5.2-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 03 Jan 2023 13:15:23 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable; remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", "" ], "package": "pam", "version": "1.5.2-5ubuntu1", "urgency": "medium", "distributions": "lunar", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Nov 2022 12:53:39 -0800" }, { "cves": [], "log": [ "", " * pam_namespace_helper manpage *wasn't* missing, it was just being", " wrongly shipped in libpam-modules instead - so complete the moving", " of the manpage to the libpam-modules-bin where it belongs with the", " binary. Really Closes: #1021336.", "" ], "package": "pam", "version": "1.5.2-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 06 Oct 2022 18:56:06 +0000" }, { "cves": [], "log": [ "", " * pam_namespace_helper manpage was missing, but namespace.conf.5 was", " already shipped in libpam-modules. Leave it there. Closes: #1021336.", "" ], "package": "pam", "version": "1.5.2-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 06 Oct 2022 17:28:36 +0000" }, { "cves": [], "log": [ "", " * Add missing manpages for pam_namespace which for some reason don't get", " installed by the upstream rules", " * Drop obsolete upgrade code from maintainer scripts which is no longer", " used", " * Drop manual multiarch file handling in favor of dh-exec.", " * No special-case needed for pam_modutil_sanitize_helper_fds in symbols", " file, it's covered by the existing globs.", " * debian/local/Debian-PAM-MiniPolicy: drop references to ancient", " package versions. Thanks, Marc Haber.", " * Support DPKG_ROOT in the postinst scripts. Closes: #993161.", " Thanks, Johannes Schauer Marin Rodrigues.", " * Further proof libpam-runtime postinst for DPKG_ROOT just in case.", "" ], "package": "pam", "version": "1.5.2-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 06 Oct 2022 04:05:02 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " * Dropped changes, no longer needed:", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", " * Refresh patches.", " * debian/patches-applied/extrausers.patch: update for upstream changes.", "" ], "package": "pam", "version": "1.5.2-2ubuntu1", "urgency": "medium", "distributions": "kinetic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Aug 2022 18:16:30 +0000" }, { "cves": [], "log": [ "", " * Pass --with-systemdunitdir=/usr/lib/systemd/system for consistent", " builds whether we are or aren't building in an environment with systemd", " present.", " * Install the pam_namespace.service unit in the libpam-modules-bin", " package.", "" ], "package": "pam", "version": "1.5.2-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Aug 2022 16:47:57 +0000" }, { "cves": [], "log": [ "", " * New upstream release.", " - fixes compatibility with libpam-systemd. Closes: #1017467.", " - fixes bashisms in configure.ac. Closes: #998361.", " * Refresh patches.", " * Drop patches included or obsoleted upstream:", " - debian/patches-applied/pam_unix_fix_sgid_shadow_auth.patch", " - debian/patches-applied/pam_unix_initialize_daysleft", " - debian/patches-applied/pam_faillock_create_directory", " - debian/patches-applied/pam_unix_avoid_checksalt", " - debian/patches-applied/pam_env-allow-environment-files-without-EOL-at-EOF.patch", " * Drop libpam-cracklib which has been obsoleted upstream.", " * Add pkgconfig .pc files to libpam0g-dev. Closes: #1012688.", " * Update .symbols file.", " * Updated Romanian debconf translation, thanks Andrei Popescu, Closes:", " #986416", " * Drop versioning of quilt build-dependency to quiet lintian, since the", " version is satisfied by oldoldoldstable.", " * Drop unused build-build-dependency on bzip2.", " * Adjust lintian overrides for latest lintian syntax.", " * Update Standards-Version.", " * Bump debhelper compat to 13.", " * debian/not-installed: document upstream files that aren't used.", " * Override incorrect lintian warning about use of dpkg database.", " * Override lintian warning for PAM module manpages being in section 8", " * Override lintian warning for unused debconf templates", " * Install additional upstream manpages: faillock(8), environment(5),", " pwhistory_helper(8)", " * Install additional helpers in libpam-modules-bin: pam_namespace_helper,", " pwhistory_helper", " * Fix wrong syntax in symbols file", "" ], "package": "pam", "version": "1.5.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Aug 2022 07:27:16 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", "" ], "package": "pam", "version": "1.4.0-13ubuntu1", "urgency": "medium", "distributions": "kinetic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 26 Apr 2022 11:10:38 -0700" }, { "cves": [], "log": [ "", " * Don't build with NIS support. This is only used for password changes on", " NIS systems, and is pulling a large dependency chain into the Essential", " package set which is not justifiable.", "" ], "package": "pam", "version": "1.4.0-13", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 25 Apr 2022 16:12:04 -0700" }, { "cves": [], "log": [ "", " * Drop Recommends on update-motd which is no longer used and is not being", " maintained.", "" ], "package": "pam", "version": "1.4.0-11ubuntu2", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 23 Mar 2022 18:43:24 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", " * Dropped changes, included in Debian:", " - d/p/pam_env-allow-environment-files-without-EOL-at-EOF.patch:", " Allow /etc/environment files without EOL at EOF.", "" ], "package": "pam", "version": "1.4.0-11ubuntu1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Feb 2022 08:51:50 -0800" }, { "cves": [], "log": [ "", " * Whitespace fixes in debconf templates.", "", " [ Sergio Durigan Junior ]", " * d/p/pam_env-allow-environment-files-without-EOL-at-EOF.patch:", " Allow /etc/environment files without EOL at EOF. In other words,", " allow files without a newline at the end. (LP: #1953201)", "" ], "package": "pam", "version": "1.4.0-11", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 1953201 ], "author": "Steve Langasek ", "date": "Mon, 06 Dec 2021 11:11:31 -0800" }, { "cves": [], "log": [ "", " [ Sergio Durigan Junior ]", " * d/p/pam_env-allow-environment-files-without-EOL-at-EOF.patch:", " Allow /etc/environment files without EOL at EOF. In other words,", " allow files without a newline at the end. (LP: #1953201)", "" ], "package": "pam", "version": "1.4.0-10ubuntu2", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1953201 ], "author": "Steve Langasek ", "date": "Mon, 06 Dec 2021 11:05:28 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable (LP: #1916509). Remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " - Disable custom daemon restart detection code if needrestart is available", " - d/libpam-modules.postinst: Add /snap/bin to $PATH in /etc/environment", " * Dropped changes, obsoleted:", " - pam_motd: Export MOTD_SHOWN=pam after showing MOTD", " - Return only PAM_IGNORE or error from pam_motd", " - Fix patches to fix FTBFS", " - Backport pam_faillock module from pam 1.4.0", " - debian/patches-applied/nullok_secure-compat.patch: Support", " nullok_secure as a deprecated alias for nullok.", " - debian/pam-configs/unix: use nullok, not nullok_secure.", " * Patches:", " - d/p/pam_motd-legal-notice: refreshed", " - Refreshed d/p/pam_umask_usergroups_from_login.defs.patch to use", " pam_modutil_search_key instead of our own hand-rolled version", " - d/p/extrausers.patch: Refreshed the patch and fixed the", " HAVE_LIBSELINUX conditional removed upstream.", " * d/local/pam-auth-update: refreshed the md5sum for debian/local/common-session", "" ], "package": "pam", "version": "1.4.0-10ubuntu1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1916509 ], "author": "Simon Chopin ", "date": "Tue, 26 Oct 2021 10:49:14 +0200" }, { "cves": [], "log": [ "", " * Fix syntax error in libpam0g.postinst when a systemd unit fails,", " Closes: #992538", " * Include upstream patch not to use crypt_checksalt; without this", " passwords set prior to bullseye were considered expired, Closes:", " #992848", " * Support DPKG_ROOT for pam-auth-update, thanks Johannes 'josch' Schauer", " Closes: #983427", "", "" ], "package": "pam", "version": "1.4.0-10", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 26 Aug 2021 13:43:23 -0600" }, { "cves": [], "log": [ "", " * Revert prefer the multiarch path from 1.4.0-8: It turns out that", " Debian uses DEFAULT_MODULE_PATH and _PAM_ISA in the opposite meaning", " of upstream. If I had read the patch header of", " patches-applied/lib_security_multiarch_compat more closely I would", " have noticed this. The effect of 1.4.0-9 is what is stated in the", " 1.4.0-8 changelog: we prefer multiarch paths, but the original patch", " did that.", " * I did test this in 1.4.0-8, but my test design was flawed. I placed a", " invalid shared object in /lib/security and confirmed it did not shadow", " an object in /lib/x86_64-linux-gnu/security. However I realized", " shortly after releasing 1.4.0-8 that a valid shared object in", " /lib/security will shadow one in the multiarch path.", "" ], "package": "pam", "version": "1.4.0-9", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 09 Jul 2021 10:55:02 -0600" }, { "cves": [], "log": [ "", " [ Hideki Yamane ]", " * debian/patches-applied/lib_security_multiarch_compat", " - Fix regression introduced in 1.4.0-1: search both /lib/security and", " /lib/[multiarch_tripple]/security/, Closes: #990790", "", " [ Sam Hartman ]", " * Reword changelog", " * Prefer the multiarch path (_PAM_ISA) to the non-multiarch path.", " That's different than buster, but guarantees everything already", " working in bullseye will continue to work and also guarantees that", " when multiarch modules are available we use them.", "" ], "package": "pam", "version": "1.4.0-8", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Hideki Yamane ", "date": "Tue, 06 Jul 2021 22:09:15 +0900" }, { "cves": [], "log": [ "", " * Updated portuguese debconf translation, thanks Pedro Ribeiro, Closes:", " #983594", " * Updated Simplified Chinese Translations, thanks Boyuan Yang", " * Updated Bulgarian Translation, Thanks Damyan Ivanov", " * Updated translation from the Slovak team, thanks Ladislav Michnovič,", " Closes: #984891", " * Updated Catalan translation, thanks Alex Muntada, Closes: #984568", " * Updated Brazilian Portuguese translation, Thanks Adriano Rafael Gomes,", " Closes: #984656", " * French Debconf translations, thanks Jean-Pierre Giraud , Closes:", " #984910", " * Updated russian Debconf translations, thanks Алексей Шилин, Closes:", " #984878", " * Updated Dutch debconf templates, Thanks Frans Spiesschaert, Closes:", " #984823", " * Updated German Debconf translations, Thanks Sven Joachim", " * Code review fixes for the fix to #982295, thanks Mark Hindley", " - Actually set service to $1 rather than happening to use a variable", " of the same name in enclosing scope", " - Remove dead code setting idl when not used", " * Code review fixes to the fix for #982530, thanks Martin Schurz", " - Include '-' in the file matching regexp so we search", " /etc/pam.d/common-* for uses of pam_tally. The profile check will", " catch this unless the user has overwridden the configuration", " - Fix capitalization of pam_Tally in debconf description", "", "" ], "package": "pam", "version": "1.4.0-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 15 Mar 2021 15:01:55 -0400" }, { "cves": [], "log": [ "", " * Clearly it's been too long since I've done debconf; run", " debconf-updatepo so the translations will show up as needing", " translating.", "" ], "package": "pam", "version": "1.4.0-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 26 Feb 2021 10:48:23 -0500" }, { "cves": [], "log": [ "", " * Remove profiles containing pam_tally or pam_tally2 since we no longer", " build them.", " * Also, fail to permit profiles to be selected that include pam_tally", " once the new pam-auth-update is installed", " * Check for any user-added references to pam_tally and halt the upgrade,", " Closes: #982530", " * Handle services with systemd units but no init scripts, Closes: #982295", " * Register md5sum for new common-password template, Closes: #982898", " * After reading pam-auth-update source, I agree with Lucas Nussbaum", " that common-session is intended only for interactive sessions.", " Otherwise pam-auth-update should not duplicate module configurations", " between common-session-noninteractive and common-session, so update", " the documentation, Closes: #982297", "" ], "package": "pam", "version": "1.4.0-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 25 Feb 2021 15:48:22 -0500" }, { "cves": [], "log": [ "", " * Document in README.source how to avoid multi-arch problems with documentation, Closes: #851650", " * Update header to common-password talking about sha512", " * The fix for #977648 incorrectly assumed how prerm scripts are called; update.", "" ], "package": "pam", "version": "1.4.0-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 03 Feb 2021 12:35:12 -0500" }, { "cves": [], "log": [ "", " [ Josh Triplett ]", " * libpam-runtime.postrm: Remove session-noninteractive files on purge,", " Closes: #978601", "", " [ Sam Hartman ]", " * patches-applied/pam_mkhomedir_stat_before_opendir: Stat the skeleton", " directory before opendir, Closes: #834589", " * libpam-modules.install: Install pam_faillock binaries, Closes: #981092", " * debian/patches-applied/pam_unix_initialize_daysleft : Initialize days before password expire, Closes: #980285", " * pam-configs/unix: Default to yescript rather than sha512. From a theoretical security standpoint, it looks like yescript has similar security properties, assuming (as we typically do in the crypto protocol community) that sha256 is still reasonable. However, in terms of practical resistant to password cracking, particularly in terms of valuing space complexity as well as time complexity, yescript is superior, Closes: #978553", " * No infinite loop on purge of libpam-runtime, Closes: #977648", " * patches-applied/pam_faillock_create_directory: create /run/faillock when needed.", "", "" ], "package": "pam", "version": "1.4.0-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 01 Feb 2021 15:27:08 -0500" }, { "cves": [], "log": [ "", " * Restart services on upgrade to 1.4.0. Closes: #978555.", "" ], "package": "pam", "version": "1.4.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 28 Dec 2020 19:20:38 -0800" }, { "cves": [], "log": [ "", " * New upstream release. Closes: #948188.", " - Stop using obsoleted selinux headers. Closes: #956355.", " - Continue building pam_cracklib, which is deprecated upstream;", " the replacement, pam_passwdqc, is packaged separately.", " - Update symbols file for new symbols.", " - Refresh lintian overrides for changes to available pam modules.", " * Drop patches to implement \"nullok_secure\" option for pam_unix.", " Closes: #674857, #936071, LP: #1860826.", " * debian/patches-applied/cve-2010-4708.patch: drop, applied upstream.", " * debian/patches-applied/nullok_secure-compat.patch: Support", " nullok_secure as a deprecated alias for nullok.", " * debian/pam-configs/unix: use nullok, not nullok_secure.", " * Drop pam_tally and pam_tally2 modules, which have been deprecated", " upstream in favor of pam_faillock. Closes: #569746, LP: #772121.", " * Add hardening+=bindnow to build options, per lintian.", "" ], "package": "pam", "version": "1.4.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 1860826, 772121 ], "author": "Steve Langasek ", "date": "Mon, 28 Dec 2020 06:05:13 +0000" }, { "cves": [], "log": [ "", " * extrausers.patch: update for compatibility with the removal of", " nullok_secure.", "" ], "package": "pam", "version": "1.3.1-5ubuntu11", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 15 Sep 2021 22:39:58 -0700" }, { "cves": [], "log": [ "", " * Fix up the nullok_secure-compat.patch to apply properly on 1.3.1.", "" ], "package": "pam", "version": "1.3.1-5ubuntu10", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 15 Sep 2021 18:28:12 -0700" }, { "cves": [], "log": [ "", " * Correctly document current VCS in debian/control.", " * Drop patches to implement \"nullok_secure\" option for pam_unix.", " Closes: #674857, #936071, LP: #1860826.", " * debian/patches-applied/nullok_secure-compat.patch: Support", " nullok_secure as a deprecated alias for nullok.", " * debian/pam-configs/unix: use nullok, not nullok_secure.", "" ], "package": "pam", "version": "1.3.1-5ubuntu9", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1860826 ], "author": "Steve Langasek ", "date": "Wed, 15 Sep 2021 18:18:19 -0700" }, { "cves": [], "log": [ "", " * Disable custom daemon restart detection code if needrestart is available", " (LP: #1935972)", "" ], "package": "pam", "version": "1.3.1-5ubuntu8", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1935972 ], "author": "Simon Chopin ", "date": "Tue, 13 Jul 2021 10:28:04 +0200" }, { "cves": [], "log": [ "", " * Backport pam_faillock module from pam 1.4.0 (LP: #1927796)", " - debian/patches-applied/add_pam_faillock.patch: add module.", " - debian/patches-applied/pam_faillock_create_directory: create dir", " before creating file in modules/pam_faillock/faillock.c.", " - debian/rules: set execute permissions on pam_faillock test.", " - debian/libpam-modules-bin.install: install faillock binary and man", " page.", "" ], "package": "pam", "version": "1.3.1-5ubuntu7", "urgency": "medium", "distributions": "impish", "launchpad_bugs_fixed": [ 1927796 ], "author": "Richard Maciel Costa ", "date": "Thu, 08 Apr 2021 07:06:27 -0400" }, { "cves": [], "log": [ "", " * Fix FTBFS with selinux/flask.h", " - debian/patches-applied/selinux_flask_ftbfs.patch: Fix FTBFS due to", " deprecated selinux/flask.h", "" ], "package": "pam", "version": "1.3.1-5ubuntu6", "urgency": "medium", "distributions": "groovy", "launchpad_bugs_fixed": [], "author": "Mike Salvatore ", "date": "Wed, 05 Aug 2020 21:10:51 -0400" }, { "cves": [], "log": [ "", " * debian/libpam-modules.postinst: Add /snap/bin to $PATH in", " /etc/environment. (LP: #1659719)", "" ], "package": "pam", "version": "1.3.1-5ubuntu5", "urgency": "medium", "distributions": "groovy", "launchpad_bugs_fixed": [ 1659719 ], "author": "Michael Hudson-Doyle ", "date": "Fri, 10 Jul 2020 08:35:49 +1200" }, { "cves": [], "log": [ "", " * Return only PAM_IGNORE or error from pam_motd (LP: #1856703)", "" ], "package": "pam", "version": "1.3.1-5ubuntu4", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [ 1856703 ], "author": "Balint Reczey ", "date": "Tue, 17 Dec 2019 17:41:40 +0100" }, { "cves": [], "log": [ "", " * Fix patches to fix FTBFS", "" ], "package": "pam", "version": "1.3.1-5ubuntu3", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [], "author": "Balint Reczey ", "date": "Thu, 05 Dec 2019 13:18:35 +0100" }, { "cves": [], "log": [ "", " * pam_motd: Export MOTD_SHOWN=pam after showing MOTD (LP: #1855092)", "" ], "package": "pam", "version": "1.3.1-5ubuntu2", "urgency": "medium", "distributions": "focal", "launchpad_bugs_fixed": [ 1855092 ], "author": "Balint Reczey ", "date": "Wed, 04 Dec 2019 12:23:57 +0100" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", "" ], "package": "pam", "version": "1.3.1-5ubuntu1", "urgency": "medium", "distributions": "disco", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 23:16:59 -0800" }, { "cves": [], "log": [ "", " * xdm restart check was inverted in the prior upload; turn it the right", " way around", " * Correctly display the notification when a manual DM restart is needed.", "" ], "package": "pam", "version": "1.3.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 14 Feb 2019 07:08:47 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - Add lintian override for pam_extrausers_chkpwd", " * Dropped changes, included in Debian:", " - Fix the name of the samba service being restarted", " - Fix debian/patches-applied/update-motd to apply the correct changes", " to the README", "" ], "package": "pam", "version": "1.3.1-4ubuntu1", "urgency": "medium", "distributions": "disco", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 15:43:33 -0800" }, { "cves": [], "log": [ "", " * Fix the name of the samba services to be restarted on upgrade.", "" ], "package": "pam", "version": "1.3.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 23:39:03 +0000" }, { "cves": [], "log": [ "", " * Fix debian/patches-applied/update-motd to apply the correct changes", " to the README (should be forwarded to Debian)", " * debian/libpam-modules.lintian-overrides: update for the current lintian", " warning given for DSOs with no dependencies.", " * debian/rules: set $DEB_HOST_MULTIARCH only if unset.", " * debian/source.lintian-overrides: update for the current quilt warnings.", " * debian/control: drop redundant priority fields.", " * Standards-Version 4.3.0.", " * Restore lintian overrides for hardening false-positives.", " * debian/libpam0g.postinst: update the xdm restart handling to cope with", " changes to what xdm writes to utmp. Closes: #922239.", "" ], "package": "pam", "version": "1.3.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 20:41:46 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " * Dropped changes, included in Debian:", " - pam-configs/mkhomedir: Added a config for pam_mkhomedir, disabled", " by default.", " * Dropped changes, obsoleted:", " - debian/patches-applied/cve-2015-3238.patch: removed manpage changes", " so they don't get regenerated during build and cause a multiarch", " installation issue.", " * Fix the name of the samba service being restarted, which was now", " differently wrong in each of Debian and Ubuntu.", " * Update extrausers.patch for changes in the upstream build system.", " * Fix debian/patches-applied/update-motd to apply the correct changes", " to the README (should be forwarded to Debian)", " * debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include changes to the README.", " * Add lintian override for pam_extrausers_chkpwd", "" ], "package": "pam", "version": "1.3.1-2ubuntu1", "urgency": "medium", "distributions": "disco", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 13 Feb 2019 06:07:03 +0000" }, { "cves": [], "log": [ "", " * Bump the version check for service restarts to 1.3.1-2.", " Closes: #922178.", " * Drop hard-coded pre-dep on libpam0g, now superseded by shlibdeps.", "" ], "package": "pam", "version": "1.3.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2019 23:52:04 +0000" }, { "cves": [], "log": [ "", " * New upstream release. Closes: #821408.", " - Don't try to close an excessive number of fds when we have a high", " ulimit. Closes: #890524.", " - Clarify pam_access docs regarding handling of daemons and X sessions.", " Closes: #762110.", " - Fix handling of rhost and tty fields in pam_succeed_if.", " Closes: #889910.", " - Fix wrong documentation of pam_umask module behavior.", " Closes: #825782.", " * Refresh patches.", " * Drop patches included or obsoleted upstream:", " - debian/patches-applied/README-rebuild", " - debian/patches-applied/pam-loginuid-in-containers", " - debian/patches-applied/cve-2013-7041.patch", " - debian/patches-applied/cve-2014-2583.patch", " - debian/patches-applied/cve-2015-3238.patch", " - debian/patches-applied/pam_namespace_fix_bashism.patch", " * Drop unused lintian overrides.", " * Fix lintian warnings; thanks to Andreas Henriksson ", " and Florian Vessaz ", " * Switch source package to 3.0 (quilt) to consume upstream .tar.xz.", " * Update debian/watch.", "", " [ Andreas Henriksson ]", " * Update debian/libpam0g.symbols", " * debian/patches-applied/fix-autoreconf.patch: Do not override user", " variables in Makefile.am", "" ], "package": "pam", "version": "1.3.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2019 07:38:11 +0000" }, { "cves": [], "log": [ "", " * Acknowledge various NMUs; thanks to the various folks who have helped", " keep this package in good condition.", " * debian/control: update VCS headers to point to git (temporarily under", " my personal salsa namespace, until I get around to restoring team", " setup).", " * Actually remove Roger Leigh from uploaders (change not included in", " previous upload). Thanks Roger for your contributions to Debian!", " * Use DEB_BUILD_PROFILES instead of the obsolete DEB_BUILD_PROFILE.", " Closes: #907492.", " * Don't include changes to autogenerated files in patches.", " * Use LC_ALL=C.UTF-8, not LC_ALL=C, when generating documentation.", " * Consistently include documentation changes in patches, for clean source", " package.", " * debian/patches-applied/README-rebuild: rebuild README files with", " current docs toolchain.", "" ], "package": "pam", "version": "1.1.8-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 09 Jan 2019 00:29:55 +0000" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Set Rules-Requires-Root to binary-targets as pam relies on", " chgrp in debian/rules.", " * Update pam-auth-update to detect write errors and properly", " fail when that happens. (Closes: #880501)", " * Remove Roger Leigh from uploaders as he has restired from", " Debian. (Closes: #869348)", " * Reduce priority of libpam0g to optional.", " * Rebuild with a recent version of dpkg-source, which ensures", " that the Build-Depends are correct in the .dsc file.", " (Closes: #890602)", " * Apply patch from Felix Lechner to make pam-auth-update ignore", " editor backup files. (Closes: #519361)", " * Apply update to Brazilian Portuguese translations of the", " debconf templates. Thanks to Adriano Rafael Gomes.", " (Closes: #799417)", "" ], "package": "pam", "version": "1.1.8-3.8", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Niels Thykier ", "date": "Sat, 11 Aug 2018 15:31:24 +0000" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * libpam-modules: Added a config for pam_mkhomedir, disabled by default.", " (Closes: #568577)", " * pam-auth-update: Add support for --enable option which is useful for", " enabling non-default configs without prompting the admin. (LP: #1192719)", "" ], "package": "pam", "version": "1.1.8-3.7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 1192719 ], "author": "Timo Aaltonen ", "date": "Fri, 02 Feb 2018 16:57:43 +0200" }, { "cves": [], "log": [ "", " * pam-auth-update: Add support for --enable option which is useful for", " enabling non-default configs without asking the admin. (LP:", " #1192719)", "" ], "package": "pam", "version": "1.1.8-3.6ubuntu2", "urgency": "medium", "distributions": "bionic", "launchpad_bugs_fixed": [ 1192719 ], "author": "Timo Aaltonen ", "date": "Thu, 05 Apr 2018 15:27:42 +0300" }, { "cves": [], "log": [ "", " * Merge with Debian unstable.", " - Fixes unescaped brace in pam_getenv regex. LP: #1538284.", " - Fixes pam_namespace defaults for compatibility with dash. LP: #1081323.", " * Remaining changes:", " - debian/control: have libpam-modules recommend update-motd package", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - pam-configs/mkhomedir: Added a config for pam_mkhomedir, disabled", " by default.", " - don't notify about xdm restarts during a release-upgrade", " - debian/patches-applied/cve-2015-3238.patch: removed manpage changes", " so they don't get regenerated during build and cause a multiarch", " installation issue.", " * Dropped changes, included in Debian:", " - Build-depend on libfl-dev.", " - debian/patches-applied/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE.", " * Fix references to /var/run in update-motd.5. LP: #1571864", " * Fix service restart handling to integrate with systemd instead of", " upstart.", "" ], "package": "pam", "version": "1.1.8-3.6ubuntu1", "urgency": "medium", "distributions": "bionic", "launchpad_bugs_fixed": [ 1538284, 1081323, 1571864 ], "author": "Steve Langasek ", "date": "Thu, 26 Oct 2017 23:23:18 -0700" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * cve-2015-3238.patch: Add the changes in the generated pam_exec.8", " and pam_unix.8 in addition to (and after) the changes to the", " source .xml files. This avoids unwanted rebuilds that can cause", " problems due to differing files on different architectures of", " the Multi-Arch: same libpam-modules. (Closes: #851545)", "" ], "package": "pam", "version": "1.1.8-3.6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Adrian Bunk ", "date": "Sat, 27 May 2017 18:44:02 +0300" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Build-Depend on libfl-dev:native as well, for cross builds.", " Re-closes: #846459", " * Fix \"Unescaped left brace in regex\" with Perl 5.22. Closes: #810873", "" ], "package": "pam", "version": "1.1.8-3.5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Adam Borowski ", "date": "Fri, 30 Dec 2016 14:37:29 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Add libfl-dev to Build-Depends, fixing FTBFS. Closes: #846459", " * Move xsl stuff to Build-Depends from -Indep to fix misbuilt manpages.", " Closes: #812566", "" ], "package": "pam", "version": "1.1.8-3.4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Adam Borowski ", "date": "Sun, 18 Dec 2016 01:03:58 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " [ Steve Langasek ]", " * Updated Swedish translation to correct a typo, thanks to Anders Jonsson", " and Martin Bagge. Closes: #743875", " * Updated Turkish translation, thanks to Mert Dirik .", " (closes: #756756)", " * d/applied-patches/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE. Thanks to Robie Basak", " for the patch. Closes: #783105.", " * Acknowledge security NMU.", " * pam-auth-update: don't mishandle trailing whitespace in profiles.", " LP: #1487103.", "", " [ Laurent Bigonville ]", " * debian/control: Fix Vcs-* and Homepage fields (Closes: #752343)", " * debian/watch: Update watch file and point it to http://www.linux-pam.org", " * debian/patches-applied/pam_namespace_fix_bashism.patch: Fix bashism in", " namespace.init script (Closes: #624842)", " * debian/control: Build-depends against debhelper (>= 9) to match the", " defined debhelper compatibility", " * Rename the cve-2011-4708.patch to cve-2010-4708.patch to match reality,", " thanks to Jakub Wilk for noticing (Closes: #761594)", " * debian/control: Bump Standards-Version to 3.9.8 (no further changes)", " * debian/libpam-doc.doc-base.applications-guide: Fix spelling", " * debian/libpam0g-dev.examples: Do not use shell brace expansion", " * debian/patches-applied/pam-loginuid-in-containers: Updated with the version", " from Ubuntu, this should fix logins in containers (Closes: #726661)", " * debian/patches-applied/update-motd: Updated with the version from Ubuntu:", " use /run/motd.dynamic instead of /var/run/motd, nothing in the archive", " uses the later (Closes: #743286)", " * debian/patches-applied/make_documentation_reproducible.patch: Make the", " build reproducible, removes differences when building with different", " locale values (Closes: #792127)", "" ], "package": "pam", "version": "1.1.8-3.3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 1487103 ], "author": "Laurent Bigonville ", "date": "Wed, 18 May 2016 02:04:29 +0200" }, { "cves": [], "log": [ "", " * No-change rebuild to pick up -fPIE compiler default in static", " libraries", "" ], "package": "pam", "version": "1.1.8-3.2ubuntu3", "urgency": "medium", "distributions": "artful", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 21 Apr 2017 20:53:23 +0000" }, { "cves": [], "log": [ "", " * debian/patches-applied/cve-2015-3238.patch: removed manpage changes", " so they don't get regenerated during build and cause a multiarch", " installation issue. (LP: #1558114)", "" ], "package": "pam", "version": "1.1.8-3.2ubuntu2", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [ 1558114 ], "author": "Marc Deslauriers ", "date": "Wed, 16 Mar 2016 13:34:02 -0400" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include patch to autogenerated manpage file", " - debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - debian/patches-applied/extrausers.patch: Ship pre-generated man page", " - debian/patches-applied/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE.", " - debian/control: have libpam-modules recommend update-motd package", "" ], "package": "pam", "version": "1.1.8-3.2ubuntu1", "urgency": "medium", "distributions": "xenial", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 16 Mar 2016 09:50:51 -0400" }, { "cves": [ { "cve": "CVE-2015-3238", "url": "https://ubuntu.com/security/CVE-2015-3238", "cve_description": "The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.", "cve_priority": "low", "cve_public_date": "2015-08-24 14:59:00 UTC" } ], "log": [ "", " * Non-maintainer upload.", " * Fix CVE-2015-3238: DoS/user enumeration due to blocking pipe in pam_unix", " module (Closes: #789986)", "" ], "package": "pam", "version": "1.1.8-3.2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Tianon Gravi ", "date": "Wed, 06 Jan 2016 15:53:31 -0800" }, { "cves": [], "log": [ "", " * d/applied-patches/pam-limits-nofile-fd-setsize-cap: cap the default", " soft nofile limit read from pid 1 to FD_SETSIZE.", "" ], "package": "pam", "version": "1.1.8-3.1ubuntu3", "urgency": "medium", "distributions": "vivid", "launchpad_bugs_fixed": [], "author": "Robie Basak ", "date": "Wed, 22 Apr 2015 08:55:24 +0000" }, { "cves": [], "log": [ "", " * debian/control:", " - have libpam-modules recommend update-motd package", " + while libpam-modules provides pam_motd, which does dynamically", " generate the motd from /etc/update-motd.d on login, hundreds of", " users have asked in the past few years how they might \"force\"", " a MOTD update; this is provided by /usr/sbin/update-motd", " in the tiny update-motd package (already in main); recommend", " this package", "" ], "package": "pam", "version": "1.1.8-3.1ubuntu2", "urgency": "medium", "distributions": "vivid", "launchpad_bugs_fixed": [], "author": "Dustin Kirkland ", "date": "Tue, 11 Nov 2014 12:49:14 -0600" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include patch to autogenerated manpage file", " - debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", " - debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " - debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " - debian/rules: Make pam_extrausers_chkpwd sguid shadow", " - debian/patches-applied/extrausers.patch: Ship pre-generated man page", "" ], "package": "pam", "version": "1.1.8-3.1ubuntu1", "urgency": "low", "distributions": "vivid", "launchpad_bugs_fixed": [], "author": "Michael Vogt ", "date": "Mon, 27 Oct 2014 09:57:52 +0100" }, { "cves": [ { "cve": "CVE-2013-7041", "url": "https://ubuntu.com/security/CVE-2013-7041", "cve_description": "The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack.", "cve_priority": "low", "cve_public_date": "2014-05-08 14:29:00 UTC" }, { "cve": "CVE-2014-2583", "url": "https://ubuntu.com/security/CVE-2014-2583", "cve_description": "Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.", "cve_priority": "low", "cve_public_date": "2014-04-10 20:29:00 UTC" } ], "log": [ "", " * Non-maintainer upload by the Security Team.", " * Fix CVE-2013-7041: case-insensitive comparison used for verifying", " passwords in the pam_userdb module (closes: #731368).", " * Fix CVE-2014-2583: multiple directory traversal issues in the", " pam_timestamp module (closes: 757555)", "" ], "package": "pam", "version": "1.1.8-3.1", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Gilbert ", "date": "Sat, 09 Aug 2014 09:50:42 +0000" }, { "cves": [], "log": [ "", " * No-change rebuild to get debug symbols on all architectures.", "" ], "package": "pam", "version": "1.1.8-3ubuntu4", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [], "author": "Brian Murray ", "date": "Tue, 21 Oct 2014 12:32:23 -0700" }, { "cves": [], "log": [ "", " * debian/patches-applied/extrausers.patch:", " - Ship pre-generated man page", "" ], "package": "pam", "version": "1.1.8-3ubuntu3", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [], "author": "Michael Terry ", "date": "Tue, 22 Jul 2014 14:13:31 -0400" }, { "cves": [], "log": [ "", " * debian/patches-applied/extrausers.patch: Add a pam_extrausers module", " that is basically just a copy of pam_unix but looks at", " /var/lib/extrausers/{group,passwd,shadow} instead of /etc/", " * debian/libpam-modules-bin.install: install the helper binaries for", " pam_extrausers to /sbin", " * debian/rules: Make pam_extrausers_chkpwd sguid shadow", "" ], "package": "pam", "version": "1.1.8-3ubuntu2", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [], "author": "Michael Terry ", "date": "Fri, 18 Jul 2014 14:52:08 -0400" }, { "cves": [], "log": [ "", " [ Stéphane Graber ]", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " include patch to autogenerated manpage file", " - debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", "", " [ Timo Aaltonen ]", " * pam-configs/mkhomedir: Added a config for pam_mkhomedir, disabled", " by default. (LP: #557013)", "" ], "package": "pam", "version": "1.1.8-3ubuntu1", "urgency": "medium", "distributions": "utopic", "launchpad_bugs_fixed": [ 557013 ], "author": "Stéphane Graber ", "date": "Fri, 02 May 2014 14:59:10 -0400" }, { "cves": [], "log": [ "", " * debian/rules: On hurd, link libpam explicitly with -lpthread since glibc", " will not dynamically switch between the libc stubs and the libpthread", " implementations on this architecture. Thanks to Samuel Thibault for the", " patch. Closes: #743891.", "" ], "package": "pam", "version": "1.1.8-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Apr 2014 17:49:38 -0700" }, { "cves": [], "log": [ "", " * Mark the libaudit-dev build-dependency linux-any, since it's not", " available on non-Linux archs. Closes: #737035.", "" ], "package": "pam", "version": "1.1.8-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 13 Feb 2014 15:02:00 -0800" }, { "cves": [], "log": [ "", " * debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Update patch with follow-up changes to loginuid.c", "" ], "package": "pam", "version": "1.1.8-1ubuntu2", "urgency": "medium", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Stéphane Graber ", "date": "Fri, 31 Jan 2014 22:11:02 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " * debian/patches-applied/pam_umask_usergroups_from_login.defs.patch: include", " patch to autogenerated manpage file", "" ], "package": "pam", "version": "1.1.8-1ubuntu1", "urgency": "medium", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 16 Jan 2014 02:40:41 +0000" }, { "cves": [], "log": [ "", " * New upstream release.", " - includes upstream changes to pam_exec. Closes: #670147.", " - adds support for newer hashing algorithms to pam_userdb.", " Closes: #671740.", " - fixes handling of 'quiet' argument to pam_listfile, to match the", " documentation. Closes: #592219.", " - fixes handling of @users@@hosts netgroup syntax in access.conf.", " Closes: #681223.", " - fixes installation of the /etc/security/namespace.d directory.", " Closes: #710998.", " - 027_pam_limits_better_init_allow_explicit_root: support for reading", " /proc/1/limits is upstream, this patch now only handles the policy", " of resetting limits by default and not applying glob limits to root.", " - debian/patches/fix-manpage-crud: drop, manpages now being generated", " upstream with a newer, fixed xsltproc.", " - debian/patches/pam_env-fix-overflow.patch, pam_env-fix-dos.patch,", " glibc-2_16-compilation-fix.patch, sys-types-include.patch: drop,", " included upstream.", " * Add build-dependency on pkg-config.", " * Ensure autogenerated files are after source files in all relevant patches,", " so that regenerating documentation doesn't cause build skew.", " * Drop the --disable-regenerate-docu argument, restoring the HTML manuals", " to the libpam-doc package. Closes: #700485.", " * No need to override dh_compress in debian/rules, it already handles .html", " files correctly.", " * debian/libpam-cracklib.prerm: use $DPKG_MAINTSCRIPT_PACKAGE_COUNT to avoid", " prematurely removing the PAM config when the package is installed for", " multiple architectures. Closes: #647428.", "" ], "package": "pam", "version": "1.1.8-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 16 Jan 2014 00:38:42 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", " * Dropped changes, merged in Debian:", " - Disable libaudit for stage1 bootstrap.", "" ], "package": "pam", "version": "1.1.3-11ubuntu1", "urgency": "medium", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 13 Jan 2014 21:41:05 -0800" }, { "cves": [], "log": [ "", " [ Wookey ]", " * Disable libaudit for stage1 bootstrap.", "", " [ Steve Langasek ]", " * debian/patches-applied/pam-loginuid-in-containers: pam_loginuid:", " Ignore failure in user namespaces.", " * Use [linux-any] in build-deps, instead of hard-coding a list of", " non-Linux archs. Closes: #634516.", "" ], "package": "pam", "version": "1.1.3-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 14 Jan 2014 03:33:31 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix's explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH.", " - Disable libaudit for stage1 bootstrap.", " - Adjust debian/patches-applied/update-motd to write to", " /run/motd.dynamic, as sysvinit/ssh/login in Debian have been changed", " to use this file and no longer links /etc/motd to /var/run/motd.", "" ], "package": "pam", "version": "1.1.3-10ubuntu1", "urgency": "low", "distributions": "trusty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 20 Oct 2013 18:21:34 -0700" }, { "cves": [], "log": [ "", " * Fix pam-auth-update handling of trailing blank lines in the fields of", " profiles. LP: #1160288.", " * Reintroduce libaudit support now that libaudit has been multiarched.", " Closes: #699159.", "" ], "package": "pam", "version": "1.1.3-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 1160288 ], "author": "Steve Langasek ", "date": "Sun, 20 Oct 2013 15:30:46 -0700" }, { "cves": [], "log": [ "", " * Revert libaudit support for now, because libaudit isn't multiarched yet", " in unstable so this regresses cross-installability. Reopens bug", " #699159.", " * Add an or'ed dependency on cdebconf, which also implements the", " xloadtemplatefile extension that prevents us from depending on just", " 'debconf-2.0'. Thanks to Régis Boudin for the info.", " Closes: #677278.", "" ], "package": "pam", "version": "1.1.3-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2013 23:06:30 +0000" }, { "cves": [], "log": [ "", " * Adjust debian/patches-applied/update-motd to write to /run/motd.dynamic,", " as sysvinit/ssh/login in Debian have been changed to use this file and", " no longer links /etc/motd to /var/run/motd.", "" ], "package": "pam", "version": "1.1.3-8ubuntu3", "urgency": "low", "distributions": "saucy", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 18 May 2013 00:07:43 -0500" }, { "cves": [], "log": [ "", " * Disable libaudit for stage1 bootstrap (LP: #1126404)", "" ], "package": "pam", "version": "1.1.3-8ubuntu2", "urgency": "low", "distributions": "raring", "launchpad_bugs_fixed": [ 1126404 ], "author": "Wookey ", "date": "Fri, 15 Feb 2013 12:45:27 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", " - Add /usr/local/games to PATH. LP: #110287.", "" ], "package": "pam", "version": "1.1.3-8ubuntu1", "urgency": "low", "distributions": "raring", "launchpad_bugs_fixed": [ 110287 ], "author": "Steve Langasek ", "date": "Mon, 11 Feb 2013 22:08:44 -0800" }, { "cves": [], "log": [ "", " * Confirm NMU for bug #611136; thanks to Michael Gilbert.", " - As a side effect, there will no longer be errors from reading the", " .pam_environment twice since we are now reading it 0 times.", " LP: #955032.", " * Adjust the pam_env documentation to match the module behavior resulting", " from the previous security upload. Closes: #693995.", " * debian/rules: never regenerate manpages at build time; this may cause", " build skew that breaks the world in a multiarch context. LP: #1095887.", " * debian/patches-applied/glibc-2_16-compilation-fix.patch: fix missing", " include causing build failure with eglibc 2.16. Thanks to Daniel", " Schepler . Closes: #693450.", " * Ditch autoconf patch in favor of a build-dependency on dh-autoreconf,", " which will let us keep up-to-date with newer autotools. In the present", " instance, this gets us aarch64 support.", " * Install pam_timestamp_check - and while we're at it, move the manpage", " to the correct binary package. Closes: #648695.", " * Update lintian overrides to suppress some noise about hardening and", " manpages.", " * Enable audit support, by popular demand. This should have no major", " impact unless you're also running auditd; but I reserve the right to", " disable this again in the event that this causes a performance hit or", " breaks upgrades (since the dependency is pulled into libpam, not just", " into pam_tty_audit). Closes: #699159, LP: #937005.", "" ], "package": "pam", "version": "1.1.3-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 955032, 1095887, 937005 ], "author": "Steve Langasek ", "date": "Tue, 12 Feb 2013 05:36:29 +0000" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Fix cve-2010-4708: user-configurable .pam_environment allows", " administrator-level changes without root access (closes: #611136).", "" ], "package": "pam", "version": "1.1.3-7.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Michael Gilbert ", "date": "Sun, 29 Apr 2012 02:23:26 -0400" }, { "cves": [], "log": [ "", " [ Nathan Williams ]", " * Add /usr/local/games to PATH. LP: #110287.", "" ], "package": "pam", "version": "1.1.3-7ubuntu3", "urgency": "low", "distributions": "quantal", "launchpad_bugs_fixed": [ 110287 ], "author": "Steve Langasek ", "date": "Tue, 03 Jul 2012 06:55:25 +0000" }, { "cves": [], "log": [ "", " * No-change rebuild with gzip 1.4-1ubuntu2 to get multiarch-clean", " compression of manpages. LP: #871083.", "" ], "package": "pam", "version": "1.1.3-7ubuntu2", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [ 871083 ], "author": "Steve Langasek ", "date": "Wed, 08 Feb 2012 17:15:39 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - Build-depend on libfl-dev in addition to flex, for cross-building", " support.", "" ], "package": "pam", "version": "1.1.3-7ubuntu1", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 28 Jan 2012 11:36:07 -0800" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Danish, thanks to Joe Dalton (closes: #648382)", " - French, thanks to Jean-Baka Domelevo Entfellner ", " (closes: #649850)", " - Dutch, thanks to Jeroen Schot ", " (closes: #650755)", " - Russian, thanks to Yuri Kozlov (closes: #650867)", " - Portuguese, thanks to Pedro Ribeiro ", " (closes: #652493)", " - German, thanks to Sven Joachim (closes: #653407)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #654043)", " - Bulgarian, thanks to Damyan Ivanov (closes: #656518)", " - Slovak, thanks to Ivan Masár (closes: #656521)", " - Japanese, thanks to Kenshi Muto (closes: #656834)", " - Polish, thanks to Michał Kułach ", " (closes: #657476)", " - Catalan, thanks to Innocent De Marchi ", " (closes: #657489)", " - Czech, thanks to Miroslav Kure ", " (closes: #657578)", " - Swedish, thanks to Martin Bagge (closes: #651349)", "" ], "package": "pam", "version": "1.1.3-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 28 Jan 2012 10:57:49 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/libpam0g.postinst: the init script for 'samba' is now named", " 'smbd' in Ubuntu, so fix the restart handling.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " * Dropped changes, included in Debian:", " - debian/patches-applied/update-motd: set a sane umask before calling", " run-parts, and restore the old mask afterwards, so /run/motd gets", " consistent permissions.", " - debian/patches-applied/update-motd: new module option for pam_motd,", " 'noupdate', which suppresses the call to run-parts /etc/update-motd.d.", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " * Build-depend on libfl-dev in addition to flex, for cross-building", " support.", "" ], "package": "pam", "version": "1.1.3-6ubuntu1", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Nov 2011 21:15:00 -0800" }, { "cves": [], "log": [ "", " * debian/patches-applied/hurd_no_setfsuid: we don't want to check all", " setre*id() calls; we know that there are situations where some of these", " may fail but we don't care. As long as the last setre*id() call in each", " set succeeds, that's the state we mean to be in.", " * debian/libpam0g.postinst: according to Kubuntu developers, kdm no longer", " keeps libpam loaded persistently at runtime, so it's not necessary to", " force a kdm restart on ABI bump. Which is good, since restarting kdm", " now seems to also log users out of running sessions, which we rather", " want to avoid. Closes: #632673, LP: #744944.", " * debian/patches-applied/update-motd: set a sane umask before calling", " run-parts, and restore the old mask afterwards, so /run/motd gets", " consistent permissions. LP: #871943.", " * debian/patches-applied/update-motd: new module option for pam_motd,", " 'noupdate', which suppresses the call to run-parts /etc/update-motd.d.", " LP: #805423.", " * debian/libpam0g.templates, debian/libpam0g.postinst: add a new question,", " libraries/restart-without-asking, that allows admins to accept the", " service restarts once for all so that they don't have to repeatedly", " say \"ok\". LP: #745004.", " * debian/libpam-runtime.templates, debian/local/pam-auth-update: add a", " new 'title' template, so pam-auth-update doesn't give a blank title", " when called outside of a maintainer script. LP: #882794.", "" ], "package": "pam", "version": "1.1.3-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 744944, 871943, 805423, 745004, 882794 ], "author": "Steve Langasek ", "date": "Sun, 06 Nov 2011 19:43:14 -0800" }, { "cves": [], "log": [ "", " * Rebuild with dpkg 1.16.1.1ubuntu2 to restore large file support.", "" ], "package": "pam", "version": "1.1.3-5ubuntu2", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 01 Nov 2011 16:59:55 -0400" }, { "cves": [ { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" } ], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - add debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " (Closes: #583958)", " * Dropped changes, included in Debian:", " - debian/patches-applied/CVE-2011-3148.patch", " - debian/patches-applied/CVE-2011-3149.patch", " - debian/patches-applied/update-motd: updated to use clean environment", " and absolute paths in modules/pam_motd/pam_motd.c.", " * debian/libpam0g.postinst: the init script for 'samba' is now named 'smbd'", " in Ubuntu, so fix the restart handling.", " * debian/patches-applied/update-motd: set a sane umask before calling", " run-parts, and restore the old mask afterwards, so /run/motd gets", " consistent permissions. LP: #871943.", " * debian/patches-applied/update-motd: new module option for pam_motd,", " 'noupdate', which suppresses the call to run-parts /etc/update-motd.d.", " LP: #805423.", "" ], "package": "pam", "version": "1.1.3-5ubuntu1", "urgency": "low", "distributions": "precise", "launchpad_bugs_fixed": [ 871943, 805423 ], "author": "Steve Langasek ", "date": "Sun, 30 Oct 2011 09:45:00 -0600" }, { "cves": [ { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" } ], "log": [ "", " [ Kees Cook ]", " * debian/patches-applied/pam_unix_dont_trust_chkpwd_caller.patch: use", " setresgid() to wipe out saved-gid just in case.", " * debian/patches-applied/008_modules_pam_limits_chroot:", " - fix off-by-one when parsing configuration file.", " - when using chroot, chdir() to root to lose links to old tree.", " * debian/patches-applied/022_pam_unix_group_time_miscfixes,", " debian/patches-applied/026_pam_unix_passwd_unknown_user,", " debian/patches-applied/054_pam_security_abstract_securetty_handling:", " improve descriptions.", " * debian/patches-applied/{007_modules_pam_unix,055_pam_unix_nullok_secure}:", " drop unneeded no-op change to reduce delta from upstream.", " * debian/patches-applied/hurd_no_setfsuid: check all set*id() calls.", " * debian/patches-applied/update-motd: correctly clear environment when", " building motd.", " * debian/patches-applied/pam_env-fix-overflow.patch: fix stack overflow", " in environment file parsing (CVE-2011-3148).", " * debian/patches-applied/pam_env-fix-dos.patch: fix DoS in environment", " file parsing (CVE-2011-3149).", "" ], "package": "pam", "version": "1.1.3-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 27 Oct 2011 21:33:57 -0700" }, { "cves": [], "log": [ "", " * Make sure shared library links are also installed to the multiarch", " directory, not just the .a files; otherwise the static libs get found", " first by the linker. Thanks to Russ Allbery for catching this.", " Closes: #642952.", "" ], "package": "pam", "version": "1.1.3-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 25 Sep 2011 22:33:55 +0000" }, { "cves": [], "log": [ "", " * Look for /etc/init.d/postgresql, not /etc/init.d/postgresql-8.{2,3},", " for service restarts; the latter are obsolete since squeeze.", " Closes: #631511.", " * Move debian/libpam0g-dev.install to debian/libpam0g-dev.install.in", " and substitute the multiarch path at build time, so our .a files go to", " the multiarch dir instead of to /usr/lib. Thanks to Riku Voipio for", " pointing out the bug.", " * debian/control: adjust the package descriptions, as the current ones", " use some awkward language that's gone unnoticed for a long time. Thanks", " to Martin Eberhard Schauer for pointing this", " out. Closes: #633863.", " * Build-depend on debhelper 8.9.4 and bump debian/compat to 9 for", " dpkg-buildflags integration, and drop manual setting of -g -O options in", " CFLAGS now that we can let dh do it for us", " * Don't set --sbindir when calling configure; upstream takes care of this", " for us", "" ], "package": "pam", "version": "1.1.3-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 24 Sep 2011 20:08:56 +0000" }, { "cves": [ { "cve": "CVE-2011-3148", "url": "https://ubuntu.com/security/CVE-2011-3148", "cve_description": "Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" }, { "cve": "CVE-2011-3149", "url": "https://ubuntu.com/security/CVE-2011-3149", "cve_description": "The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).", "cve_priority": "medium", "cve_public_date": "2012-07-22 17:55:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: possible code execution via incorrect environment file", " parsing (LP: #874469)", " - debian/patches-applied/CVE-2011-3148.patch: correctly count leading", " whitespace when parsing environment file in modules/pam_env/pam_env.c.", " - CVE-2011-3148", " * SECURITY UPDATE: denial of service via overflowed environment variable", " expansion (LP: #874565)", " - debian/patches-applied/CVE-2011-3149.patch: when overflowing, exit", " with PAM_BUF_ERR in modules/pam_env/pam_env.c.", " - CVE-2011-3149", " * SECURITY UPDATE: code execution via incorrect environment cleaning", " - debian/patches-applied/update-motd: updated to use clean environment", " and absolute paths in modules/pam_motd/pam_motd.c.", " - CVE-2011-XXXX", "" ], "package": "pam", "version": "1.1.3-2ubuntu2.1", "urgency": "low", "distributions": "oneiric-security", "launchpad_bugs_fixed": [ 874469, 874565 ], "author": "Marc Deslauriers ", "date": "Tue, 18 Oct 2011 09:33:47 -0400" }, { "cves": [], "log": [ "", " * Merge with Debian to get bug fix for unknown kernel rlimits. Remaining", " changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " - debian/local/pam-auth-update: Add the new md5sums for pam_umask addition.", " - add debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it", " from /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined", " there. This restores compatibility with the pre-PAM behaviour of login.", " (Closes: #583958)", " * Dropped changes:", " - debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " no need to bump the hard limit for number of file descriptors any more", " since we read kernel limits directly now.", "" ], "package": "pam", "version": "1.1.3-2ubuntu1", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Kees Cook ", "date": "Thu, 18 Aug 2011 16:41:18 -0500" }, { "cves": [], "log": [ "", " [ Kees Cook ]", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " - only report about unknown kernel rlimits when \"debug\" is set", " (Closes: 625226, LP: #794531).", "", " [ Steve Langasek ]", " * Build for multiarch. Closes: #463420.", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " don't reset the process niceness for root; since it's root, they can", " still renice to a lower nice level if they need to and changing the", " nice level by default is unexpected behavior. Closes: #594377.", "" ], "package": "pam", "version": "1.1.3-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 794531 ], "author": "Steve Langasek ", "date": "Tue, 21 Jun 2011 11:41:12 -0700" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * debian/patches/pam_motd-legal-notice: use pam_modutil_gain/drop_priv", " common helper functions, instead of hand-rolled uid-setting code.", "", " [ Martin Pitt ]", " * debian/local/common-session{,-noninteractive}: Enable pam_umask by", " default, now that the umask setting is gone from /etc/profile.", " (LP: #253096, UbuntuSpec:umask-to-0002)", " * debian/local/pam-auth-update: Add the new md5sum of above files.", " * Add debian/patches-applied/pam_umask_usergroups_from_login.defs.patch:", " Deprecate pam_unix' explicit \"usergroups\" option and instead read it from", " /etc/login.def's \"USERGROUP_ENAB\" option if umask is only defined there.", " This restores compatibility with the pre-PAM behaviour of login.", " (Closes: #583958)", "" ], "package": "pam", "version": "1.1.3-1ubuntu3", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [ 253096 ], "author": "Martin Pitt ", "date": "Fri, 24 Jun 2011 11:07:57 +0200" }, { "cves": [], "log": [ "", " * debian/patches-applied/update-motd-manpage-ref: refresh patch to apply", " cleanly against new upstream.", "" ], "package": "pam", "version": "1.1.3-1ubuntu2", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 04 Jun 2011 14:20:17 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " bump the hard limit for number of file descriptors, to keep pace with", " the changes in the kernel.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - New patch, lib_security_multiarch_compat, which lets us reuse the", " upstream --enable-isadir functionality to support a true path for", " module lookups; this way we don't have to force a hard transition to", " multiarch, but can support resolving modules in both the multiarch and", " non-multiarch directories.", " - build for multiarch, splitting our executables out of libpam-modules", " into a new package, libpam-modules-bin, so that modules can be", " co-installable between architectures.", " * Dropped changes:", " - bumping the service restart version in libpam0g.postinst to ensure", " servers don't fail to find the pam modules in the new paths; the min", " version requirement upstream is higher than this now.", "" ], "package": "pam", "version": "1.1.3-1ubuntu1", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 04 Jun 2011 14:04:19 -0700" }, { "cves": [ { "cve": "CVE-2010-3853", "url": "https://ubuntu.com/security/CVE-2010-3853", "cve_description": "pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3316", "url": "https://ubuntu.com/security/CVE-2010-3316", "cve_description": "The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pam_xauth PAM check.", "cve_priority": "low", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3430", "url": "https://ubuntu.com/security/CVE-2010-3430", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3431", "url": "https://ubuntu.com/security/CVE-2010-3431", "cve_description": "The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" }, { "cve": "CVE-2010-3435", "url": "https://ubuntu.com/security/CVE-2010-3435", "cve_description": "The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.", "cve_priority": "medium", "cve_public_date": "2011-01-24 18:00:00 UTC" } ], "log": [ "", " * New upstream release.", " - Fixes CVE-2010-3853, executing namespace.init with an insecure", " environment set by the caller. Closes: #608273.", " - Fixes CVE-2010-3316 CVE-2010-3430 CVE-2010-3431 CVE-2010-3435.", " Closes: #599832.", " * Port hurd_no_setfsuid patch to new pam_modutil_{drop,restore}_priv", " interface; now possibly upstreamable", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " set a better default RLIMIT_MEMLOCK value for BSD kernels. Thanks to", " Petr Salinger for the fix. Closes: #602902.", " * bump the minimum version check in maintainer scripts for the restart", " handling.", "" ], "package": "pam", "version": "1.1.3-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 04 Jun 2011 03:10:50 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " bump the hard limit for number of file descriptors, to keep pace with", " the changes in the kernel.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " - debian/libpam0g.postinst: drop kdm from the list of services to", " restart.", " - debian/libpam0g.postinst: check if gdm is actually running before", " trying to reload it.", " - New patch, lib_security_multiarch_compat, which lets us reuse the", " upstream --enable-isadir functionality to support a true path for", " module lookups; this way we don't have to force a hard transition to", " multiarch, but can support resolving modules in both the multiarch and", " non-multiarch directories.", " - build for multiarch, splitting our executables out of libpam-modules", " into a new package, libpam-modules-bin, so that modules can be", " co-installable between architectures.", " - bumping the service restart version in libpam0g.postinst to ensure", " servers don't fail to find the pam modules in the new paths.", " * bump debhelper build-dep for final multiarch support.", "" ], "package": "pam", "version": "1.1.2-3ubuntu1", "urgency": "low", "distributions": "oneiric", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 20 May 2011 12:53:24 -0700" }, { "cves": [], "log": [ "", " [ Kees Cook ]", " * 027_pam_limits_better_init_allow_explicit_root: load rlimit defaults", " from the kernel (via /proc/1/limits), instead of continuing to hardcode", " the settings internally. Fall back to internal defaults when the kernel", " rlimits are not found. Closes: #620302. (LP: #746655, #391761)", "", " * Updated debconf translations:", " - Vietnamese, thanks to Clytie Siddall ", " (closes: #601197)", " - Dutch, thanks to Eric Spreen (closes: #605592)", " - Danish, thanks to Joe Dalton (closes: #606739)", " - Catalan, thanks to Innocent De Marchi ", " (closes: #622786)", "" ], "package": "pam", "version": "1.1.2-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 746655, 391761 ], "author": "Steve Langasek ", "date": "Sun, 01 May 2011 01:49:11 -0700" }, { "cves": [], "log": [ "", " * Check if gdm is actually running before trying to reload it. (LP: #745532)", "" ], "package": "pam", "version": "1.1.2-2ubuntu8", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 745532 ], "author": "Stéphane Graber ", "date": "Mon, 11 Apr 2011 21:57:36 -0400" }, { "cves": [], "log": [ "", " * debian/patches-applied/027_pam_limits_better_init_allow_explicit_root:", " bump the hard limit for number of file descriptors, to keep pace with", " the changes in the kernel. Fortunately this shadowing should all go", " away next cycle when we can start to grab defaults directly from /proc.", " LP: #663090", "" ], "package": "pam", "version": "1.1.2-2ubuntu7", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 663090 ], "author": "Steve Langasek ", "date": "Tue, 05 Apr 2011 13:02:02 -0700" }, { "cves": [], "log": [ "", " * debian/libpam0g.postinst: according to Kubuntu developers, kdm no longer", " keeps libpam loaded persistently at runtime, so it's not necessary to", " force a kdm restart on ABI bump. Which is good, since restarting kdm", " now seems to also log users out of running sessions, which we rather", " want to avoid. LP: #744944.", "" ], "package": "pam", "version": "1.1.2-2ubuntu6", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 744944 ], "author": "Steve Langasek ", "date": "Tue, 29 Mar 2011 13:16:26 -0700" }, { "cves": [], "log": [ "", " * Force a service restart on upgrade to the new libpam0g, to ensure", " servers don't fail to find the pam modules in the new paths.", " * libpam-modules should also Pre-Depend: on the multiarch-aware libpam0g,", " for the same reason.", "" ], "package": "pam", "version": "1.1.2-2ubuntu5", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 22 Mar 2011 02:19:51 -0700" }, { "cves": [], "log": [ "", " * Build for multiarch; FFe LP: #733501.", " * Split our executables out of libpam-modules into a new package,", " libpam-modules-bin, so that modules can be co-installable between", " architectures.", " * New patch, lib_security_multiarch_compat, which lets us reuse the", " upstream --enable-isadir functionality to support a true path for module", " lookups; this way we don't have to force a hard transition to multiarch,", " but can support resolving modules in both the multiarch and", " non-multiarch directories.", " * Build-Depend on the multiarchified debhelper.", " * Add Pre-Depends: ${misc:Pre-Depends} for multiarch-support.", "" ], "package": "pam", "version": "1.1.2-2ubuntu4", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [ 733501 ], "author": "Steve Langasek ", "date": "Fri, 18 Mar 2011 00:12:26 -0700" }, { "cves": [], "log": [ "", " * Er, but let's get this patch applying cleanly.", "" ], "package": "pam", "version": "1.1.2-2ubuntu3", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 21 Feb 2011 16:10:11 -0800" }, { "cves": [], "log": [ "", " * debian/patches/update-motd-manpage-ref: patch the manpage too, not just", " the xml source.", "" ], "package": "pam", "version": "1.1.2-2ubuntu2", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 21 Feb 2011 15:47:27 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", "" ], "package": "pam", "version": "1.1.2-2ubuntu1", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 17 Feb 2011 16:15:47 -0800" }, { "cves": [], "log": [ "", " * debian/patches-applied/hurd_no_setfsuid: handle some new calls to", " setfsuid in pam_xauth that I overlooked, so that the build works again", " on non-Linux. Closes: #613630.", "" ], "package": "pam", "version": "1.1.2-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 16 Feb 2011 09:27:11 -0800" }, { "cves": [], "log": [ "", " * New upstream release.", " - Add support for NSS groups to pam_group. Closes: #589019,", " LP: #297408.", " - Support cross-building the package. Thanks to Neil Williams", " for the patch. Closes: #284854.", " * debian/rules: pass getconf LFS_CFLAGS so that we get a 64-bit rlimit", " interface. Closes: #579402.", " * Drop patches conditional_module,_conditional_man and", " mkhomedir_linking.patch, which are included upstream.", " * debian/patches/hurd_no_setfsuid: pam_env and pam_mail now also use", " setfsuid, so patch them to be likewise Hurd-safe.", " * Update debian/source.lintian-overrides to clean up some spurious", " warnings.", " * debian/libpam-modules.postinst: if any 'min=n' options are found in", " /etc/pam.d/common-password, convert them on upgrade to 'minlen=n' for", " compatibility with upstream.", " * debian/NEWS: document the disappearance of 'min=n', in case users have", " encoded this option elsewhere outside of /etc/pam.d/common-password.", " * debian/patches/007_modules_pam_unix: drop compatibility handling of", " 'max=' no-op; use of this option will now log an error, as warned three", " years ago.", " * Bump Standards-Version to 3.9.1.", " * Add lintian overrides for a few more spurious warnings.", " * debian/patches-applied/no_PATH_MAX_on_hurd: define PATH_MAX for", " compatibility when it's not already set. Closes: #552043.", " * debian/local/pam-auth-update: Don't try to pass embedded newlines to", " debconf; backslash-escape them instead and use CAPB escape.", " * debian/local/pam-auth-update: sort additional module options before", " writing them out, so that we don't wind up with a different config file", " on every invocation. Thanks to Jim Paris for the patch.", " Closes: #594123.", " * debian/libpam-runtime.{postinst,templates}: since 1.1.2-1 is targeted", " for post-squeeze, we don't need to support upgrades from 1.0.1-6 to", " 1.0.1-10 anymore. Drop the debconf error note about having configured", " your system with a lack of authentication, so that translators don't", " spend any more time on it.", " * Updated debconf translations:", " - Swedish, thanks to Martin Bagge (closes: #575875)", "" ], "package": "pam", "version": "1.1.2-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 297408 ], "author": "Steve Langasek ", "date": "Tue, 15 Feb 2011 23:21:41 -0800" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Italian, thanks to Nicole B. (closes: #602112)", "" ], "package": "pam", "version": "1.1.1-7", "urgency": "low", "distributions": "UNRELEASED", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 17 Nov 2010 16:53:46 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", " * Dropped changes:", " - libpam-modules depend on base-files (>= 5.0.0ubuntu6): 5.0.0ubuntu20", " is in 10.04 LTS and this is an essential package, so no more need for", " the versioned dependency.", "" ], "package": "pam", "version": "1.1.1-6.1ubuntu1", "urgency": "low", "distributions": "natty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 15 Feb 2011 23:36:47 -0800" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Fix pending l10n issues. Debconf translations:", " - Czech (Miroslav Kure). Closes: #598329", " - Slovak (Ivan Masár). Closes: #600164", " - Japanese (Kenshi Muto). Closes: #600247", " - Finnish (Esko Arajärvi). Closes: #600641", "" ], "package": "pam", "version": "1.1.1-6.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Christian Perrier ", "date": "Tue, 19 Oct 2010 07:30:49 +0200" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Swedish, thanks to Martin Bagge (closes: #575875)", "" ], "package": "pam", "version": "1.1.1-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 05 Sep 2010 23:36:35 -0700" }, { "cves": [], "log": [ "", " * debian/rules: pass getconf LFS_CFLAGS so that we get a 64-bit rlimit", " interface. Closes: #579402.", " * Update debian/source.lintian-overrides to clean up some spurious", " warnings.", " * Bump Standards-Version to 3.9.1.", " * Add lintian overrides for a few more spurious warnings.", " * debian/patches-applied/no_PATH_MAX_on_hurd: define PATH_MAX for", " compatibility when it's not already set. Closes: #552043.", " * debian/local/pam-auth-update: Don't try to pass embedded newlines to", " debconf; backslash-escape them instead and use CAPB escape.", " * debian/local/pam-auth-update: sort additional module options before", " writing them out, so that we don't wind up with a different config file", " on every invocation. Thanks to Jim Paris for the patch.", " Closes: #594123.", "" ], "package": "pam", "version": "1.1.1-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 05 Sep 2010 12:42:34 -0700" }, { "cves": [ { "cve": "CVE-2010-0832", "url": "https://ubuntu.com/security/CVE-2010-0832", "cve_description": "pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to \"user file stamps\" and the motd.legal-notice file.", "cve_priority": "high", "cve_public_date": "2010-07-12 16:30:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: root privilege escalation via symlink following.", " - debian/patches-applied/pam_motd-legal-notice: drop privs for work.", " - CVE-2010-0832", "" ], "package": "pam", "version": "1.1.1-4ubuntu2", "urgency": "low", "distributions": "maverick-security", "launchpad_bugs_fixed": [], "author": "Kees Cook ", "date": "Mon, 25 Oct 2010 06:40:32 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's", " not present there or in /etc/security/pam_env.conf. (should send to", " Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent", " showing it again.", " - debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation.", " - debian/patches/update-motd-manpage-ref: add a reference in pam_motd(8)", " to update-motd(5)", "" ], "package": "pam", "version": "1.1.1-4ubuntu1", "urgency": "low", "distributions": "maverick", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 16 Aug 2010 19:12:35 -0700" }, { "cves": [], "log": [ "", " * debian/patches/conditional_module,_conditional_man: if we don't have the", " libraries required for building pam_tty_audit, we shouldn't install the", " manpage either. LP: #588547.", " * Updated debconf translations:", " - Portuguese, thanks to Eder L. Marques ", " (closes: #581746)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #592172)", " - Galician, thanks to Jorge Barreiro ", " (closes: #592808)", " * Don't pass --version-script options when linking executables,", " only when linking libraries. Thanks to Julien Cristau", " for the fix. Closes: #582362.", "" ], "package": "pam", "version": "1.1.1-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 588547 ], "author": "Steve Langasek ", "date": "Sun, 15 Aug 2010 21:53:46 -0700" }, { "cves": [], "log": [ "", " * Trigger a rebuild, applying changes from 1.1.1-2ubuntu2 which", " were previously not committed to bzr", "" ], "package": "pam", "version": "1.1.1-3ubuntu2", "urgency": "low", "distributions": "maverick", "launchpad_bugs_fixed": [], "author": "Dustin Kirkland ", "date": "Thu, 13 May 2010 10:04:23 +0200" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " * Dropped changes:", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade - upgrades to maverick are", " only supported from lucid, so this delta can be dropped.", " - debian/patches-applied/ubuntu-no-error-if-missingok: 'missingok' option", " is obsoleted by 10.04 LTS and no longer needs to be supported for", " upgrades.", "" ], "package": "pam", "version": "1.1.1-3ubuntu1", "urgency": "low", "distributions": "maverick", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 13 May 2010 00:39:44 +0200" }, { "cves": [], "log": [ "", " * pam-auth-update: fix a bug in our handling of module options when the", " module name contains digits, caused by a buggy regexp. :/ Partially", " addresses LP #369575.", " * Install /sbin/pam_tally2 in the libpam-modules package; thanks to", " Olivier BONHOMME for reporting. Closes: #554010.", "" ], "package": "pam", "version": "1.1.1-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 25 Apr 2010 05:53:44 -0700" }, { "cves": [], "log": [ "", " * debian/update-motd.5, debian/libpam-modules.manpages: add a manpage", " for update-motd, with some best practices and notes of explanation,", " LP: #562566", " * debian/patches/update-motd-manpage-ref: add a reference in pam_mod(8)", " to update-motd(5), LP: #552175", "" ], "package": "pam", "version": "1.1.1-2ubuntu2", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [ 562566, 552175 ], "author": "Dustin Kirkland ", "date": "Tue, 13 Apr 2010 16:58:12 -0500" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.1.1-2ubuntu1", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 18 Feb 2010 12:04:18 +0000" }, { "cves": [], "log": [ "", " * Document the new symbols added in 1.1.1 in debian/libpam0g.symbols, and", " raise the minimum version for the service restarting code.", " Closes: #568480.", "" ], "package": "pam", "version": "1.1.1-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 17 Feb 2010 23:21:23 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.1.1-1ubuntu1", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 01 Feb 2010 09:55:02 -0800" }, { "cves": [], "log": [ "", " * New upstream version.", " - restore proper netgroup handling in pam_access.", " Closes: #567385, LP: #513955.", " * Drop patches pam.d-manpage-section, namespace_with_awk_not_gawk, and", " pam_securetty_tty_check_before_user_check, which are included upstream.", " * debian/patches/026_pam_unix_passwd_unknown_user: don't return", " PAM_USER_UNKNOWN on password change of a user that has no shadow entry,", " upstream now implements auto-creating the shadow entry in this case.", " * Updated debconf translations:", " - French, thanks to Jean-Baka Domelevo Entfellner ", " (closes: #547039)", " - Bulgarian, thanks to Damyan Ivanov (closes: #562835)", " * debian/patches/sys-types-include.patch: fix pam_modutil.h so that it can", " be included directly, without having to include sys/types.h first.", " Closes: #556203.", " * Add postgresql-8.3 to the list of services in need of restart on upgrade.", " Closes: #563674.", " * And drop postgresql-{7.4,8.1} from the list, neither of which is present", " in stable.", " * debian/patches/007_modules_pam_unix: recognize that *all* of the password", " hashes other than traditional crypt handle passwords >8 chars in length.", " LP: #356766.", "" ], "package": "pam", "version": "1.1.1-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 513955, 356766 ], "author": "Steve Langasek ", "date": "Mon, 01 Feb 2010 02:04:33 -0800" }, { "cves": [], "log": [ "", " * Brown paper bag: remove the right patch from the series file.", "" ], "package": "pam", "version": "1.1.0-4ubuntu3", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 10 Dec 2009 23:09:03 -0800" }, { "cves": [], "log": [ "", " * \"Rebase\" Ubuntu patches to apply them last in the series.", " * Drop patch ubuntu-regression_fix_securetty, superseded by the more", " precise fix in pam_securetty_tty_check_before_user_check.", "" ], "package": "pam", "version": "1.1.0-4ubuntu2", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 10 Dec 2009 22:52:20 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.1.0-4ubuntu1", "urgency": "low", "distributions": "lucid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 05 Nov 2009 21:33:15 -0800" }, { "cves": [], "log": [ "", " * debian/patches/pam_securetty_tty_check_before_user_check: new patch,", " to make pam_securetty always return success on a secure tty regardless", " of what username was passed. Thanks to Nicolas François", " for the patch. Closes: #537848", " * debian/local/pam-auth-update: only reset the seen flag on the template", " when there's new information; this avoids reprompting users for the same", " information on upgrade, regardless of the debconf priority used.", " Closes: #544805.", " * libpam0g no longer depends on libpam-runtime; packages that use", " /etc/pam.d/common-* must depend directly on libpam-runtime, and most do", " (including the Essential: yes ones), so let's break this circular", " dependency. Closes: #545086, LP: #424566.", "" ], "package": "pam", "version": "1.1.0-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 424566 ], "author": "Steve Langasek ", "date": "Mon, 14 Sep 2009 18:47:25 -0700" }, { "cves": [], "log": [ "", " * Bump debian/compat to 7, so we can use sane contents in debian/*.install", " * Switch all packages over to dh_install", " * Rename debian/*.lintian to debian/*.lintian-overrides and use dh_lintian", " * Move installation logic out of debian/rules into individual .install", " files", " * Drop superfluous options to dh_installchangelogs, dh_shlibdeps", " * Use debian/clean instead of rm -f'ing files in debian/rules clean target", " * Drop ./configure options that are no-ops", " * Drop the /lib/security/pam_unix_*.so symlinks, which have been deprecated", " now for 10 years and are not used at all if pam-auth-update is in play.", " * Drop the pam_rhosts_auth.so symlink as well, and document in NEWS.Debian", " that this is now obsolete.", " * Drop stale content from README.debian: some of this should have been in", " NEWS.Debian instead (but is so old it's not worth putting it there now),", " some of it is obsolete by the change in package VCS.", " * Convert debian/rules to debhelper 7 and add versioned build-dependencies", " on debhelper and quilt to suit.", " * Drop CFLAGS that we don't need anymore (-fPIC, -D_REENTRANT,", " -D_GNU_SOURCE).", " * Explicitly add -O0 to CFLAGS when noopt is set.", " * debian/patches/autoconf.patch: pull ltmain.sh in, to fix some spurious", " library linkage in the modules.", " * Move pam_cracklib manpage to the libpam-cracklib package, and add the", " requisite Replaces", " * Drop dh_makeshlibs -V; everything from lenny on should use the .symbols", " file instead, making the shlibs redundant so we don't need to care what", " version gets listed there.", "" ], "package": "pam", "version": "1.1.0-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 07 Sep 2009 18:47:45 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", " * Changes merged in Debian:", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.1.0-2ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 04 Sep 2009 01:11:48 -0700" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * debian/patches/pam_unix_dont_trust_chkpwd_caller.patch: fix this patch", " to call setregid() instead of always returning an error on username", " mismatch in unix_chkpwd, needed in the SELinux case and in some corner", " cases with the broken_shadow option. Thanks to Michael Spang for the", " analysis. Closes: #543589.", " * fix the PAM mini-policy to not tell app maintainers that they don't need", " to depend on libpam-modules if they reference modules from there.", " * make libpam-runtime depend on libpam-modules (>= 1.0.1-6) - nothing else", " guarantees that we have pam_unix available for use by pam-auth-update.", " * Use /bin/sh instead of /bin/bash for libpam0g.postinst, since we've", " confirmed there are no longer any bashisms there. Closes: #519973.", " * Clean up the libpam0g postinst a bit; invoke-rc.d has been a guaranteed", " interface for two stable release cycles now", " * debian/patches/namespace_with_awk_not_gawk: fix the sample", " namespace.init script's dependency on non-POSIX features of gawk, since", " we don't use gawk by default. Closes: #518908.", " * Updated debconf translations:", " - German, thanks to Sven Joachim (closes: #544464)", "", " [ Kees Cook ]", " * debian/local/common-password, debian/pam-configs/unix: switch from \"md5\"", " to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.1.0-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 31 Aug 2009 14:21:27 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " - debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", " * Dropped changes, superseded upstream:", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf.", "" ], "package": "pam", "version": "1.1.0-1ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 26 Aug 2009 00:40:14 -0700" }, { "cves": [], "log": [ "", " * New upstream version.", " - pam_access no longer does DNS lookups when we know we're comparing", " with a tty name or a service name. Closes: #376209.", " - fixes for manpage spelling. Closes: #488690.", " - fix evaluation of or'ed list of users in time.conf and group.conf.", " Closes: #326407, #514423.", " * Drop patches pam_unix_thread-safe_save_old_password.patch,", " pam_env_ignore_garbage.patch, dont_freeze_password_chain,", " pam_1.0.4_mindays, pam_mail-fix-quiet, pam_unix-chkpwd-wait, and", " cve-2009-0887-libpam-pam_misc.patch, which are included upstream.", " * Trim pam.d-manpage-section patch, which was mostly but not completely", " applied upstream.", " * Update debian/libpam0g.symbols for new extension.", " * Bump the shlibs version as well, for our dpkg-shlibdeps fallback.", " * And bump the version checks in the libpam-modules {pre,post}inst, so that", " the necessary services get restarted for any modules that need the new", " symbols.", " * Add /sbin/mkhomedir_helper to libpam-modules.", " * Document that pam_cracklib no longer checks /etc/security/opasswd.", " Closes: #263767.", " * debian/patches/007_modules_pam_unix: drop divergence from upstream", " that treats \"0\" as a special value in various fields in /etc/shadow,", " and document this in debian/NEWS. Thanks to Nicolas François", " for the detailed analysis.", " Closes: #308229.", " * Updated debconf translations:", " - French, thanks to Jean-Baka Domelevo Entfellner ", " (closes: #521266)", " * Build with LDFLAGS=-Wl,-z,defs to guard against the possibility of", " any undefined symbols (due to typos or otherwise) at build time.", " Closes: #102311.", " * On upgrade from versions before 1.1.0-1, if", " /etc/pam.d/common-session-noninteractive has not been created (because", " the user declined use of pam-auth-update), create it by copying", " /etc/pam.d/common-session. Closes: #543401.", " * debian/patches/fix-man-crud: new patch, fix \"undefined macro\" errors in", " manpages caused by oddities of toolchain used when generating them", " upstream.", "" ], "package": "pam", "version": "1.1.0-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 25 Aug 2009 20:35:26 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", " * debian/local/pam-auth-update: prune some more md5sums from intrepid", " pre-release versions, reducing the Ubuntu delta some", " * debian/local/common-{auth,account,password}.md5sums: include the", " Ubuntu-specific intrepid,jaunty md5sums for use during the", " common-session-noninteractive upgrade.", "" ], "package": "pam", "version": "1.0.1-11ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 23 Aug 2009 20:14:58 -0700" }, { "cves": [], "log": [ "", " * debian/libpam-runtime.postinst: bump the --force version check to", " 1.0.1-11, to allow for a new common-session-noninteractive config file;", " and include md5sum checking logic that will work the same with old", " unmanaged and new managed /etc/pam.d/common-* files.", " * debian/local/common-{auth,account,session,password}.md5sums: document", " the known md5sums for the new managed files.", " * debian/local/common-session-noninteractive{,.md5sums},", " debian/local/pam-auth-update: split out a session-noninteractive include", " file, so that we can at last distinguish between interactive and", " non-interactive PAM sessions at a policy level. Closes: #169930,", " LP: #287715.", " * debian/local/pam-auth-update: prune md5sums for unsupported upgrade", " paths (intrepid pre-release -> karmic/squeeze)", " * Clean up the PAM mini-policy, which hasn't been touched in a number of", " years and was looking a bit crufty", " * debian/libpam-runtime.templates: correctly tag the URL as a", " non-translatable string.", " * Updated debconf translations:", " - Swedish, thanks to Martin Bagge (closes: #541399)", " - Portuguese, thanks to Américo Monteiro ", " (closes: #541108)", " - Russian, thanks to Yuri Kozlov (closes: #541094)", "" ], "package": "pam", "version": "1.0.1-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 287715 ], "author": "Steve Langasek ", "date": "Sun, 23 Aug 2009 18:07:11 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian, remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " - Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", " - debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", "" ], "package": "pam", "version": "1.0.1-10ubuntu1", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 07 Aug 2009 09:50:02 +0100" }, { "cves": [ { "cve": "CVE-2009-0887", "url": "https://ubuntu.com/security/CVE-2009-0887", "cve_description": "Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.", "cve_priority": "low", "cve_public_date": "2009-03-12 15:20:00 UTC" } ], "log": [ "", " [ Steve Langasek ]", " * Updated debconf translations:", " - Finnish, thanks to Esko Arajärvi (closes: #520785)", " - Russian, thanks to Yuri Kozlov (closes: #521874)", " - German, thanks to Sven Joachim (closes: #521530)", " - Basque, thanks to Piarres Beobide ", " (closes: #524285)", " * When no profiles are chosen in pam-auth-update, throw an error message", " and prompt again instead of letting the user end up with an insecure", " system. This introduces a new debconf template. Closes: #519927,", " LP: #410171.", "", " [ Kees Cook ]", " * Add debian/patches/pam_1.0.4_mindays: backport upstream 1.0.4 fixes", " for MINDAYS-Field regression (closes: #514437).", " * debian/control: add missing misc:Depends for packages that need it.", "", " [ Sam Hartman ]", " * Remove conflicts information for transitions prior to woody release", " * Fix lintian overrides for libpam-runtime", " * Overrides for lintian finding quilt patches", " * pam_mail-fix-quiet: patch from Andreas Henriksson", " applied upstream to fix quiet option of pam_mail, Closes: #439268", "", " [ Dustin Kirkland ]", " * debian/patches/update-motd: run the update-motd scripts in pam_motd;", " render update-motd obsolete, LP: #399071", "", " [ Sam Hartman ]", " * cve-2009-0887-libpam-pam_misc.patch: avoid integer signedness problem", " (CVE-2009-0887) (Closes: #520115)", "" ], "package": "pam", "version": "1.0.1-10", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [ 410171, 399071 ], "author": "Steve Langasek ", "date": "Thu, 06 Aug 2009 17:54:32 +0100" }, { "cves": [], "log": [ "", " * Make libpam-modules depend on base-files (>= 5.0.0ubuntu6), to ensure", " run-parts does the right thing in /etc/update-motd.d.", "" ], "package": "pam", "version": "1.0.1-9ubuntu3", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 15 Jul 2009 23:55:50 -0700" }, { "cves": [], "log": [ "", " [ Dustin Kirkland ]", " * debian/patches/update-motd: run the update-motd scripts in pam_motd;", " render update-motd obsolete, LP: #399071", " * debian/patches-applied/pam_motd-legal-notice: display the contents of", " /etc/legal once, then set a flag in the user's homedir to prevent showing", " it again.", "" ], "package": "pam", "version": "1.0.1-9ubuntu2", "urgency": "low", "distributions": "karmic", "launchpad_bugs_fixed": [ 399071 ], "author": "Steve Langasek ", "date": "Wed, 15 Jul 2009 20:41:52 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.0.1-9ubuntu1", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 20 Mar 2009 19:12:10 -0700" }, { "cves": [], "log": [ "", " * Move the pam module packages to section 'admin'.", " * 027_pam_limits_better_init_allow_explicit_root: defaults need to be", " declared as LIMITS_DEF_DEFAULT instead of LIMITS_DEF_ALL, otherwise", " global limits will fail to be applied. LP: #314222.", "" ], "package": "pam", "version": "1.0.1-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 314222 ], "author": "Steve Langasek ", "date": "Fri, 20 Mar 2009 19:48:47 -0700" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Bulgarian, thanks to Damyan Ivanov (closes: #518121)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #518214)", " - Swedish, thanks to Martin Bagge (closes: #518324)", " - Vietnamese, thanks to Clytie Siddall ", " (closes: #518329)", " - Japanese, thanks to Kenshi Muto (closes: #518335)", " - Slovak, thanks to Ivan Masár (closes: #518341)", " - Czech, thanks to Miroslav Kure (closes: #518992)", " - Portuguese, thanks to Américo Monteiro ", " (closes: #519204)", " - Galician, thanks to Marce Villarino ", " (closes: #519447)", " - Romanian, thanks to Eddy Petrișor ", " (closes: #520552)", " * 027_pam_limits_better_init_allow_explicit_root: set the RLIMIT_MEMLOCK", " limit correctly to match the kernel default, which is not RLIM_INFINITY.", " Closes: #472629.", "" ], "package": "pam", "version": "1.0.1-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 20 Mar 2009 18:15:07 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " * Dropped changes, merged in Debian:", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " - New patch dont_freeze_password_chain, cherry-picked from upstream:", " don't always follow the same path through the password stack on", " the PAM_UPDATE_AUTHTOK pass as was used in the PAM_PRELIM_CHECK", " pass; this Linux-PAM deviation from the original PAM spec causes a", " number of problems, in particular causing wrong return values when", " using the refactored pam-auth-update stack. LP: #303515, #305882.", " - debian/patches/027_pam_limits_better_init_allow_explicit_root:", " Add documentation to the patch showing how to set limits for root.", " * Bump the libpam-cracklib dependency on libpam-runtime to 1.0.1-6,", " reducing the delta with Debian.", " * Drop upgrade handling code from libpam-runtime.postinst that's only", " needed when upgrading from 1.0.1-2ubuntu1, a superseded intrepid", " pre-release version of the package.", " * pam-auth-update: swap out known md5sums from intrepid pre-release versions", " with the md5sums from the released intrepid version", " * pam-auth-update: drop some md5sums that will only be seen on upgrade from", " pre-intrepid versions; skipping over the 8.10 final release is not", " supported, and upgrading via 8.10 means those config files will be", " replaced so the old md5sums will never be seen again.", "" ], "package": "pam", "version": "1.0.1-7ubuntu1", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [ 303515, 305882 ], "author": "Steve Langasek ", "date": "Tue, 03 Mar 2009 17:34:19 -0800" }, { "cves": [], "log": [ "", " * 027_pam_limits_better_init_allow_explicit_root:", " - fix the patch so that our limit resets are actually *applied*,", " which has apparently been broken for who knows how long!", " - shadow the finite kernel defaults for RLIMIT_SIGPENDING and", " RLIMIT_MSGQUEUE as well, so that the preceding change doesn't", " suddenly expose systems to DoS or other issues.", " - include documentation in the patch, giving examples of how to set", " limits for root. Thanks to Jonathan Marsden.", " * pam-auth-update: swap out known md5sums from intrepid pre-release", " versions with the md5sums from the released intrepid version", " * pam-auth-update: set the umask, so we don't accidentally mark", " /etc/pam.d/common-* unreadable. Thanks to Martin Krafft for catching.", " Closes: #518042.", "" ], "package": "pam", "version": "1.0.1-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 03 Mar 2009 17:18:42 -0800" }, { "cves": [], "log": [ "", " * Updated debconf translations:", " - Vietnamese, thanks to Clytie Siddall ", " * New patch dont_freeze_password_chain, cherry-picked from upstream:", " don't always follow the same path through the password stack on", " the PAM_UPDATE_AUTHTOK pass as was used in the PAM_PRELIM_CHECK", " pass; this Linux-PAM deviation from the original PAM spec causes a", " number of problems, in particular causing wrong return values when", " using the refactored pam-auth-update stack. LP: #303515, #305882.", " * debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", "" ], "package": "pam", "version": "1.0.1-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 303515, 305882 ], "author": "Steve Langasek ", "date": "Sat, 28 Feb 2009 13:36:57 -0800" }, { "cves": [], "log": [ "", " * New patch dont_freeze_password_chain, cherry-picked from upstream:", " don't always follow the same path through the password stack on", " the PAM_UPDATE_AUTHTOK pass as was used in the PAM_PRELIM_CHECK", " pass; this Linux-PAM deviation from the original PAM spec causes a", " number of problems, in particular causing wrong return values when", " using the refactored pam-auth-update stack. LP: #303515, #305882.", "" ], "package": "pam", "version": "1.0.1-5ubuntu2", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [ 303515, 305882 ], "author": "Steve Langasek ", "date": "Fri, 27 Feb 2009 16:20:24 -0800" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " * Bump the version numbers referenced in the config files, again, as pam", " has revved in Debian and moved the bar.", " * pam-auth-update: If /var/lib/pam/seen is absent, treat this the same", " as a present but empty file; thanks to Greg Price for the patch.", " LP: #294513.", " * pam-auth-update: Ignore removed profiles when detecting an empty set", " of currently-enabled modules. Thanks to Greg Price for this as well.", " * debian/control: libpam-runtime needs a versioned dependency on", " debconf, because it uses the x_loadtemplatefile extension that's ", " not supported by debconf versions before hardy. LP: #295135.", " * pam-auth-update: trim leading whitespace from multiline fields when", " parsing PAM profiles. LP: #295441.", " * pam-auth-update: factor out the duplicate code used for returning", " the lines for a given module", "", " [ Jonathan Marsden ]", " * debian/patches/027_pam_limits_better_init_allow_explicit_root:", " Add to patch, documenting how to set limits for root user.", " Include an example. Alters limits.conf, limits.conf.5.xml,", " and limits.conf.5 . (LP: #65244)", "" ], "package": "pam", "version": "1.0.1-5ubuntu1", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [ 294513, 295135, 295441, 65244 ], "author": "Steve Langasek ", "date": "Thu, 08 Jan 2009 20:26:25 +0000" }, { "cves": [], "log": [ "", " * Build-conflict with libxcrypt-dev, which otherwise pulls libxcrypt in as", " a dependency of libpam-modules if it's installed during the build.", " Thanks to Larry Doolittle for catching.", " * Don't refer to gnome-screensaver in the debconf template; it isn't", " actually affected by the libpam symbol issue because it forks a separate", " process to display the screensaver dialog.", " * Have libpam-modules Pre-Depend on ${misc:Depends}, so that we can", " warn users about needing to disable xscreensaver and xlockmore", " before libpam-modules is unpacked. Closes: #502140, LP: #256238.", " * Updated debconf translations for the new template:", " - Italian, thanks to David Paleino ", " - Simplified Chinese, thanks to Deng Xiyue", " (closes: #510371)", " - Portuguese, thanks to Américo Monteiro ", " - Swedish, thanks to Martin Bagge (closes: #510379)", " - Japanese, thanks to Kenshi Muto (closes: #510380)", " - Finnish, thanks to Esko Arajärvi (closes: #510382)", " - Spanish, thanks to Javier Fernandez-Sanguino Peña ", " (closes: #510389)", " - Galician, thanks to Marce Villarino ", " - Slovak, thanks to helix84 (closes: #510412)", " - Bulgarian, thanks to Damyan Ivanov ", " - Czech, thanks to Miroslav Kure <", " (closes: #510608)", " - French, thanks to Steve Petruzzello ", " - German, thanks to Sven Joachim (closes: #510617)", " - Basque, thanks to Piarres Beobide ", " (closes: #510699)", " - Russian, thanks to Yuri Kozlov (closes: #510701)", " - Turkish, thanks to Mert Dirik (closes: #510707)", "" ], "package": "pam", "version": "1.0.1-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 256238 ], "author": "Steve Langasek ", "date": "Tue, 06 Jan 2009 00:05:13 -0800" }, { "cves": [], "log": [ "", " * No-change upload to jaunty to fix publication on armel.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.4", "urgency": "low", "distributions": "jaunty", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 18 Nov 2008 14:09:00 +0000" }, { "cves": [], "log": [ "", " * No-change upload of 1.0.1-4ubuntu5.1 to -updates. -proposed package was", " copied while some ports were not built yet.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.3", "urgency": "low", "distributions": "intrepid-updates", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Tue, 11 Nov 2008 14:50:12 +0100" }, { "cves": [], "log": [ "", " * No-change rebuild because the archive admin (me) copied the package", " to jaunty too soon.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.2", "urgency": "low", "distributions": "intrepid-proposed", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 05 Nov 2008 20:28:11 +0000" }, { "cves": [], "log": [ "", " * Allow passwords to change on expired accounts, by passing", " new_authtok_reqd return codes immediately (LP: #291091).", "" ], "package": "pam", "version": "1.0.1-4ubuntu5.1", "urgency": "low", "distributions": "intrepid-proposed", "launchpad_bugs_fixed": [ 291091 ], "author": "Kees Cook ", "date": "Wed, 05 Nov 2008 09:31:45 -0800" }, { "cves": [], "log": [ "", " * debian/libpam0g.postinst: change 'cupsys' to 'cups' in the list of", " default desktop services that are ignored in deciding whether to prompt", " for service restarts on upgrade. Partially addresses LP #278117.", " * debian/libpam0g.postinst: also filter out samba, which may be installed", " on the desktop to enable filesharing.", " * debian/libpam-cracklib.prerm, debian/libpam-runtime.prerm: add the", " ubiquitous debhelper tokens (currently a no-op)", " * pam-auth-update: Use -Initial only for the first profile, even when", " there's no explicit -Initial config for that first profile", " * fix common-session/common-password to use the same overall stack", " structure as auth/account, so that we get the correct behavior when", " all password modules fail. LP: #272232.", "" ], "package": "pam", "version": "1.0.1-4ubuntu5", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 272232 ], "author": "Steve Langasek ", "date": "Wed, 15 Oct 2008 18:11:13 -0700" }, { "cves": [], "log": [ "", " * Fix a bug in the parser that caused spewing of errors when there", " were more lines in the config file following the managed block.", " LP: #270328.", "" ], "package": "pam", "version": "1.0.1-4ubuntu4", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 270328 ], "author": "Steve Langasek ", "date": "Tue, 23 Sep 2008 06:34:56 +0000" }, { "cves": [], "log": [ "", " * Fix up the code that saves state to /var/lib/pam, so that it matches", " what's expected by the code which later compares the saved and active", " profiles in the case that there are both primary and additional", " modules present.", "" ], "package": "pam", "version": "1.0.1-4ubuntu3", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 16 Sep 2008 06:49:56 +0000" }, { "cves": [], "log": [ "", " * Brown paper bag bug: fix a missing comma in pam-auth-update.", "" ], "package": "pam", "version": "1.0.1-4ubuntu2", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 13 Sep 2008 08:55:32 +0000" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " - debian/local/common-password, debian/pam-configs/unix: switch from", " \"md5\" to \"sha512\" as password crypt default.", " * Bump the version numbers referenced in the config files, again, as pam", " has revved in Debian and moved the bar.", " * debian/pam-config/*: refine the password profiles to use a 'primary'", " block, to better parallel the auth structure.", " * Drop '-Final' from the field names in /usr/share/pam-configs, supporting", " these field names for backwards compatibility only", " * Bump the dependency version requirement to 1.0.1-4ubuntu1 for the above", " change", "" ], "package": "pam", "version": "1.0.1-4ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sat, 13 Sep 2008 08:55:19 +0000" }, { "cves": [], "log": [ "", " * High-urgency upload for RC bugfix.", "", " [ Julien Cristau ]", " * pam_unix-chkpwd-wait: don't assume that the unix_chkpwd process exits", " normally; if it was killed by a signal, we don't want to accept the", " password. Closes: #495879.", "", " [ Steve Langasek ]", " * 007_modules_pam_unix: update the manpage at the same time as the xml", " source (grr, autogenerated files in source packages). Closes: #495804.", " * 055_pam_unix_nullok_secure: also don't call the helper at all from", " _unix_blankpasswd when we can detect that null passwords are disallowed,", " to avoid causing spammy logs on successful authentications.", " Closes: #496620.", " * debian/rules: call chgrp *before* calling chmod, lest the sgid bit", " on unix_chkpwd be cleared during the build when using -rsudo.", " Closes: #496983.", "" ], "package": "pam", "version": "1.0.1-4", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Thu, 28 Aug 2008 22:59:23 -0700" }, { "cves": [], "log": [ "", " [ Steve Langasek ]", " * Never remove the .pam-old files; just avoid creating them if --force isn't", " set.", " * Add a manpage for pam-auth-update.", " * Automatically upgrade the boilerplate for /etc/pam.d/common-* if we", " detect that they have not been locally modified.", "", " [ Kees Cook ]", " * debian/local/common-password, debian/pam-configs/unix: switch from \"md5\"", " to \"sha512\" as password crypt default.", "" ], "package": "pam", "version": "1.0.1-3ubuntu5", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 26 Aug 2008 06:33:07 +0000" }, { "cves": [], "log": [ "", " * If two profiles have the same Priority, sort by the profile name to", " ensure a complete sort so we can filter out all the duplicates from the", " list and not write out broken configs. LP: #260371.", "" ], "package": "pam", "version": "1.0.1-3ubuntu4", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 260371 ], "author": "Steve Langasek ", "date": "Fri, 22 Aug 2008 17:33:14 +0000" }, { "cves": [], "log": [ "", " * s/pam-auth-config/pam-auth-update/ in the source, I can't seem to get", " this name consistent to save my life - I'm starting to think I named it", " wrong...", " * Fix the regex used when suppressing jump counts when reading the saved", " config, so that we don't clobber module options with numbers in them.", " * If the target doesn't already exist, don't try to copy it.", " * Filter the config list to exclude configs that no longer exist.", " LP: #260122.", " * Avoid unnecessary sort/grep in the case where we already have a sorted", " list.", " * Implement pam-auth-update --remove, for use in package prerms when called", " with \"remove\".", "" ], "package": "pam", "version": "1.0.1-3ubuntu3", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 260122 ], "author": "Steve Langasek ", "date": "Thu, 21 Aug 2008 15:38:37 -0700" }, { "cves": [], "log": [ "", " * debian/local/common-session: the session stack needs to be handled the", " same way as the password stack, with the possibility of zero primary", " modules; required to fix build failures on the Ubuntu buildds due to", " su not being able to open sessions by default. LP: #259867.", " * debian/libpam-runtime.postinst: when upgrading from the broken", " 1.0.1-2ubuntu1 version, manually edit /etc/pam.d/common-session to", " recover.", "" ], "package": "pam", "version": "1.0.1-3ubuntu2", "urgency": "high", "distributions": "intrepid", "launchpad_bugs_fixed": [ 259867 ], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 13:27:10 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " - debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", " * Remove spurious 'conflict' with a non-existent module, which was added", " just as an example", "" ], "package": "pam", "version": "1.0.1-3ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 11:58:35 -0700" }, { "cves": [], "log": [ "", " * 055_pam_unix_nullok_secure: don't call _pammodutil_tty_secure with a NULL", " tty argument, since this will cause our helper to segfault instead of", " returning a useful value. Thanks to Troy Davis for the report.", " Closes: #495806.", "" ], "package": "pam", "version": "1.0.1-3", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 11:55:47 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam-runtime.postinst,", " debian/local/common-{auth,password}{,.md5sums}:", " Use the new 'missingok' option by default for pam_smbpass in case", " libpam-smbpass is not installed (LP: #216990); must use \"requisite\"", " rather than \"required\" to prevent \"pam_smbpass migrate\" from firing in", " the event of an auth failure; md5sums updated accordingly.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - Change Vcs-Bzr to point at the Ubuntu branch.", " * debian/local/pam-auth-update (et al): new interface for managing", " /etc/pam.d/common-*, using drop-in config snippets provided by module", " packages.", "" ], "package": "pam", "version": "1.0.1-2ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 216990 ], "author": "Steve Langasek ", "date": "Wed, 20 Aug 2008 09:17:28 +0000" }, { "cves": [], "log": [ "", " * 007_modules_pam_unix: update the documentation to correctly document", " the default minimum password length is 6, not 1.", " * Look for cups instead of cupsys as an init script name when restarting", " services; thanks to Stephen Olander-Waters for pointing this out.", " Closes: #492977.", " * Update the Debian PAM mini-policy to remove references to the", " long-obsolete pam_pwdb, and clarify the relationship between pam_stack", " and @include.", " * Drop various bits of unused cruft from the debian/ directory.", " * Drop libpam-runtime.preinst, only used for upgrades from woody to sarge", " to deal with modified conffiles.", " * Build-Conflict with libdb4.2-dev, which satisfies the libdb-dev", " build-dependency but causes pam_userdb to be silently omitted.", " Closes: #493574.", " * 054_pam_security_abstract_securetty_handling: move the warning log about", " an insecure tty back to pam_securetty proper; we don't want to generate", " log messages every time pam_unix is called as non-root.", " Closes: #493283. As a side-effect, pam_unix no longer logs any warnings", " about NULL password + insecure tty, but I don't think this is critical.", "" ], "package": "pam", "version": "1.0.1-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 08 Aug 2008 10:47:26 -0700" }, { "cves": [], "log": [ "", " * Merge from Debian unstable", " * Dropped changes:", " - Linux-PAM/modules/pam_selinux/pam_selinux.8: Ubuntu pam_selinux manpage", " is 2 years newer than Debian's, contains a number of character escaping", " fixes plus content updates", " - debian/patches-applied/ubuntu-pam_selinux_seusers: patch pam_selinux to", " correctly support seusers (backported from changes in PAM 0.99.8). ", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Bound RLIMIT_NICE", " from below as well as from above. Fix off-by-one error when converting", " RLIMIT_NICE to the range of values used by the kernel.", " * Remaining changes:", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf. (should send to Debian).", " - debian/libpam-runtime.postinst,", " debian/local/common-{auth,password}{,.md5sums}:", " Use the new 'missingok' option by default for pam_smbpass in case", " libpam-smbpass is not installed (LP: #216990); must use \"requisite\"", " rather than \"required\" to prevent \"pam_smbpass migrate\" from firing in", " the event of an auth failure; md5sums updated accordingly.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running.", " - debian/patches-applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-regression_fix_securetty: prompt for", " password on bad username.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " * Refresh patch ubuntu-no-error-if-missingok for the new upstream version.", " * Change Vcs-Bzr to point at the new Ubuntu branch.", "" ], "package": "pam", "version": "1.0.1-1ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 216990 ], "author": "Steve Langasek ", "date": "Mon, 28 Jul 2008 20:58:26 +0000" }, { "cves": [], "log": [ "", " * New upstream version.", " - pam_limits: bound RLIMIT_NICE from below. Closes: #403718.", " - pam_mail: set the MAIL variable even when .hushlogin is set.", " Closes: #421010.", " - new minclass option introduced for pam_cracklib. Closes: #454237.", " - fix a failure to check the string length when matching usernames in", " pam_group. Closes: #444427.", " - fix setting shell security context in pam_selinux. Closes: #451722.", " - use --disable-audit, to avoid libaudit being linked in", " accidentally", " - pam_unix now supports SHA-256 and SHA-512 password hashes.", " Closes: #484249, LP: #245786.", " - pam_rhosts_auth is dropped upstream (closes: #382987); add a compat", " symlink to pam_rhosts to support upgrades for a release, and give a", " warning in NEWS.Debian.", " - new symbol in libpam.so.0, pam_modutil_audit_write; shlibs bump, and", " do another round of service restarts on upgrade.", " - pam_unix helper is now called whenever an unprivileged process", " tries and fails to query a user's account status. Closes: #367834.", " * Drop patches 006_docs_cleanup, 015_hurd_portability,", " 019_pam_listfile_quiet, 024_debian_cracklib_dict_path, 038_support_hurd,", " 043_pam_unix_unknown_user_not_alert, 046_pam_group_example,", " no_pthread_mutexes, limits_wrong_strncpy, misc_conv_allow_sigint.patch,", " pam_tally_audit.patch, 057_pam_unix_passwd_OOM_check, and", " 065_pam_unix_cracklib_disable which have been merged upstream.", " * Patch 022_pam_unix_group_time_miscfixes: partially merged upstream;", " now is really just \"pam_group_miscfixes\".", " * Patch 007_modules_pam_unix partially superseded upstream; stripping", " hpux-style expiry information off of password fields is now supported.", " * New patch pam_unix_thread-safe_save_old_password.patch, to make sure all", " our getpwnam() use in pam_unix is thread-safe (fixes an upstream", " regression)", " * New patch pam_unix_fix_sgid_shadow_auth.patch, fixing an upstream", " regression which prevents sgid shadow apps from being able to authenticate", " any more because the module forces use of the helper and the helper won't", " allow authentication of arbitrary users. This change does mean we're", " going to be noisier for the time being in an SELinux environment, which", " should be addressed but is not a regression on Debian.", " * New patch pam_unix_dont_trust_chkpwd_caller.patch, rolling back an", " upstream change that causes unix_chkpwd to assume that setuid(getuid())", " is sufficient to drop permissions and attempt any authentication on", " behalf of the user.", " * The password-changing helper functionality for SELinux systems has been", " split out into a separate unix_update binary, so at long last we can", " change unix_chkpwd to be sgid shadow instead of suid root.", " Closes: #155583.", " - Update the lintian override to match.", " * Install the new unix_update helper into libpam-modules.", " * Use a pristine upstream tarball instead of repacking; requires various", " changes to debian/rules and debhelper files.", " * Replace the Vcs-Svn field with a Vcs-Bzr field; jumping ship from svn,", " and how!", " * Debconf translations:", " - Romanian, thanks to Igor Stirbu ", " (closes: #491821)", " * Add libpam0g.symbols, for finer-grained package dependencies with", " dpkg-gensymbols.", " * Fix debian/copyright to list the known copyright holders", " * Fix up the doc-base sections for the libpam-doc documentation, \"Apps\"", " should not be part of the section name", " * Also fix up whitespace issues in the doc-base abstracts", " * Fix a typo in the libpam0g-dev description.", " * 027_pam_limits_better_init_allow_explicit_root: RLIM_INFINITY is also", " invalid for RLIMIT_NOFILE, so when resetting the limits for a new session,", " use the kernel default of 1024 instead. Closes: #404836.", " * Create /etc/environment on initial install of libpam-modules (or on", " upgrade from an old version), to quell warnings in the logs about it", " being missing. Closes: #442049.", " * 026_pam_unix_passwd_unknown_user: drop a redundant, and broken, check for", " the NSS source of our user; this was preventing password changes for NIS", " users, which otherwise should have worked. Closes: #203222, LP: #9224.", " * New patch do_not_check_nis_accidentally: respect the 'nis' option", " (set or unset) when looking up the user's password entry for password", " changes. Thanks to Quentin Godfroy for the", " patch. Closes: #469635.", " * Drop patch 049_pam_unix_sane_locking, which upon review is not needed;", " it reduces the length of time we hold the lock, but at the expense of", " being able to enforce minimum times between password changes.", " * debian/watch: upstream has hit 1.0, so we're no longer in a \"pre\"", " directory. Fix up the regex for uscan.", " * Fix the libpam0g-dev examples directory to not include a gratuitous", " .cvsignore file.", " * New patch, pam.d-manpage-section, to fix the manpage references to", " point to section 5 instead of section 8.", " * Update patch PAM-manpage-section to fix the references to pam(7) from", " other manpages. Closes: #470137.", " * Add debian/README.source documenting that this package uses quilt.", " * Bump Standards-Version to 3.8.0.", " * Fix a bug in the uid-restoring code in the hurd_no_setfsuid patch; thanks", " to Tomas Mraz for indirectly bringing this to my", " attention", "" ], "package": "pam", "version": "1.0.1-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [ 245786, 9224 ], "author": "Steve Langasek ", "date": "Mon, 28 Jul 2008 13:56:26 -0700" }, { "cves": [], "log": [ "", " * Medium-urgency upload for RC bugfix", " * Debconf translations:", " - Italian, thanks to David Paleino (closes: #483913)", " - Slovak, thanks to Ivan Masár (closes: #488908)", " - Turkish, thanks to Mert Dirik (closes: #490880)", " - Basque, thanks to Piarres Beobide ", " (closes: #473975)", " * Drop the 'XS' from Vcs-Svn/Vcs-Browser, since these are now officially", " recognized fields.", " * Add a Homepage field. Closes: #473338.", " * Drop -DCRACKLIB_DICTS from CFLAGS, since the referenced define is no", " longer provided by cracklib2-dev 2.8 and above. This requires a", " build-dependency on the corresponding version of libcrack2-dev.", " Closes: #490236.", "" ], "package": "pam", "version": "0.99.7.1-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 21 Jul 2008 11:49:59 -0700" }, { "cves": [], "log": [ "", " * debian/libpam-modules.postinst: revert addition of ~/bin to the end of the", " default PATH set in /etc/environment as it was pointed out by Colin", " Watson that getenv() does not properly expand '~'", "" ], "package": "pam", "version": "0.99.7.1-6ubuntu2", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [], "author": "Jamie Strandboge ", "date": "Tue, 24 Jun 2008 06:29:40 -0400" }, { "cves": [], "log": [ "", " * Merge from debian unstable", " * Dropped changes:", " - Linux-PAM/modules/pam_limits/README,", " Linux-PAM/modules/pam_selinux/README: Ubuntu versions had some", " insignificant character differences, dropping in favor of Debian", " versions; pam_selinux documentation has dropped \"multiple\", and added", " \"select_context\", and \"use_current_range\" as options.", " - debian/control, debian/local/common-session{,md5sums}: use", " libpam-foreground for session management.", " - Build using db4.5 instead of db4.6.", " * Remaining changes:", " - Linux-PAM/modules/pam_selinux/pam_selinux.8: Ubuntu pam_selinux manpage", " is 2 years newer than Debian's, contains a number of character escaping", " fixes plus content updates; (should send to Debian).", " - debian/control: Maintainer updated.", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf; add ~/bin to PATH", " (LP: #64064); (should send to Debian).", " - debian/libpam-runtime.postinst,", " debian/local/common-{auth,password}{,.md5sums}:", " Use the new 'missingok' option by default for pam_smbpass in case", " libpam-smbpass is not installed (LP: #216990); must use \"requisite\"", " rather than \"required\" to prevent \"pam_smbpass migrate\" from firing in", " the event of an auth failure; md5sums updated accordingly.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running (LP: #141309).", " - debian/applied/series: Ubuntu patches are as below ...", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " - debian/patches-applied/ubuntu-pam_selinux_seusers: patch pam_selinux to", " correctly support seusers (backported from changes in PAM 0.99.8). ", " Without this patch login will not get correct security context when ", " using libselinux >= 1.27.2 (LP: #187822).", " - debian/patches-applied/ubuntu-regression_fix_securetty: securetty's", " earlier behavior would correctly prompt for password on bad usernames", " (LP: #139075).", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits. Bound", " RLIMIT_NICE from below as well as from above. Fix off-by-one error when", " converting RLIMIT_NICE to the range of values used by the kernel.", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " * Alphabetized this merge changelog entry by filename (easier reading", " against Ubuntu patch).", "" ], "package": "pam", "version": "0.99.7.1-6ubuntu1", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 64064, 216990, 141309, 187822, 139075 ], "author": "Dustin Kirkland ", "date": "Fri, 20 Jun 2008 10:32:00 -0500" }, { "cves": [], "log": [ "", " * Debconf translations:", " - Updated Vietnamese, thanks to Clytie Siddall ", " (closes: #444437)", " - Updated Spanish, thanks to Javier Fernández-Sanguino Peña", " (closes: #444479)", " - Updated German, thanks to Sven Joachim ", " (closes: #444566)", " - Galician, thanks to Jacobo Tarrio (closes: #444758)", " - Updated Czech, thanks to Miroslav Kure ", " (closes: #445022)", " - French, thanks to Cyril Brulebois ", " (closes: #445869)", " - Japanese, thanks to Kenshi Muto (closes: #446584)", " - Dutch, thanks to Bart Cornelis (closes: #448930)", " - Basque, thanks to Piarres Beobide (closes: #457042)", " - Updated Finnish, thanks to Esko Arajärvi (closes: #458264)", " - Swedish, thanks to Christer Andersson ", " (closes: #457674)", " * Make sure the \"audit\" option is specified in octal instead of in decimal,", " so that it doesn't randomly set other options. Thanks to Corey Wright", " for the catch. Closes: #446327.", "" ], "package": "pam", "version": "0.99.7.1-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 16 Mar 2008 02:06:28 -0700" }, { "cves": [], "log": [ "", " * debian/libpam-modules.postinst: Add ~/bin to the end of the default PATH", " set in /etc/environment (LP: #64064).", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu8", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 64064 ], "author": "Dustin Kirkland ", "date": "Thu, 19 Jun 2008 12:52:48 -0500" }, { "cves": [], "log": [ "", " * debian/patches-applied/ubuntu-no-error-if-missingok: add a new, magic", " module option 'missingok' which will suppress logging of errors by", " libpam if the module is not found.", " * debian/local/common-{auth,password}, debian/libpam-runtime.postinst:", " Use the new 'missingok' option by default for pam_smbpass, to", " correct the problem of very loud logging introduced in the previous", " upload when libpam-smbpass is not installed. LP: #216990.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu7", "urgency": "low", "distributions": "intrepid", "launchpad_bugs_fixed": [ 216990 ], "author": "Steve Langasek ", "date": "Tue, 22 Apr 2008 18:53:37 +0000" }, { "cves": [], "log": [ "", " * debian/local/common-{auth,password}, debian/libpam-runtime.postinst:", " Add pam_smbpass as an optional module in the stack, to keep NTLM", " passwords (for filesharing) in sync with the main system passwords on a", " best-effort basis. LP: #208419.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu6", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [ 208419 ], "author": "Steve Langasek ", "date": "Tue, 08 Apr 2008 18:21:40 +0000" }, { "cves": [], "log": [ "", " * debian/local/common-session: Drop libpam-foreground. It's gone for good,", " and we do not want this in the PAM config for new installations, since it", " just spams syslog with error messages. (LP: #198714)", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu5", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [ 198714 ], "author": "Martin Pitt ", "date": "Tue, 11 Mar 2008 11:22:11 +0100" }, { "cves": [], "log": [ "", " * ubuntu-pam_selinux_seusers: patch pam_selinux to correctly support", " seusers (backported from changes in PAM 0.99.8). Without this patch", " login will not get correct security context when using libselinux", " >= 1.27.2 (LP: #187822).", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu4", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [ 187822 ], "author": "Caleb Case ", "date": "Wed, 30 Jan 2008 06:39:48 -0500" }, { "cves": [], "log": [ "", " * Temporarily reenable libpam-foreground in common-session again, until", " dbus' at_console policy works with ConsoleKit.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu3", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Thu, 29 Nov 2007 15:17:54 +0100" }, { "cves": [], "log": [ "", " * debian/local/common-session{,.md5sums}, debian/control: Drop", " libpam-foreground, superseded by ConsoleKit integration into hal.", " * debian/control: Build against libdb4.6 again. This drops this Debian delta", " and 4.6 is our target version in Hardy.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu2", "urgency": "low", "distributions": "hardy", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Thu, 22 Nov 2007 18:56:47 +0100" }, { "cves": [], "log": [ "", " * Resynchronise with Debian. Remaining changes:", " - debian/control, debian/local/common-session{,md5sums}: use", " libpam-foreground for session management.", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf.", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits. Bound", " RLIMIT_NICE from below as well as from above. Fix off-by-one error when", " converting RLIMIT_NICE to the range of values used by the kernel.", " (Originally patch 101; converted to quilt.)", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " - debian/patches-applied/ubuntu-regression_fix_securetty: securetty's", " earlier behavior would correctly prompt for password on bad usernames", " (LP: #139075).", " - Build using db4.5 instead of db4.6.", " - debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running (LP: #141309).", " * debian/libpam0g.postinst: don't display a debconf warning about display", " managers that need restarting when update-manager is running, instead", " signal to update-notifier if a reboot is required.", "" ], "package": "pam", "version": "0.99.7.1-5ubuntu1", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 139075, 141309 ], "author": "Steve Langasek ", "date": "Fri, 28 Sep 2007 23:45:24 -0700" }, { "cves": [], "log": [ "", " * More lintian overrides, related to debconf prompting in the postinst", " * Debconf translations:", " - Brazilian Portuguese, thanks to Eder L. Marques ", " (closes: #440385)", " - Russian, thanks to Yuri Kozlov ", " (closes: #440390, #440953, #444039)", " - Bulgarian, thanks to Damyan Ivanov ", " (closes: #441863)", " - Finnish, thanks to Esko Arajärvi (closes: #443720)", " - Simplified Chinese, thanks to Ming Hua", " (closes: #443924)", " - Updated Portuguese, thanks to Américo Monteiro ", " - Updated Vietnamese, thanks to Clytie Siddall ", " (closes: #440800)", " - Updated German, thanks to Sven Joachim ", " - Updated Spanish, thanks to Javier Fernández-Sanguino Peña", " ", " - Updated Czech, thanks to Miroslav Kure ", " (closes: #441325)", " * Further cleanups of 007_modules_pam_unix -- don't use a global variable", " for pass_min_len, don't gratuitously move the length checking into the", " \"obscure\" checks, and internationalize the error strings.", " * Stop overriding the built-in default minimum password length in", " /etc/pam.d/common-password, and also drop the \"max\" option which has now", " been obsoleted.", " * Fix up the comments in /etc/pam.d/common-password to make it clear that", " the options are specific to pam_unix. Closes: #414559.", " * Patch 038: fix another thinko in the getline handling. Closes: #442276.", " * If there are active X logins, don't restart kdm, wdm, and xdm by default;", " instead, display a debconf error if they haven't been restarted.", " Closes: #441843.", " * Drop the local patch for Linux capabilities in pam_limits; Linux", " capabilities are not generally useful in a PAM context, and the PAM", " capabilities patch has been broken through much of its life.", " Closes: #440130.", " * -Wl,-z,defs was never enabled correctly, drop it since upstream is", " already using -no-undefined", " * Pass --build and --host args to ./configure as necessary, for", " cross-building support.", "" ], "package": "pam", "version": "0.99.7.1-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 28 Sep 2007 00:17:00 -0700" }, { "cves": [], "log": [ "", " * debian/libpam0g.postinst: call \"reload\" for all display managers", " (LP: #139065).", " * debian/libpam0g.postinst: only ask questions during update-manager when", " there are non-default services running (LP: #141309).", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu4", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 139065, 141309 ], "author": "Kees Cook ", "date": "Mon, 24 Sep 2007 15:01:29 -0700" }, { "cves": [], "log": [ "", " * ubuntu-regression_fix_securetty: securetty's earlier behavior would", " correctly prompt for password on bad usernames (LP: #139075).", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu3", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 139075 ], "author": "Kees Cook ", "date": "Wed, 12 Sep 2007 15:20:09 -0700" }, { "cves": [], "log": [ "", " * Build using db4.5 (instead of db4.6). One db4.x version less on the CD.", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu2", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Wed, 12 Sep 2007 17:44:25 +0200" }, { "cves": [], "log": [ "", " * Resynchronise with Debian (LP: #43169, #14505, #80431). Remaining changes:", " - debian/control, debian/local/common-session{,md5sums}: use", " libpam-foreground for session management.", " - debian/rules: install unix_chkpwd setgid shadow instead of setuid root.", " The nis package handles overriding this as necessary.", " - debian/libpam-modules.postinst: Add PATH to /etc/environment if it's not", " present there or in /etc/security/pam_env.conf.", " - debian/patches-applied/ubuntu-fix_standard_types: Use standard u_int8_t", " type rather than __u8.", " - debian/patches-applied/ubuntu-rlimit_nice_correction: Explicitly", " initialise RLIMIT_NICE rather than relying on the kernel limits. Bound", " RLIMIT_NICE from below as well as from above. Fix off-by-one error when", " converting RLIMIT_NICE to the range of values used by the kernel.", " (Originally patch 101; converted to quilt.)", " - debian/patches-applied/ubuntu-user_defined_environment: Look at", " ~/.pam_environment too, with the same format as", " /etc/security/pam_env.conf. (Originally patch 100; converted to quilt.)", " * Dropped:", " - debian/rules: bashism fixes (merged upstream).", " - debian/control: Conflict on ancient nis (expired with Breezy).", " - debian/libpam-runtime.postinst: check for ancient pam (expired with", " Breezy).", "" ], "package": "pam", "version": "0.99.7.1-4ubuntu1", "urgency": "low", "distributions": "gutsy", "launchpad_bugs_fixed": [ 43169, 14505, 80431 ], "author": "Kees Cook ", "date": "Wed, 05 Sep 2007 15:18:36 -0700" }, { "cves": [], "log": [ "", " * libpam0g.postinst, libpam0g.templates: gdm doesn't need to be restarted", " to fix the library skew, only reloaded; special-case this daemon in the", " postinst and remove the mention of it from the debconf template, also", " tightening the language of the debconf template in the process.", " Closes: #440074.", " * Add courier-authdaemon to the list of services that need to be", " restarted; thanks to Micah Anderson for reporting.", " * New patch pam_env_ignore_garbage.patch: fix pam_env to really skip over", " garbage lines in /etc/environment and log an error, instead of failing", " with an obscure error; and ignore any PAM_BAD_ITEM values returned", " by pam_putenv(), since this is the expected error return when trying", " to delete a non-existent var. Closes: #439984.", " * Yet another thinko in hurd_no_setfsuid and in", " 029_pam_limits_capabilities; this code should really be Hurd-safe at", " last...", " * getline() returns -1 on EOF, not 0; check this appropriately, to fix", " an infinite loop in pam_rhosts_auth. Thanks to Stephan Springl", " for the fix. Closes: #440019.", " * Use ${misc:Depends} for libpam0g, so we get a proper dependency on", " debconf.", " * 019_pam_listfile_quiet: per discussion with upstream, don't suppress", " errors about missing files or files with wrong permissions; these are", " real errors that should not be buried.", " * Drop the remainder of 061_pam_issue_double_free, not required for the", " original bugfix.", " * Drop patch 064_pam_unix_cracklib_dictpath, which is not needed now that", " we define CRACKLIB_DICTS in debian/rules.", " * Drop patch 063_paswd_segv, superseded by a different upstream fix", " * Split 047_pam_limits_chroot_string_value up between", " 008_modules_pam_limits_chroot and 029_pam_limits_capabilites", " * Updates to patch 007_modules_pam_unix: restore the same built-in min", " password len of 6 that upstream uses; fix a typo panlindrome ->", " palindrome.", " * The 'max=' option was never intended to be used to limit maximum password", " length for users, only to declare what the number of significant", " characters /is/ for a password. But we don't need a config option to", " tell us that, we know the answer based on which crypt type we're using,", " so drop this as a config file option. Closes: #389197.", " * Debconf translations:", " - Spanish, thanks to Javier Fernández-Sanguino Peña ", " - Vietnamese, thanks to Clytie Siddall ", " - German, thanks to Sven Joachim (closes: #440355)", " - Czech, thanks to Miroslav Kure ", " (closes: #440362)", " - Portuguese, thanks to Américo Monteiro ", " (closes: #440368)", "" ], "package": "pam", "version": "0.99.7.1-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 31 Aug 2007 17:11:05 -0700" }, { "cves": [], "log": [ "", " * New patch limits_wrong_strncpy: fix unnecessary manipulations of string", " buffers, including an illegal use of strncpy(). Thanks to Paul Hampson", " for reporting. Closes: #331278.", " * New patch misc_conv_allow_sigint.patch: allow SIGINT to be handled by the", " application, instead of blocking it when misc_conv is in use and", " preventing users from being able to ^C at any PAM prompt. Closes: #1708.", " * 024_debian_cracklib_dict_path: default to NULL instead of a specific", " dictionary path when none is defined for consistency with the new upstream", " version of cracklib, and define our path in debian/rules.", " * 055_pam_unix_nullok_secure: document the pam_unix \"nullok_secure\" option,", " a prereq for forwarding this patch upstream. Closes: #325974.", " * Create /etc/security/opasswd on new installs or on upgrades from", " 0.99.7.1-2 or below, so that users that enable the remember= option to", " pam_unix aren't left unable to change passwords. Closes: #95324.", " * Fix a couple of thinkos in hurd_no_setfsuid, that were preventing the code", " from compiling on the Hurd still. Thanks to Michael Banck for the catch.", " * Fix a memory leak in the pam_limits capabilities patch: always", " cap_free() the cap_t before returning from pam_sm_open_session().", " Closes: #153157.", " * libpam0g.postinst, libpam0g.templates: on upgrades from versions", " prior to 0.99.7.1-3, restart known PAM-using services so that they", " get the new libpam symbols, since otherwise the newer PAM modules", " will fail to load. Postinst taken from libssl0.9.8; thanks to", " Christoph Martin for the fine example! Closes: #439835.", " * Build-depend on po-debconf to support l10n of the debconf questions", " from the above.", "" ], "package": "pam", "version": "0.99.7.1-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 28 Aug 2007 06:33:33 -0700" }, { "cves": [ { "cve": "CVE-2005-2977", "url": "https://ubuntu.com/security/CVE-2005-2977", "cve_description": "The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unix_chkpwd, which does not log failed guesses or delay its responses.", "cve_priority": "medium", "cve_public_date": "2005-11-01 12:47:00 UTC" } ], "log": [ "", " * New upstream release; thanks to Roger Leigh and Jan Christoph Nordholz", " for their extensive work in helping to prepare for this update in Debian.", " Closes: #360460.", " - now uses autoconf for library detection, so SELinux should not be", " unconditionally enabled on non-Linux archs. Closes: #333141.", " - pam_mail notice handling has been completely reworked, so there should", " no longer be missing spaces in the messages. Closes: #119689.", " - with libtool and autoconf, now behaves \"sensibly\" on unknown", " platforms. Closes: #165067.", " - the source now builds without warnings. Closes: #212165.", " - uses automake instead of hand-rolled makefiles with indentation", " bugs. Closes: #241661, #328084.", " - pam_mkhomedir now creates directories recursively as needed.", " Closes: #178225.", " - pam_listfile now supports being used as a session module too.", " Closes: #416665.", " - misspelled pam_userdb log message has been corrected. Closes: #305058.", " - the current pam_strerror manpage no longer mentions \"Unknown", " Linux-PAM error\". Closes: #220157.", " - the text documentation no longer uses ANSI bold sequences.", " Closes: #181451.", " - pam_localuser now supports being used as a session module.", " Closes: #412484.", " - package no longer fails to build with dash as /bin/sh.", " Closes: #331208.", " - All modules should now be documented in the system administrator", " guide. Closes: #350620.", " - pam_userdb now logs an error instead of segfaulting when no db=", " option is provided. Closes: #436005.", " - pam_time now warns on a missing tty instead of erroring out,", " making it possible to use the module with non-console services.", " Closes: #127931.", " - upstream changelog is now 'ChangeLog' instead of 'CHANGELOG'; install", " accordingly", " - bump the shlibs", " - the 'test.c' example no longer exists", " - add /usr/share/locale to libpam-runtime.", " - CVE-2005-2977: only uid=0 is allowed to invoke unix_chkpwd with an", " arbitrary username, and then only when SELinux is active.", " Closes: #336344.", " * Mark myself as primary maintainer as previously discussed with Sam, and", " add Roger as an uploader.", " * Refactor to use quilt.", " * Update to Standards-Version 3.7.2.", " * Drop unnecessary build-dependency on patch, which is", " build-essential (and no longer invoked directly).", " * Drop patches 002_debian_no_ldconfig_call, 010_pam_cplusplus,", " 018_man_fixes, 030_makefile_link_against_libpam,", " 037_pam_issue_ttyname_can_be_null, 044_configure_supports_bsd,", " 050_configure_in_gnu and 052_pam_unix_no_openlog, which have been", " superseded upstream.", " * Drop patches 005_pam_limits_099_6,", " 012_pam_group_less_restrictive_charset, 023_pam_env_limits_miscfixes,", " 048_pam_group_colon_valid_char, 058_pam_env_enable, 059_pam_userdb_segv,", " 060_pam_tally_segv and 062_c++_safe_headers, which have been integrated", " upstream.", " * Patch 057: SELinux support is merged upstream, leaving only an", " unrelated OOM check for pam_unix_passwd. Rename as", " 057_pam_unix_passwd_OOM_check.", " * Patches 006, 008, 036: update for the switch from SGML to XML.", " * Patch 007: update for the switch from SGML to XML; drop some log", " messages that were already added upstream; update for the pam_modutil", " changes; tighten the flag handling of the 'obscure' option; drop bogus", " check in unix_chkpwd for null passwords. Also fix a grammar error", " along the way. Closes: #362855.", " * Patch 024: CRACKLIB_DICTPATH is no longer set in configure.in, so patch", " pam_cracklib.c instead to use the default dictpath already available", " from crack.h; and patch configure.in to use AC_CHECK_HEADERS instead", " of AC_CHECK_HEADER, so crack.h is actually included. Also remove", " unnecessary string copies, which break on the Hurd due to PATH_MAX.", " * Patch 038: partially merged/superseded upstream; also add new Hurd", " fix for pam_xauth.", " * Patch 061: partially merged upstream", " * Use ${binary:Version} instead of ${Source-Version} in", " debian/control.", " * Remove empty maintainer scripts debian/libpam0g-dev.{postinst,prerm},", " debian/libpam0g.{postinst,prerm}, and", " debian/libpam-modules.{postinst,prerm}; debhelper can autogenerate these", " just fine without our help.", " * Build-Depend on xsltproc, libxml2-utils, docbook-xml, docbook-xsl", " and w3m instead of on linuxdoc-tools, linuxdoc-tools-latex, tetex-extra,", " groff, and opensp.", " * Also build-depend on flex for libfl.a.", " * Updates for documentation handling:", " - move debian/local/pam-*-guide to debian/libpam-doc.doc-base.foo-guide,", " and invoke dh_installdocs instead of installing these by hand.", " - drop libpam-doc.{postinst,prerm}, which are no longer needed.", " - add an install target to debian/rules, and have binary-indep depend on", " it instead of trying to install doc files individually from the source", " tree", " - consequently, drop libpam-doc.dirs as well which is no longer needed", " and no longer accurate", " - add debian/libpam-doc.install for moving the docs to the right place,", " and also replace libpam-runtime.files with libpam-runtime.install;", " for the moment this means we're using both dh_movefiles and", " dh_install...", " - libpam0g.docs: install the Debian-PAM-MiniPolicy from here, further", " cleaning up debian/rules", " * Drop debian/libpam0g.links, no longer needed because upstream now has a", " working install target which creates the library symlinks", " * Add libpam-modules.links: create pam_unix_{acct,auth,passwd,session}.so", " symlinks by hand, no longer provided upstream.", " * debian/patches-applied/PAM-manpage-section: \"PAM\" is not a daemon, manpage", " belongs in section 7, not in section 8.", " * Actually ship the pam, pam.conf, and pam.d manpages in libpam-runtime.", " * debian/patches-applied/autoconf.patch: move all changes to autotools", " generated files into a single patch at the end of the stack.", " - don't touch configure in debian/rules, the quilt patch takes care", " of this for us.", " * New patch 064_pam_unix_cracklib_dictpath: correctly define", " CRACKLIB_DICTS, since this is not defined by configure. Thanks to Jan", " Christoph Nordholz.", " * New patch 065_pam_unix_cracklib_disable: Debian-specific patch to disable", " cracklib support in pam_unix. Thanks to Christoph Nordholz.", " * debian/rules:", " - Rename OS_CFLAGS to CFLAGS.", " - kill off references to unused variables", " - make binary-arch also depend on the install target, and streamline the", " rules", " - fix up the clean target to not ignore errors; thanks to Roger Leigh", " - drop the local module_check target in favor of using -Wl,-z,defs", " in LDFLAGS to enforce correct linkage of all objects at build time", " * Drop debian/local/unix_chkpwd.8 in favor of the upstream manpage.", " * libpam-modules.files: /usr/sbin/pam_tally has moved to /sbin/pam_tally", " for consistency.", " * Update to debhelper V5.", " * Don't ship Makefiles as part of the libpam0g-dev examples.", " * libpam-modules.manpages, libpam-runtime.manpages, libpam0g-dev.manpages:", " put all the manpages in the correct packages. Closes: #411812,", " #62193, #313486, #300773, #330545, #184270.", " * Drop libpam{0g,0g-dev,-modules,-runtime}.dirs, not needed for anything", " because we aren't trying to ship empty directories in the packages", " * Build-Conflict with fop, to avoid unreproducible builds of pdf", " documentation from a tool in contrib.", " * libpam-cracklib should depend on a real wordlist package, per policy;", " use wamerican as the default.", " * Drop local/pam-undocumented.7 from the package, since we no longer have", " a reason to ship it", " * Add lintian overrides for known false-positives", " * Conflicts/Replaces/Provides libpam-umask, now included upstream.", " Closes: #436222.", " * Upstream no longer marks unix_chkpwd suid-root for us, so set the perms", " by hand in debian/rules. In the process, unix_chkpwd is now writable", " by the owner, as expected by policy. Closes: #368100.", " * Migrate from db4.3 to db4.6; once again, no administrator action should", " be needed for upgrading on-disk database formats. Closes: #354309.", " * Add XS-Vcs-Svn and XS-Vcs-Browser fields to debian/control; thanks to", " Laurent Bigonville for the hint. Closes: #439038.", " * Add a watch file for use with uscan; thanks to Laurent Bigonville for", " this patch as well. Closes: #439040.", " * Rewrite of 031_pam_include, fixing a memory leak and letting us drop", " patch 056_no_label_at_end; thanks to Jan Christoph Nordholz", " for this much-improved version!", " * New patch no_pthread_mutexes: don't use pthread mutexes in", " pam_modutil functions, they're not needed because pam handles", " themselves should not be used concurrently by multiple threads and", " using pthreads causes problems for portable linking.", " * New patch hurd_no_setfsuid: if we don't have sys/fsuid.h, work around", " using setreuid instead.", "" ], "package": "pam", "version": "0.99.7.1-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 26 Aug 2007 19:15:09 -0700" }, { "cves": [], "log": [ "", " * Remove /usr/bin/X11 from default PATH (new installs only).", "" ], "package": "pam", "version": "0.79-4ubuntu2", "urgency": "low", "distributions": "feisty", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Wed, 20 Dec 2006 16:14:37 +0000" }, { "cves": [], "log": [ "", " * Resynchronise with Debian. Remaining changes:", " - Patch 100 (renumbered from 060): Look at ~/.pam_environment too, with", " the same format as /etc/security/pam_env.conf.", " - Patch 101 (renumbered from 061): Explicitly initialise RLIMIT_NICE", " rather than relying on the kernel limits. Bound RLIMIT_NICE from below", " as well as from above. Fix off-by-one error when converting", " RLIMIT_NICE to the range of values used by the kernel.", " - Add PATH to /etc/environment if it's not present there or in", " /etc/security/pam_env.conf.", " - debian/rules: Fix a bashism.", " - Install unix_chkpwd setgid shadow instead of setuid root. The nis", " package handles overriding this as necessary.", " - Use pam_foreground in the default session.", " - Linux-PAM/libpamc/test/regress/test.libpamc.c: Use standard u_int8_t", " type rather than __u8.", "" ], "package": "pam", "version": "0.79-4ubuntu1", "urgency": "low", "distributions": "feisty", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 19 Dec 2006 10:32:47 +0000" }, { "cves": [], "log": [ "", " * Medium-urgency upload; at least one RC bugfix, but also a", " significant number of changes, hence not urgency=high.", " * Move libpam-modules and libpam0g to Section: libs and libpam-runtime", " to section: admin, to match the overrides in the archive.", " * Move old changelog entries (well, entry) that don't follow the current", " format to debian/changelog.old, since there's no way to figure out a", " timestamp for an 8-year-old upload, and this is the most effective", " way to clear a glut of lintian warnings.", " * Fix the formatting of the libpam-cracklib package description.", " * Patch 010: remove parts of the patch that aren't necessary for C++", " compatibility.", " * Patch 060: fix a segfault in pam_tally caused by misuse of", " pam_get_data(); already fixed upstream. Closes: #335273.", " * Patch 061: fix a double free in pam_issue, caused by overuse (and misuse)", " of strdup (similar to patch 059). Already fixed upstream.", " Closes: #327272.", " * Don't build-depend on libselinux1-dev and libcap-dev on kfreebsd archs.", " Closes: #352329.", " * Patch 005: sync pam_limits with upstream:", " - support \"-\" (unlimited) for all limit types except process priority.", " - support the additional aliases \"-1\", \"unlimited\", and \"infinity\" for", " clearing the limits; closes: #122400, #149027.", " - restrict the range of process priority, login count, and system login", " count settings to (INT_MIN,INT_MAX) (heh).", " - special-case RLIM_INFINITY when applying multipliers to values from", " the config.", " - document maxsyslogins in the default limits.conf; closes: #149883.", " - use the current process priority as a default instead of resetting to", " 0; closes: #241663.", " - add support for (and document) new RLIMIT_NICE and RLIMIT_RTPRIO", " settings in Linux 2.6.12 and above; closes: #313542, #313588.", " - allow imposing limits on uid=0.", " * Patch 027: only set RLIM_INFINITY as the default for the limits where", " we know this is sensible, so that recompiling in an environment with new", " limits doesn't create a security hole -- as happened with RLIMIT_NICE and", " RLIMIT_RTPRIO! Thanks to Ville Hallik for the initial patch.", " Closes: #388431.", " * Patch 029, 047: Fix up the broken pam_limits capabilities patch so it", " actually works -- which may well be a first... Closes: #318452.", "" ], "package": "pam", "version": "0.79-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Mon, 23 Oct 2006 05:36:08 -0700" }, { "cves": [], "log": [ "", " * Non-maintainer upload to fix important bug, that makes passwd segfault", " when CTRL-D is pressed at the password prompt. Applied the patch", " provided by Dann Frazier. (Closes: #360657)", "" ], "package": "pam", "version": "0.79-3.2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Margarita Manterola ", "date": "Sat, 5 Aug 2006 02:11:22 -0300" }, { "cves": [], "log": [ "", " * Resynchronise with Debian.", "" ], "package": "pam", "version": "0.79-3.1ubuntu1", "urgency": "low", "distributions": "edgy", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 29 Jun 2006 17:27:34 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer upload.", " * Linux-PAM/libpamc/include/security/pam_client.h,", " Linux-PAM/libpamc/pamc_converse.c: Apply patch from", " latest upstream version to remove redefinition of internal", " glibc/libstdc++ types. Closes: #344447.", "" ], "package": "pam", "version": "0.79-3.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Roger Leigh ", "date": "Sun, 5 Feb 2006 21:46:59 +0000" }, { "cves": [], "log": [ "", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: Protect use of", " RLIMIT_NICE in init_limits() with an #ifdef.", "" ], "package": "pam", "version": "0.79-3ubuntu14", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Fri, 12 May 2006 17:42:40 +0100" }, { "cves": [], "log": [ "", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: Set soft and hard", " nice limits to 20 (= userland nice value 0) rather than unlimited by", " default. Correct off-by-one error (the same error as in Linux 2.6.12,", " but fixed in 2.6.13) in user<->kernel translation of nice limit.", "" ], "package": "pam", "version": "0.79-3ubuntu13", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 11 May 2006 11:29:58 +0100" }, { "cves": [], "log": [ "", " * debian/control: Add libpam-foreground dependency to libpam-runtime, since", " the default /etc/pam.d/common-session refers to it. Closes: LP#35142", "" ], "package": "pam", "version": "0.79-3ubuntu12", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Mon, 10 Apr 2006 14:42:40 +0200" }, { "cves": [], "log": [ "", " [ Dana Olson ]", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: removed glibc", " workaround now that glibc is aware of rlimits.", "", " [ Martin Pitt ]", " * debian/rules: Fix bashisms.", "" ], "package": "pam", "version": "0.79-3ubuntu11", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Thu, 6 Apr 2006 15:03:37 +0200" }, { "cves": [], "log": [ "", " * debian/patches-applied/061_pam_rlimits_nice_rtprio: Support \"nice\" and", " \"rtprio\" rlimits, new in Linux 2.6.12. Backported from upstream thanks", " to Dana Olson and others (closes: Malone #17348).", "" ], "package": "pam", "version": "0.79-3ubuntu10", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 23 Feb 2006 16:22:12 +0000" }, { "cves": [], "log": [ "", " * Fix operator precedence in libpam-modules.postinst.", "" ], "package": "pam", "version": "0.79-3ubuntu9", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Thu, 16 Feb 2006 15:23:04 +0000" }, { "cves": [], "log": [ "", " * Make pam_env be quiet if it can't find the user's configuration file,", " since it's optional.", "" ], "package": "pam", "version": "0.79-3ubuntu8", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Sat, 4 Feb 2006 16:44:12 +0100" }, { "cves": [], "log": [ "", " * Add the PATH on initial install for real this time.", "" ], "package": "pam", "version": "0.79-3ubuntu7", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Thu, 2 Feb 2006 20:33:42 +0100" }, { "cves": [], "log": [ "", " * Changes from Roger Leigh:", "", " * Linux-PAM/libpamc/include/security/pam_client.h,", " Linux-PAM/libpamc/pamc_converse.c: Apply patch from", " latest upstream version to remove redefinition of internal", " glibc/libstdc++ types. Closes: #344447.", " * Linux-PAM/libpamc/test/regress/test.libpamc.c: Also switch to standard", " types; not taken from upstream.", " " ], "package": "pam", "version": "0.79-3ubuntu6", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Reinhard Tartler ", "date": "Wed, 1 Feb 2006 13:14:24 +0000" }, { "cves": [], "log": [ "", " * Add pam_foreground to /etc/pam.d/common-session", "" ], "package": "pam", "version": "0.79-3ubuntu5", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Matthew Garrett ", "date": "Tue, 24 Jan 2006 02:26:19 +0000" }, { "cves": [], "log": [ "", " * Add PATH on initial install, too.", "" ], "package": "pam", "version": "0.79-3ubuntu4", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Mon, 23 Jan 2006 15:55:40 +0100" }, { "cves": [], "log": [ "", " * Add PATH to /etc/environment if it's not present there or in", " /etc/security/pam_env.conf and we are upgrading from a version which", " didn't add it.", "" ], "package": "pam", "version": "0.79-3ubuntu3", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Tue, 17 Jan 2006 15:54:01 +0100" }, { "cves": [], "log": [ "", " * Look at ~/.pam_environment too. Same format as", " /etc/security/pam_env.conf. The patch is recorded as", " patches-applied/060_pam_env_per_user", "" ], "package": "pam", "version": "0.79-3ubuntu2", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Tollef Fog Heen ", "date": "Tue, 17 Jan 2006 15:32:55 +0100" }, { "cves": [], "log": [ "", " * Resynchronise with Debian.", "" ], "package": "pam", "version": "0.79-3ubuntu1", "urgency": "low", "distributions": "dapper", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Mon, 21 Nov 2005 12:15:44 +0000" }, { "cves": [], "log": [ "", " * Patch 059", " - Fix a segfault in pam_userdb when the new \"crypt=\" option", " is unset, as will be the case for all existing users; already fixed", " upstream. Closes: #330829.", " - Fix a memory leak in the same code due to gratuitous strdup()s.", " * Further regression in pam_env: don't treat a missing /etc/environment", " as a fatal error, either. Amend patch 058 accordingly. Closes: #330852.", "" ], "package": "pam", "version": "0.79-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Fri, 30 Sep 2005 01:17:53 -0700" }, { "cves": [], "log": [ "", " The \".c.o: rm -rf $@\" release", " * Fix debian/rules so that make clean doesn't remove ./configure when the", " timestamp on configure.in is newer (!).", " * Switch pam_userdb from db3 to db4.3, which according to the libdb", " maintainers should require no manual intervention for upgrading on-disk", " database formats. Closes: #165068.", " * Patch 058: yes, of course we want to read /etc/environment by", " default. Grr! Revert upstream change which disables this for no", " apparent reason (closes: #330458).", " * Tweak selinux rootok code to use the version of the function call that", " doesn't pollute namespace", "" ], "package": "pam", "version": "0.79-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 27 Sep 2005 02:44:36 -0700" }, { "cves": [], "log": [ "", " * New upstream version (closes: #284954, #300775).", " - includes some fixes for typos (closes: #319026).", " - pam_unix should now be LSB 3.0-compliant (closes: #323982).", " - fixes segfaults in libpam on config file syntax errors", " (closes: #330097).", " * Drop patches 000_bootstrap, 004_libpam_makefile_static_works,", " 011_pam_access, 013_pam_filter_termio_to_termios, 017_misc_fixes,", " 025_pam_group_conffile_name, 028_pam_mail_delete_only_when_set,", " 033_use_gcc_not_ld, 034_pam_dispatch_ignore_PAM_IGNORE,", " 035_pam_unix_security, 039_pam_mkhomedir_no_maxpathlen_required,", " 041_call_bootstrap, 042_pam_mkhomedir_dest_not_source_for_errors,", " 051_32_bit_pam_lastlog_ll_time, and", " 053_pam_unix_user_known_returns_user_unknown which have been", " integrated upstream.", " * Merge one last bit of patch 053 into patch 043, where it should have", " been in the first place", " * Patch 057: SELinux support:", " - add support to pam_unix for copying SELinux security contexts when", " writing out new passwd/shadow files and creating lockfiles", " - support calling unix_chkpwd if opening /etc/shadow fails due to", " SELinux permissions", " - allow unix_chkpwd to authenticate for any user when in an SELinux", " context (hurray!); we depend on SELinux policies to prevent the", " helper's use as a brute force tool", " - also support querying user expiration info via unix_chkpwd", " - misc cleanup: clean up file descriptors when invoking unix_chkpwd", " (closes: #248310)", " - make pam_rootok check the SELinux passwd class permissions, not just", " the uid", " - add new pam_selinux module (closes: #249499)", " * Build-depend on libselinux1-dev.", " * Fix pam_getenv, so that it can read the actual format of /etc/environment", " instead of trying to read it using the syntax of", " /etc/security/pam_env.conf; thanks to Colin Watson for the patch.", " Closes: #327876.", " * Set LC_COLLATE=C when using alphabetic range expressions in", " debian/rules; bah, so *that's* what kept happening to my README file", " when trying to build out of svn! Closes: #295296.", " * Add a reference to the text of the GPL to debian/copyright.", "" ], "package": "pam", "version": "0.79-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Sun, 25 Sep 2005 22:08:20 -0700" }, { "cves": [], "log": [ "", " * Fix Gcc 3.4 compilation, Closes: #259634", " * Note that pam.conf is not read if /etc/pam.d exists, Closes: #248928", " * Fix typo in pam_env.conf, Closes: #277633", "" ], "package": "pam", "version": "0.76-23", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 10 Jul 2005 16:42:25 -0400" }, { "cves": [], "log": [ "", " * Fix pam_getenv, which never worked:", " - Parse /etc/security/pam_env.conf using its own syntax, and then", " /etc/environment using its own syntax rather than the syntax of", " /etc/security/pam_env.conf.", " - 'my $val' was used in an incorrect scope; fixed.", " - Exit non-zero if the requested environment variable is not found.", "" ], "package": "pam", "version": "0.76-22ubuntu3", "urgency": "low", "distributions": "breezy", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Mon, 12 Sep 2005 18:32:54 +0100" }, { "cves": [], "log": [ "", " * debian/rules: Install unix_chkpwd setgid shadow instead of setuid root.", " This only breaks when using NIS lookups, therefore the new nis package", " dpkg-statoverrides it back to setuid root while being installed.", " (Debian #155583, http://udu.wiki.ubuntu.com/ProactiveSecurityRoadmap)", " * debian/control: Added conflict to nis (<< 3.13-3ubuntu1): This is the", " version that corrects the permissions for usage with NIS.", "" ], "package": "pam", "version": "0.76-22ubuntu2", "urgency": "low", "distributions": "breezy", "launchpad_bugs_fixed": [], "author": "Martin Pitt ", "date": "Fri, 17 Jun 2005 12:34:23 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS with gcc-3.4 (closes: #259634). Ubuntu 9037.", "" ], "package": "pam", "version": "0.76-22ubuntu1", "urgency": "low", "distributions": "breezy", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Wed, 4 May 2005 18:14:51 +0200" }, { "cves": [], "log": [ "", " * Add uploaders", " * Document location of repository", " * Fix options containing arguments in pam_unix, Closes: #254904", "" ], "package": "pam", "version": "0.76-22", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 28 Jun 2004 14:28:08 -0400" }, { "cves": [], "log": [ "", " * Fix patch 055 again because -20 was broken and didn't actually fix the", " problem.", "" ], "package": "pam", "version": "0.76-21", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 4 May 2004 21:37:38 -0400" }, { "cves": [], "log": [ "", " * Update to patch 55 to only check securetty when we are sure the", " password is null, Closes: #243698", " * Medium urgency because the version now in testing has confusing and", " verbose log messages.", " * Include pam_getenv script which hopefully will be used by some people", " somewhere for some purpose", "" ], "package": "pam", "version": "0.76-20", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 28 Apr 2004 22:51:18 -0400" }, { "cves": [], "log": [ "", " * Oops, too busy testing the upgrade from woody to make sure the upgrade", " from -16 to -18 worked. Thanks to all those who reported,", " Closes: #243413", "" ], "package": "pam", "version": "0.76-19", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 13 Apr 2004 16:08:54 -0400" }, { "cves": [], "log": [ "", " * Manipulate conffiles to avoid unnecessary prompt in woody to sarge", " upgrade, Closes: #218318", "" ], "package": "pam", "version": "0.76-18", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 10 Apr 2004 18:10:35 -0400" }, { "cves": [], "log": [ "", " * common-password now includes length restrictions and cracklib", " examples, Closes: #227681, #237537", " * Patch 054: abstract out the logic from pam_securetty to determine if a", " tty is in /etc/securetty into a library function", " * Patch 55: Add nullok_secure option to pam_unix. If set, then null", " passwords are accepted from terminals in /etc/securetty.", " * common-auth now includes nullok_secure, Closes: #228114", "", "" ], "package": "pam", "version": "0.76-17", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 4 Apr 2004 23:10:11 -0400" }, { "cves": [], "log": [ "", " * Patch 51 from the x86-64 folks to support 32-bit ll_time in", " pam_lastlog even if time_t is 64-bits", " * Don't call openlog in pam_unix (patch 52), Closes: #213566", " * Return PAM_USER_UNKNOWN for unknown users in pam_unix (patch 53), Closes: #204506", "" ], "package": "pam", "version": "0.76-16", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 23 Mar 2004 22:26:04 -0500" }, { "cves": [], "log": [ "", " * Fix description of libpam-runtime, Closes: #209755", " * Fix description of libpam-cracklib, Closes: #210014", " * Depend on libc6-dev|libc-dev not libc6-dev, Closes: #212354", " * Clean up binaries, Thanks Russell, Closes: #212158", " * Depend on sufficiently new cracklib2-dev, Closes: #214092", " * Treate GNU/* as GNU for OS variable to make pam_limits compile,", " (patch 050) Closes: #220980", " * No longer build-depend on latex2html, Closes: #221318", " * Allow : in tty specification for pam_group, (patch 048) Closes: #220439", " * Pull in locking patch from Linux-PAM CVS; this ended up causing", " 021_pam_nis_locking to be reworked and that patch now no longer", " contains locking fixes, but just NIS cleanup in general. See", " 049_pam_unix_sane_locking for the locking changes, Closes: #220158", "" ], "package": "pam", "version": "0.76-15", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 12 Jan 2004 02:23:59 -0500" }, { "cves": [], "log": [ "", " * Pull in NMU diff from 13.1, Closes: #186011", " * Split out common-password into its own file, Closes: #207497", " * Make other a conffile again and update to @include stuff", " * Add missing symlink, Closes: #196605", " * Remove undocumented manpages", " * Update PAM mini-policy", "" ], "package": "pam", "version": "0.76-14", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 1 Sep 2003 18:08:54 -0400" }, { "cves": [], "log": [ "", " * NMU with maintainer's permission.", " * Add three new config files (/etc/pam.d/common-{auth,account,session})", " to libpam-runtime. Other packages which depend on libpam-runtime", " can now @include these files from their own PAM configs.", " * Convert /etc/pam.d/other from a conffile to a non-conffile config", " file. Closes: #186011.", " * Remove empty libpam-runtime.prerm script (debhelper will autocreate if needed)", "" ], "package": "pam", "version": "0.76-13.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Steve Langasek ", "date": "Tue, 19 Aug 2003 19:41:03 -0500" }, { "cves": [], "log": [ "", " * Nope, that dependency didn't work, so let's remove it. If we run into other module versioning issues, I now have an arm build environment to debug with. Closes: #198618", "" ], "package": "pam", "version": "0.76-13", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 7 Jul 2003 00:22:34 -0400" }, { "cves": [], "log": [ "", " * Fix group.conf example, (patch 046) Closes: #197080", " * Ignore module return value in jumps, (patch 045) Closes: #176693", " * Accept string value for chroot limit, thanks Andrei Pelinescu-Onciul,", " Patch (047), Closes: #196903", " * Depend on libpam-modules instead of conflicting with older versions.", " This creates a circular dependency between libpam0g and", " libpam-modules. James says this works fine; we hope he's right.", " Closes: #196949" ], "package": "pam", "version": "0.76-12", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 21 Jun 2003 17:19:29 -0400" }, { "cves": [], "log": [ "", " * Don't allow db4 to satisfy build-depends because it doesn't actually", " work, and sometimes building with it would be wrong.", " * Don't depend on libpcap-dev on Debian BSD", " * Conflict with old libpam-modules, Closes: #191906", " * Incorrect username should not be logged at alert (patch 43),", " Closes: #175900", " * Patch to support FreeBSD (patch 44, thanks Robert), Closes: #191906", "" ], "package": "pam", "version": "0.76-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 31 May 2003 19:55:26 -0400" }, { "cves": [], "log": [ "", " * Don't double list conffiles, Closes: #190954", " * Only install example sources not executables, Closes: #185286", " * Display correct directory in error message for pam_mkhomedir, patch", " 042 thanks to Akira TAGOH, Closes: #165240", " * Don't log EPERM when setting NOFILE limit as Linux doesn't let you", " set that to -1, Closes: #180310", " * Add newline to end of distributed time.conf, Closes: #172229", " * Up our standards version and support noopt in DEB_BUILD_OPTIONS", "" ], "package": "pam", "version": "0.76-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 3 May 2003 22:28:37 -0400" }, { "cves": [], "log": [ "", " * Fix pam_rhosts hurd patch so it actually works, Closes: #172914", " * Fix patch 040 not to clobber errno when logging the error fails,", " Closes: #172186", " * Fix dependency for linuxdoc-tools, Closes: #173097", "" ], "package": "pam", "version": "0.76-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 15 Dec 2002 17:10:58 -0500" }, { "cves": [], "log": [ "", " * Have makefile appropriately depend on bootstrap-libpam", " * Install pam minipolicy, Closes: #167798", " * Don't segfault if ttyname is null; this avoids the segfault but does", " not actually make pam_issue useful for ssh. I believe the way", " pam_issue works is fundamentally incompatible with what sshd expects", " from PAM (patch 037), Closes: #153152", " * We actually fixed passwords containing , in 0.76-6, but failed to", " document it. They do work, Closes: #164713", " * Note that /etc/pam.d/other is a fall back for each service", " * Patches from Michal 'hramrach' Suchanek\" to", " make HURD work, Closes: #165066 (patch 038 and 039)", " * Don't depend on gs and other doc prep tools for build-depends, just", " build-depends-indep, Closes: #165065", " * Patch from Eric Anderson to log failures of", " setrlimit (patch 040), Closes: #169836", " * Build pam_limits on hurd, Closes: #165190", "" ], "package": "pam", "version": "0.76-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 24 Nov 2002 22:04:28 -0500" }, { "cves": [], "log": [ "", " * Fix handling of pam_ignore in case where we're skipping modules;", " update to patch 034", "" ], "package": "pam", "version": "0.76-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 20 Oct 2002 21:49:22 -0400" }, { "cves": [], "log": [ "", " * The \"No, I don't think I actually want any of what upstream is", " smoking\" release", " * If this were already in testing, this would be an severity emergency", " upload", " * pam_unix currently treats * in shadow file as no password not", " disabled; major security issue; fixed in upstream CVS, (patch 035) Closes: #164659", " * OK, I think this actually fixes the rest of the manpage symlinks,", " Closes: #163839, #164298", " * You don't want to use getlogin for pam_wheel because utmp may be wrong or for xterm have no entry, pull forward patch from the 0.72 packages (patch 036), Closes: #163787", "" ], "package": "pam", "version": "0.76-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 15 Oct 2002 10:44:56 -0400" }, { "cves": [], "log": [ "", " * Fix library links from 0.75 to 0.76", " * Ignore PAM_IGNORE in _pam_dispatch_aux (patch 34), Closes: #163841", " * Fix man page symlinks, Closes: #163839", "" ], "package": "pam", "version": "0.76-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 11 Oct 2002 01:08:06 -0400" }, { "cves": [], "log": [ "", " * Upstream correctly states that one should use gcc not ld when", " linking and then hapilly proceeds to actually use ld, fixed, Closes: #163711", "", " * Remove experimental warning from readme, Closes: 163742", "" ], "package": "pam", "version": "0.76-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 7 Oct 2002 23:45:53 -0400" }, { "cves": [], "log": [ "", " * Oops, let's try building -fpic. This currently builds everything", " -fpic which is somewhat wrong, but doing more than that requires", " significant build system hacking (touch every makefile for dynamic", " objects), so it will wait, Closes: #163600", "" ], "package": "pam", "version": "0.76-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 6 Oct 2002 23:33:12 -0400" }, { "cves": [], "log": [ "", " * Link against appropriate libraries so we find the symbols we need,", " Closes: #162175", " * The if everyone's going to complain when I upload broken software to", " experimental release, I might as well upload to unstable and give them", " something worth actually complaining about release.", " * Also the remove the scourge of dbs release", " * Include patch 034 from the 0.72 packages, meaning that we've included", " all the patches we need before release", " * Reject the patch to pam_wheel as I cannot find out what reasonable", " thing it was trying to do and it seemed broken", " * libpam-cracklib should depend on wordlist so it actually works;", " thanks Olaf Meeuwissen,", " Closes: #112965", " * Merge build-depends and build-depends-indep because I'm a bad person", " and was too lazy to make docs build in a separate pass. I'll deal in", " a few versions.", "" ], "package": "pam", "version": "0.76-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 6 Oct 2002 18:52:13 -0400" }, { "cves": [], "log": [ "", " * New upstream version", " * Upstream includes fix to not break cron, Closes: 160566", " * New Upstream correctly handles priority < 0 for pam_limits, Closes: #126251", " * .cvsignores removed, Closes: #159961", "" ], "package": "pam", "version": "0.76-1", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sun, 22 Sep 2002 16:11:35 -0400" }, { "cves": [], "log": [ "", " * Apply patch 027 pam_limits so that we initialize to wide open not", " current limits.", " * In pam_mail, don't complain about deleting environment variable if", " we never set it, Closes: #58429", " * Don't set default max procs limit in pam_limits, Closes: #116874", " * libpam-runtime now arch all since it has no arch-specific files,", " Closes: #132545", " * Update mini policy to reflect confusion on debian-devel", "" ], "package": "pam", "version": "0.75-3", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 16 Jul 2002 09:30:50 -0400" }, { "cves": [], "log": [ "", " * Fix pam_userdb to build and to build against db3, fixes patch 020", " * Fix upstream makefile so pam_group has valid configuration, closes: #148657", " * time.conf reference to logoutd removed, closes: #143801", " * The static library contains all the appropriate symbols in this", " version. You may find the complete lack of PAM modules somewhat", " frustrating; currently the static pam library is only useful if you", " register your own modules. Fixing this would require annoying hacking", " on the upstream build system, closes: #103495", " * unix_chkpwd.8 typo fixes thanks to dancer@anthill.echidna.id.au,", " Closes: #139949", " * Since we're working on the new upstream version, we also have the new docs, closes: #147763", " * Patch from Martin Schwenke to only change", " passwords in pam_unix when they exist in the password file; hopefully", " does not break NIS, closes: #135990", " * Another patch from Martin to return PAM_USER_UNKNOWN if we ever", " actually do get into the password changing routine only to find that", " we have no password to change, closes: #135604", " * .cvsignore no longer installed, closes: #120795", " * We're using debhelper 3, just in time to be obselete, Closes: #93414", "" ], "package": "pam", "version": "0.75-2", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 8 Jun 2002 18:04:40 -0400" }, { "cves": [], "log": [ "", " * Preliminary test packages", " * New upstream version", " * Hopefully works mostly the same as 0.72 except for upstream bug", " fixes and for the fact that pam_limits is fairly broken right now.", " * If it breaks you are lucky if you get to keep both pieces release.", "" ], "package": "pam", "version": "0.75-1", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 25 May 2002 22:57:57 -0400" }, { "cves": [], "log": [ "", " * Fix like_auth to make libpam-krb5 and libpam-heimdal actually useful,", " patch from RISKO Gergely , closes: #126251", "" ], "package": "pam", "version": "0.72-35", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 21 Jan 2002 15:20:22 -0500" }, { "cves": [], "log": [ "", " * Note that HOME may not be useful in pam_environment, closes: #109281", " * Don't smash case domains (groups/users) in pam_limits, closes: #119893", " * Remove double the from description, closes: #107705", " * Fix typo on mail message, closes: #119689", " * Medium since these are small fixes that should go into woody", "" ], "package": "pam", "version": "0.72-34", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 23 Nov 2001 21:24:20 -0500" }, { "cves": [], "log": [ "", " * Fix pam_mail to look in /var/mail not /var/spool/mail, thanks mjb.", "" ], "package": "pam", "version": "0.72-33", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Thu, 11 Oct 2001 15:44:32 -0400" }, { "cves": [], "log": [ "", " * This should probably get into testing before freeze; medium.", " * Patch from Volker Stolz to fix bug in previous pam_group patch,", " closes: #111854", "" ], "package": "pam", "version": "0.72-32", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 22 Sep 2001 06:32:29 -0400" }, { "cves": [], "log": [ "", " * Add support for credential reinitialization in pam_group, closes: #108697", "" ], "package": "pam", "version": "0.72-31", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 31 Aug 2001 13:16:39 -0400" }, { "cves": [], "log": [ "", " * Include patch from robbe@orcus.priv.at to build pam_limits on hurd,", " closes: #103556", " * Start installing limits.conf for hurd (may not work quite right)", "" ], "package": "pam", "version": "0.72-30", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 16 Jul 2001 09:35:51 -0400" }, { "cves": [], "log": [ "", " * Correctly declare uint32 type for ia64, closes: #104584", "" ], "package": "pam", "version": "0.72-29", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Sat, 14 Jul 2001 01:30:39 -0400" }, { "cves": [], "log": [ "", " * Fix scanf string so pam_limits chroot works, closes: #100812", " * Only log unknown user at warning, not alert, closes: #95220", " * By default do complete matches not substring matches for pam_time.", " You can include explicit wildcard for substring, closes: #66152", "" ], "package": "pam", "version": "0.72-28", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 3 Jul 2001 17:31:45 -0400" }, { "cves": [], "log": [ "", " * Fix typo in last patch", "" ], "package": "pam", "version": "0.72-27", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 25 Jun 2001 18:27:42 -0400" }, { "cves": [], "log": [ "", " * Block SIGCHLD when calling unix password verification program, patch from mdz@debian.org, fixes pam part of #97977", "" ], "package": "pam", "version": "0.72-26", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 25 Jun 2001 08:47:12 -0400" }, { "cves": [], "log": [ "", " * Depend on opensp, working around #89063, closes: #100125", " * This is urgency medium to get docs back into testing.", "" ], "package": "pam", "version": "0.72-25", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 8 Jun 2001 11:44:12 -0400" }, { "cves": [], "log": [ "", " * New NIS double locking and root password patch from Philippe Troin", " , fixes bug in unreleased patch submitted for", " 0.72-23. Also improves changing root password so it does something;", " ongoing discussion on whether this is right.", "" ], "package": "pam", "version": "0.72-24", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 21 May 2001 08:06:05 -0400" }, { "cves": [], "log": [ "", " * Patch from Benoit Gaussen , Don't trim from , to end", " of string in user input, only trim from salt", " grabbed from passwd file, closes: #96779", " * Fix NIS double locking, closes: #96736", "" ], "package": "pam", "version": "0.72-23", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 16 May 2001 15:46:34 -0400" }, { "cves": [], "log": [ "", " * Fix pam.8 to be pam.7, closes: #92874", "" ], "package": "pam", "version": "0.72-22", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Tue, 17 Apr 2001 23:04:04 -0400" }, { "cves": [], "log": [ "", " * Don't depend on libcap for hurd, closes: #91998", " * Don't list scurity/limits.conf as a conffile for hurd", "" ], "package": "pam", "version": "0.72-21", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Mon, 9 Apr 2001 12:30:18 -0400" }, { "cves": [], "log": [ "", " * Install pam-undocumented in -runtime not -dev, closes: #93063", " * Mark pam-runtime as replacing files from -dev in case you installed", " -19 and have pam-undocumented in the wrong place", "" ], "package": "pam", "version": "0.72-20", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Fri, 6 Apr 2001 06:38:15 -0400" }, { "cves": [], "log": [ "", " * New maintainer, closes: #92353", " * Install pam-undocumented; somehow it was not installed in -18", "" ], "package": "pam", "version": "0.72-19", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sam Hartman ", "date": "Wed, 4 Apr 2001 21:32:17 -0400" }, { "cves": [], "log": [ "", " * pam_securetty: log failed tty checks. Normally this was only done if", " the \"debug\" option was on...do it regardless now, closes: #89390", " * Get rid of log message for when \"root\" is not applied to group checks.", " closes: #88825", " * Add quiet option to pam_listfile, closes: #84428", " * pam(8) should be pam(7), pam.conf(8) should be pam.conf(5), closes:", " #89322", " * Added groff to Build-Depends-Indep, closes: #88794", "" ], "package": "pam", "version": "0.72-18", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 25 Mar 2001 21:40:32 -0500" }, { "cves": [], "log": [ "", " * Fixed login in pam_limits where the max logins could be ignored.", "" ], "package": "pam", "version": "0.72-17", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 9 Mar 2001 09:14:48 -0500" }, { "cves": [], "log": [ "", " * New pam limits cap patch from Topi Miettinen", " , closes: #88401, #88406, #88525, #88399,", " #86197", " * pwdb no longer used, closes: #59917", " * fix patch 023 for gethostbyname build failure, closes: #86156", " * Make sure unix_chkpwd gets installed as suid root, closes: #88519", " * Fix whatis parse of manpages, closes: #86203", " * pam_listfile, fix arg parsing when arg does not contain '=', closes:", " #86070", "" ], "package": "pam", "version": "0.72-16", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 4 Mar 2001 22:45:58 -0500" }, { "cves": [], "log": [ "", " * Doh, added build-depends for libcap, closes: #85352", " * Change section of libpam-cracklib from admin to libs to match", " overrides.", "" ], "package": "pam", "version": "0.72-15", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 9 Feb 2001 09:06:40 -0500" }, { "cves": [], "log": [ "", " * Added fix to pam_access for gethostname decleration. closes: #82100", " * Just name the lib/security directory instead of all the modules", " seperately for dh_movefiles. closes: #76119", " * Fix pam_env corruption, closes: #66849, #77229", " * Add patch to allow recursive /etc/skel copy in pam_mkhomedir, closes:", " #67211", " * remove dh_suidregister call, added conflict for old suidregister", " package", " * Applied patch for Linux capabilities in pam_limits, closes: #74176", " * pam_issue.so works for me, without segv, and even with escapes. This", " is with login. Note, things like pam_issue do not work with ssh simply", " because ssh is not able to work in that way (does not support", " arbiitrary conversations). So if you want it to work there, file a bug", " on ssh, not on libpam-modules. closes: #77228", " * unix_chkpwd: check for NULL password, closes: #69960", "" ], "package": "pam", "version": "0.72-14", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 8 Feb 2001 11:06:03 -0500" }, { "cves": [], "log": [ "", " * Fix grammar in pam_source.sgml, closes: #78959", " * pam_undocumented.7: Fix escaped 's, closes: #75987", " * Fix build ordering, closes: #71442, #80397, #77017", " * Applied Hurd patch, closes: #76119", " * Use gcc for linking, not ld. closes: #71941", " * Pretty sure this was fixed, closes: #67172", " * Applied spealang fixes to Debian-mini-policy. closes: #80249", " * Applied patch to allow devfs style terminal devices with pam_group,", " closes: #77661", " * Could not reproduce, even using md5 passwords. User, if you still have", " * this problem, you need to tell me with what service (login, which I", " tested, sshd, telnet, etc...) and also send me the entire pam.d file", " for that service. closes: #76087", " * Fixed awhile back, closes: #72858", " * Closing this since I am not going to include any modules in this", " package that aren't in upstream. If someone else wants to package", " these modules seperately, they can do so. closes: #69550", " * For correct usage, pam_wheel.so should be used with \"sufficient\" and", " not \"required\". This is documented. If you use \"required\", then you", " must also use the \"trust\" option, but that doesn't give you the", " results you want. closes: #76236", "" ], "package": "pam", "version": "0.72-13", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 31 Dec 2000 05:38:23 -0500" }, { "cves": [], "log": [ "", " * Recompile against db2 for glibc change", " * Add db2 to build-deps", "" ], "package": "pam", "version": "0.72-12", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 27 Sep 2000 12:08:11 -0400" }, { "cves": [], "log": [ "", " * Removed all traces of pwdb in packages. libpwdb has been removed from", " the archive. This means that the pam_pwdb and pam_radius modules are", " no longer available (from the libpam-pwdb package).", " * doc/modules/pam_wheel.sgml: Really spell out that being a member of a", " group meands the user is listed in /etc/group, closes: #69242", " * doc/*: s/PAM_AUTHOK_RECOVERY_ERR/PAM_AUTHOK_RECOVER_ERR/g,", " closes: #64473", " * pam_wheel: PAM does not distinguish it, the libc calls make the", " distinction. The users gid is returned in their passwd info, while", " getgrent() returns only the members of the group listed in /etc/group.", " This is ok, because if it's really that important, you can actually", " have it in both places. The fact that it's documented should suffice", " in making this clear, closes: #69236", " * Sorry, but seperate modules generally need to be packaged seperately.", " I don't want to overload this package with everyone's pet module, so I", " have to put my foot down, closes: #61759", " * Actually, I'm going to move in Woody to make packages depend more on", " the defaults in /etc/pam.d/other, so that admins have less to", " maintain. For one, all packages should not have a password service", " listed, closes: #70000 (YAY! I got the 70k rollover bug number!)", " * Sorry, I can't include this. \",\" is a legitimate char in a password", " salt/hash. If you can code up something that is super intelligent", " about lenghts of the field, I can go for it, maybe, closes: #59459", " * modules/pam_limits: Added chroot feature patch, closes: #61090", " * modules/pam_access: Allow last field to contain ':', closes: #67291", " * modules/pam_limits: Allow explicit limits for root, closes: #62448", " * modules/pam_unix: Do not zero old/new password fields, libpam does", " this itself, and doing so in the module breaks stacking,", " closes: #66270", " * modules/pam_group: Allow alpha *and* numeric in tty field (duh),", " closes: #63752", " * modules/pam_access: Enable NIS, closes: #64854", " * libpam0g-dbg: removed, useless anyway", "" ], "package": "pam", "version": "0.72-11", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 30 Aug 2000 18:39:32 -0400" }, { "cves": [], "log": [ "", " * Update build depends", " * Fixed logic for showing non-existent user names when auth failed in", " pam_unix.so, closes: #67786 (thanks to Jim Breton for being patient in", " helping track this down). It would sometimes show them, even if we", " didn't want to.", "" ], "package": "pam", "version": "0.72-10", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 27 Jul 2000 09:17:08 -0400" }, { "cves": [], "log": [ "", " * pam_unix: do not call obscure_msg() of pass_old is NULL,", " closes: #65321", " * pam_access: check for from[0] == '\\0' so that tty logic is actually", " used, closes: #65401", "" ], "package": "pam", "version": "0.72-9", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 14 Jun 2000 11:38:35 -0400" }, { "cves": [], "log": [ "", " * Build depends added in previous version, closes: #60817, #61439", " * Allow use of \":0\" in group.conf, closes: #61966", " * Added syslog entry to notify that a user succesfully changed their", " password, closes: #61724", " * Make pam_unix compatible with HP-UX style NIS+ password information,", " patch from ldaffner@rsn.hp.com, closes: #61942", " * If \"audit\" is not enabled, don't let pam_unix print the names of", " unknown users for auth attempts, closes: #61942", " * Fixed ttyname() parsing in pam_access to match that of the old shadow", " access.conf s,/dev/,, closes: #61644", " * Set some sane defaults for pam_limits.so instead of carrying over", " potentially bad defaults, patch from Peter Paluch", " closes: #63230", " * Allow explicit (e.g. specified specifically for) limits for root,", " patch from Topi Miettinen , closes: #62448", " * Added information to time.conf about logoutd, which is now enabled via", " this file.", " * cracklib maintainer claims this isn't a bug, closes: #54180", " * fixed control syntax handling which was causing segfaults, closes: #62237", "" ], "package": "pam", "version": "0.72-8", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 29 Apr 2000 11:39:59 -0400" }, { "cves": [], "log": [ "", " * pam_limits: fix parsing of users which explicitly removes limits,", " closes: #59911, #60287", " * Added build-depends", "" ], "package": "pam", "version": "0.72-7", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 20 Mar 2000 16:06:28 -0500" }, { "cves": [], "log": [ "", " * Remove conflict for libpam0g-util from libpam0g and put it in", " libpam-runtime. This should fix a problem with upgrades that apt", " experiences, closes: #58677", "" ], "package": "pam", "version": "0.72-6", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 28 Feb 2000 14:05:28 -0500" }, { "cves": [], "log": [ "", " * Added obscure password checks to pam_unix. Required for shadow to be", " able to emulate the pre-PAM setup (referenced in a bug on passwd).", " * Applied patch from #57800 to fix NIS/NIS+ shadow accounting checks,", " closes: #57800, #58164", " * Fixed two typos in the PAM System Administrators Guide,", " closes: #56578, #56587", "" ], "package": "pam", "version": "0.72-5", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 28 Feb 2000 10:58:09 -0500" }, { "cves": [], "log": [ "", " * unix_chkpwd: check for NULL on stdin aswell as 0 reads, closes: #56375", " * pam_unix/Makefile: removed bashism, closes: #56370", " * fixed in shadow upload, closes: #49832", "" ], "package": "pam", "version": "0.72-4", "urgency": "low", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 29 Jan 2000 00:27:28 -0500" }, { "cves": [], "log": [ "", " * Added cpluplus wraps in all the headers, closes: #53653", "" ], "package": "pam", "version": "0.72-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 2 Jan 2000 15:15:40 -0500" }, { "cves": [], "log": [ "", " * Well, this is an odd one. A recompile fixes it. So it must have been a", " problem from linking with 0.71 when this is version 0.72. All of this", " build daemons seem to have compiled the latest 0.72, so this should be", " resolved after this gets recompiled on all of them, closes: #51619, #49584", " * This is from a very old version (0.56) of libpam0. It is not relevant", " to the latest version, closes: #47162", "" ], "package": "pam", "version": "0.72-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 26 Dec 1999 09:10:13 -0500" }, { "cves": [], "log": [ "", " * New upstream source release, lots of patches merged upstream (thanks", " Andrew).", " * libpam-doc: now provides pam-doc, closes: #45631", " * cleanups to the build system", " * shlibs.local: bumped shlib deps", "" ], "package": "pam", "version": "0.72-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 14 Dec 1999 11:17:36 -0500" }, { "cves": [], "log": [ "", " * Debian-PAM-MiniPolicy: new document describing how PAM is implemented", " in Debian", "" ], "package": "pam", "version": "0.71-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 26 Nov 1999 17:26:40 -0500" }, { "cves": [], "log": [ "", " * pam_listfile: lstat -> stat, closes: #49833", " * pam_tally: install the pam_tally program, closes: #50314", " * debian/control: libpam-modules, replaces libpam0g-util, closes: #50716", "" ], "package": "pam", "version": "0.71-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 25 Nov 1999 21:02:23 -0500" }, { "cves": [], "log": [ "", " * New upstream release, merges lots of patches from the Debian source,", " also merges the pam_{motd,mkhomedir,issue} modules into the main", " source. Lots of minor bugs fixed, and compiler warnings", " * pam_mail: Reimplemented the authentication handlers, so now this works", " as both (changes nothing in Debian, but was required to get the patch", " accepted upstream)", " * general: Lots of small edits to fix compiler warnings", " * pam_userdb: fixed potential usage of an unitialized value as", " PAM_AUTHTOK, doesn't look particularly exploitable, but better safe", " than sorry", "" ], "package": "pam", "version": "0.71-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 8 Nov 1999 19:21:52 -0500" }, { "cves": [], "log": [ "", " * pam_wheel/pam_wheel.c: change to use getpwuid(getuid()) by default, so", " avoid the problems associated with getlogin()", "" ], "package": "pam", "version": "0.70-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 1 Nov 1999 13:33:10 -0500" }, { "cves": [], "log": [ "", " * Applied patch from Herbert Xu to enable PAM_CONV_AGAIN support in", " pam_ftp, closes: #47288", "" ], "package": "pam", "version": "0.70-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 13 Oct 1999 13:25:21 -0400" }, { "cves": [], "log": [ "", " * 100_pam_pwdb_security_fix: new patch fixes security problem with", " regard to NIS accounts", "" ], "package": "pam", "version": "0.70-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 13 Oct 1999 11:42:41 -0400" }, { "cves": [], "log": [ "", " * New upstream release", " * Seems there were a lot of fixes merged/matches upstream, looks good,", " (maybe it's time I start sending my patches in, since the maintainer", " is active again).", " * libpamc: new library (libpam client library), this actually used to be", " in the Debian packages for a few versions, but it was removed upstream.", " Guess what, it's back :)", "" ], "package": "pam", "version": "0.70-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 10 Oct 1999 01:07:43 -0400" }, { "cves": [], "log": [ "", " * {pwdb,unix}_chkpwd.8: fixed format to get rid of \"no whatis\" warnings", " from mandb, closes: #47004", " * pam_unix.sgml: new file, documents the pam_unix.so module,", " closes: #46511", "" ], "package": "pam", "version": "0.69-11", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 9 Oct 1999 12:41:58 -0400" }, { "cves": [], "log": [ "", " * libpam/pam_item.c: fixed debug message being in wrong place", " * 013_pam_issue: new patch, provides issue file parsing for PAM", " applications (helps to replace lost functionality in login).", "" ], "package": "pam", "version": "0.69-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 6 Oct 1999 20:30:17 -0400" }, { "cves": [], "log": [ "", " * Fix typo in pam_mail.so module's \"no\" return", "" ], "package": "pam", "version": "0.69-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 3 Oct 1999 15:08:56 -0400" }, { "cves": [], "log": [ "", " * docs/modules/pam_mkhomedir.sgml: Fixed module name", " * changed build system structure", " * libpam/Makefile: add -lcrypt to the linked libs, closes: #46104", " * increase shlib deps to 0.69-7, closes: #45801", " * pam_motd.c: close motd file after reading, closes: #46122", " * pam_motd.c: fix setting \\0 in the wrong place when motd file is", " zero length, closes: #45686, #45632", " * pam_unix_acct.c: allow '0' to denote disabled for some expiry fields", " since chage(1) documents it this way, closes: #45446", " * pam_mail.c|modules/pam_mail.sgml: added 2 options, one \"standard\" to", " give the old style \"You have ...\" response and \"quiet\" which only", " reports new mail for both formats, documented both options,", " closes: #45670", " * with the new pam_unix module, this bug is fixed, closes: #42230", " * pam_limits.c: make sure that we not only ignore limits on root, we", " also remove them just in case we are su'ing from a limited user to", " the root account (since as root they can remove the limits anyway),", " closes: #35302", "" ], "package": "pam", "version": "0.69-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 3 Oct 1999 12:07:28 -0400" }, { "cves": [], "log": [ "", " * debian/rules: fixed module_check", " * pam_env/pam_env.c: fixed env parsing to include values wrapped in ''", " and also allow continued lines with a trailing '\\'.", " * pam_motd,pam_mail: converted to session modules, so that they could", " be ordered with the lastlog module", " * updated default pam.d/login to reflect above change (now login looks", " the same as the non-PAM version, lastlog, then motd, and then mail", " check)", " * pam_motd: removed extraneous \\n from output", " * modules/pam_limits/pam_limits.c: Fixed parsing of lines with only", " \"domain -\", which was documented as being able to get rid of limits", " for that user or group.", " * debian/control: (libpam-cracklib) Added depends for cracklib-runtime,", " closes: #45488", " * modules/pam_env.c: Fixed /etc/environment parsing causing segfaults on", " long lines, closes: #45408", "" ], "package": "pam", "version": "0.69-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 19 Sep 1999 13:50:40 -0400" }, { "cves": [], "log": [ "", " * Install unix_chkpwd suid root, it's needed for NIS to work without", " modification to the binary.", " * modules/pam_limits/pam_limits.c: hmm, some how I got a strange broken", " patch left over from the source upgrade...removed all but the pwdb", " purging, closes: #45088", " * modules/pam_env/pam_env.c: Changed to a debug message, instead of a", " syslog message when /etc/environment does not exist.", "" ], "package": "pam", "version": "0.69-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 15 Sep 1999 04:25:21 -0400" }, { "cves": [], "log": [ "", " * Removed libpam0g's preinst check for full paths in the pam.d files,", " this should really be a lintian check at build (i think the old libpam", " could not work like this, but hey...things change for the better some", " times. This PAM works fine like that). closes: #45001", " +NOTE: Debian packages should not reference modules by the full path", " so they don't break if I ever decide to move the modules to a different", " default directory. Only the admin should reference full paths and only", " for locally installed modules. I have submitted a request to check for", " this in lintian along with a few other devious things.", " * debian/patches/008_pam_mkhomedir: Fix title of sgml doc", " * modules/pam_userdb/Makefile: added patch for building against glibc 2.0", " (request from Roman Hodek), closes: #45064", "" ], "package": "pam", "version": "0.69-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 14 Sep 1999 06:12:34 -0400" }, { "cves": [], "log": [ "", " * Link all dynamic modules with libpam. For some reason, alpha doesn't", " like it when we don't", "" ], "package": "pam", "version": "0.69-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 13 Sep 1999 06:01:40 -0400" }, { "cves": [], "log": [ "", " * doc/modules/pam_cracklib.sgml: changed to correct path for", " cracklib_dict reference.", " * modules/pam_env/pam_env.c: now groks bash style env's from", " /etc/environment to be compatible with other programs that use it.", " * modules/pam_securetty/pam_securetty.c: don't just plain fail when", " root isn't allowed to login, fake a password request just like any", " good auth module would. Keeps us from letting them know that they", " are doing something bad :)", " * modules/pam_{motd,mkhomedir}: merged these two modules into this", " source, also wrote corresponding sgml files for libpam-doc,", " closes: #40754", " * debian/control: Moved libpam0g, libpam-modules and libpam-runtime", " to base with required priority since login depends on them and", " policy will require this", "" ], "package": "pam", "version": "0.69-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 11 Sep 1999 08:06:02 -0400" }, { "cves": [], "log": [ "", " * Modified build so that it uses libs and headers in the build tree", " rather than on the local system. This involved changint the build", " order slightly and should make it easier to compile on new archs.", " * Modified pam_limits so that it was invoked during pam_sm_setcred()", " instead of during pam_sm_session_open() so that it will work with", " shadow's su.", " * Fixed missing symbols in libpam.so, they were caused by it thinking", " it was supposed to have static modules built in.", " * Fixed problem where libpam was getting built with -DDEBUG", " * pam_unix_passwd.c: Changed the perms on shadow to be 0.42 and 0640", " instead of 0.0 and 0600", " * unix_chkpwd: fix it not being sgid shadow", "" ], "package": "pam", "version": "0.69-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Thu, 9 Sep 1999 13:52:01 -0400" }, { "cves": [], "log": [ "", " * New upstream source", " - Now with a new and improved pam_unix module, closes: #38631", " - Lot's of documentation cleanups", " * Converted build system to dbs (doogie's build system, aka Adam Heath)", " * Fixed libpam.so compilation so that it did not link with any of the", " modules (this was causing lot's of problems, closes; #43913, #40739", " * modules/pam_ftp/pam_ftp.c: Fixed sizeof, to use strlen,", " closes: #44054, #41845, #44142, #39129, #39871, #44412", " * Postscript pages are now generated correctly, closes: #41608", " * Moved to FHS compliance (including use of debhelper 2.0.40),", " this also raises the policy version to 3.0.1.1", " * Don't check the paths in /etc/pam.d files anymore. This is old", " and causes nothing but complaints, closes: #39747", " * Build libpam0g-dbg with debuggable static and shared libraries, also", " enabled the internal DEBUG_REL compile flag for these so that the", " debugging messages will also be output", "" ], "package": "pam", "version": "0.69-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 7 Sep 1999 17:45:20 -0400" }, { "cves": [], "log": [ "", " * Added ability for pam_env to parse /etc/environment and updated", " docs to reflect it", " * Applied patch for pwdb_chkpwd man page, closes: #38976", " * Merged pam_unix_*.so modules into one pam_unix.so with symlinks", " for backward compatibility. This helps centralize this module the", " same way the pam_pwdb.so is and the way pam_unix.so is on other", " operating systems (commercial ones specifically).", " * Closed by pam-apps upload, closes: #38632", " * Fixed `sgml2latex' syntax, closes: #39119", " * Added doc-base support, closes: #37627", "" ], "package": "pam", "version": "0.66-10", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 16 Jun 1999 01:20:23 -0400" }, { "cves": [], "log": [ "", " * SPARC NMU to fix chown symbols when compiling with glibc 2.1.1", "" ], "package": "pam", "version": "0.66-9.1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 11 May 1999 13:33:33 +0000" }, { "cves": [], "log": [ "", " * Changed the debian/rules to not mess with the library symlinks (ie", " running ldconfig in the lib dir) and all is well, closes: #36169", "" ], "package": "pam", "version": "0.66-9", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sun, 18 Apr 1999 09:09:51 -0400" }, { "cves": [], "log": [ "", " * Compiled with libpam_client.so now (seperate lib in libpam0g)", " * Made regex for libpam0g postinst a little more specific so it", " didn't flag false problems. closes: #34626", " * Applied patch to fix pam_ftp, closes: #35388", " * Modified pam_mail and pam_lastlog to honor PAM_SILENT in order to", " enable apps to use hushlogin/PAM_SILENT", " * Fixed problem with libpam_client.so being static", "" ], "package": "pam", "version": "0.66-8", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Mon, 15 Mar 1999 20:54:23 -0500" }, { "cves": [], "log": [ "", " * Fixed XCASE in pam_filter.c (not really in glibc 2.1 by default)", "" ], "package": "pam", "version": "0.66-7", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Sat, 6 Mar 1999 18:46:56 -0500" }, { "cves": [], "log": [ "", " * Removed empty /lib/security/ from libpam0g (is created in", " libpam-runtime)", " * Added a depends for libpam-runtime to libpam0g (was supposed to be", " there, must have deleted it)", " * Removed empty /usr/bin from libpam-runtime (old directory where", " upperLOWER was)", "" ], "package": "pam", "version": "0.66-6", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 24 Feb 1999 13:14:25 -0500" }, { "cves": [], "log": [ "", " * Removed harcoded libc6 dependency from libpam0g-dev and changed it to", " libc6-dev. closes: #33615", " * Added md5 flag for pam_unix_passwd.so", " * Removed upperLOWER program since it is just an example. Moved it's", " source to the examples directory in libpam-modules", " * Fixed documentation of pam_strerror() and examples. closes #31142", " * Made pam_unix_passwd.so leave /etc/shadow mode 640 and root.shadow", " after changes", " * Fixed problem in pam_unix_auth that didn't let you su from a normal", " user to another normal user (ie. neither one was root)", " * Closing misc fixed bugs. closes #32809, #32274 (have been fixed,", " just need closing)", " * Tested lockvc with pam support, works for normal users (pam_pwdb)", " closes: #31150", " * Changed /var/log/wtmp in pam_lastlog docs to reflect correct", " /var/log/lastlog file. closes: #26544", " * Added -ldl to libpam.so, so apps don't have to", "" ], "package": "pam", "version": "0.66-5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 19 Feb 1999 18:47:30 -0500" }, { "cves": [], "log": [ "", " * Changed pwdb_chkpwd to sgid shadow instead of suid root since it only", " needs read permissions to /etc/shadow and not write.", " * Moved a lot of files arouns to get rid of libpam-runtime dependencies", " * Put libpam-pwdb into it's own package", " * Removed -lpwdb links for modules since libpwdb is somewhat buggy (or", " alteast it's interaction with libpam is)", " * Fixed bug in pam_unix_passwd.so that caused it to never authenticate", " the correct passwd, making it so you couldn't change the passwd", "" ], "package": "pam", "version": "0.66-4", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 16 Feb 1999 15:50:28 -0500" }, { "cves": [], "log": [ "", " * Fixed defaults in /etc/pam.d/other to be pam_unix_*.so modules instead", " of the accidental pam_pwdb.so module", " * Fixed suid of pwdb_chkpwd (had to move dh_fixperms after", " dh_suidregister)", " * Added Replaces: libpam0g-util in order to help dpkg upgrade from", " older packages", " * Applied glibc 2.1 patch from Christian Meder. closes: #32809", " * Moved libpam-doc to Section doc. closes: #32274", "" ], "package": "pam", "version": "0.66-3", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Fri, 12 Feb 1999 02:01:43 -0500" }, { "cves": [], "log": [ "", " * Removed all of the versioned module stuff. Modules are now in", " /lib/security and stay there. Seems after discussion, that modules may", " not change as often as thought", " * Fixed suidregister for pwdb_chkpwd", " * Fixed incomplete descriptions in control file", " * This is a kludge to close some bugs since the last upload was yanked", " before being installed in the archive, closes: #16882, #30862, #7725,", " #10234, #10406, #12210, #14291, #15528, #15529, #20660, #25330,", " #29868, #31088, #31128, #9131, #9919, #19383, #5132, #14533, #25915,", " #28075, #31548, #31191", "" ], "package": "pam", "version": "0.66-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Tue, 2 Feb 1999 12:47:25 -0500" }, { "cves": [], "log": [ "", " * New maintainer", " * New upstream release. closes: #16882, #30862, #7725", " * Created a better split of the main lib and the runtime to kill the", " circular dependencies and make it possible to have two .so version of", " the library installed for upgrades. closes: #10234, #10406, #12210,", " bug #14291, #15528, #15529, #20660, #25330, #29868, #31088, #31128,", " bug #9131, #9919.", " * Harcoded modules directory prefixed with the .so version, and", " used alternatives to create the symlink to the 'default' modules", " directory. libpam will use the full path when specified, but use the", " versioned modules directory for relative names.", " * Put libpam0g-cracklib modules back in (own package). This means that", " cracklib support is _not_ in the static libpam.a, also cracklib", " support is _not_ in pam_unix_passwd.o, but only in pam_cracklib.so", " by itself.", " * Fixed a few typos in the source causing compile errors", " * Fixed source #include's so that pam _didn't_ have to be installed", " in order to compile the source ( changed from <> to \"\" )", " * Removed empty directories from built packages", " * Opted not to build examples, only going to put *.c files in examples", " directory for libpam0g-dev", " * Moved *.sgml files for modules into their own directory (looks like", " that is what the original maintainer wanted to do, but it didn't go)", " * Moved doc build to arch-indep build in rules so that it doesn't get", " built when specifying -B with debuild/dpkg-buildpackage.", " * Moved `touch .quiet...' to build-stamp in order to have -B builds not", " ask about pam.conf", " * Split out non-standard modules to their own package, so as to make the", " base install smaller (planning for base inclusion here)", " * Created small manpage for pwdb_chkpwd. closes: #10941", " * The Copright file in /usr/doc/*/ was already named copright and not", " compressed. closes: #14533", " * Package is now lintian clean. closes #19383, #5132", " * There is a maintainer now and the patch for #25915 is still included", " so.... closes: #25915", " * Added check for editor backup files in /etc/pam.d (*~). closes: #28075", " * Applied patch for md5.h in pam_pwdb module. closes: #31548", " * Added support for dhelp in libpam-doc. closes: #31191", "" ], "package": "pam", "version": "0.66-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Ben Collins ", "date": "Wed, 20 Jan 1999 07:09:15 -0500" }, { "cves": [], "log": [ "", " * Marked PAM as orphaned, given that there has been no maintainer upload", " in almost two years.", " * [defs/debian.defs] Removed superflous cracklib2 dependency.", " (Urgent as cracklib still has release-critical bugs).", " (Fixes #30862).", "" ], "package": "pam", "version": "0.65-0.8", "urgency": "high", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Wed, 20 Jan 1999 09:34:35 +0100" }, { "cves": [], "log": [ "", " * Fixed security vulnerability in the pam_unix and pam_tally modules", " (reported by Michal Zalewski on bugtraq; patch", " A000-SECURITY-PATCH-0.65-and-below.gz by Andrey V. Savochkin).", "" ], "package": "pam", "version": "0.65-0.7", "urgency": "high", "distributions": "frozen unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Tue, 29 Dec 1998 16:20:18 +0100" }, { "cves": [], "log": [ "", " * Fixed distribution of files over the various packages, which was", " severely messed up.", " * Added appropriate Replaces: to ensure upgrading from both the hamm", " version and previous slink versions.", " * Fixed debug libraries, PAM module loading.", " * Added examples.", " * Added a \"pam-undocumented\" manpage pointing to libpam-doc, and", " made links for functions without a manpage to that.", "" ], "package": "pam", "version": "0.65-0.6", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Sun, 11 Oct 1998 19:29:40 +0200" }, { "cves": [], "log": [ "", " * Rewritten the preinst warning text (it still mentioned the search path).", "" ], "package": "pam", "version": "0.65-0.5", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Fri, 9 Oct 1998 14:23:18 +0200" }, { "cves": [], "log": [ "", " * It looks like I misunderstood DEFAULT_MODULE_PATH: Linux-PAM does not", " currently seem to be easily configured to look for modules in more than", " one directory. With this version, it's configured to look only in", " /lib/security .", "" ], "package": "pam", "version": "0.65-0.4", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Fri, 9 Oct 1998 11:43:34 +0200" }, { "cves": [], "log": [ "", " * Moving the PAM modules to /lib/security broke netatalk.", " Added a preinst script to detect /etc/pam.d files with explicit paths to", " PAM modules, give a warning about them, and offer to abort the install", " (Fixes #27514).", "" ], "package": "pam", "version": "0.65-0.3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Tue, 6 Oct 1998 20:10:43 +0200" }, { "cves": [], "log": [ "", " * Argh. The tools didn't recognise -0.1 as a new upstream release, so", " my previous upload was rejected due to a missing .orig.tar.gz .", "" ], "package": "pam", "version": "0.65-0.2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Sun, 4 Oct 1998 17:15:09 +0200" }, { "cves": [], "log": [ "", " * New upstream version.", " * Non-maintainer upload.", " * Major package overhaul; now uses debhelper.", " * In experimental for now. *Please* provide feedback; if the feedback is", " positive, we can put this in slink.", " * Dropped libc5 support.", " * [libpam/pam_static.c] Fixed compilation: \"pamh\" was undefined; use \"NULL\".", " is this the correct fix?", " * [defs/debian.defs] New.", " * [Makefile]", " * Exit when a make in a subdirectory fails.", " * Compile statically too.", " * New variables: LC, LP, LPLIBS, DEFAULT_MODULE_PATH .", " * [libpam/Makefile]", " * Use DEFAULT_MODULE_PATH if nonempty.", " * Link libpam against LPLIBS.", " * [modules/*/Makefile]", " * Link the dynamic security objects against libpam and libc", " (LP and LC).", " * [modules/pam_pwdb/Makefile]", " * Link dynamic security objects against libcrypt and libnsl.", " * [conf/install_conf] Allow for non-interactive install (as the other", " install_conf scripts already did).", " * Automatically determine the list of /etc/security/* conffiles.", " * Moved libpam to /lib, and PAM modules to /lib/security as they will", " become part of the base system in the future.", " * Built without cracklib support, to keep the base system smaller.", " * /sbin/pwdb_chkpwd is undocumented, as is upperLOWER.", "" ], "package": "pam", "version": "0.65-0.1", "urgency": "low", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "J.H.M. Dassen (Ray) ", "date": "Fri, 2 Oct 1998 20:23:27 +0200" }, { "cves": [], "log": [ "", " * Non maintainer upload", " My previous upload had removed the libc5 stuff from the controlfile", " messing up things. Change 'Architecture: any' to 'i386 m68k' for those", " .deb's instead.", "" ], "package": "pam", "version": "0.57b-0.4", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Turbo Fredriksson ", "date": "Thu, 20 Aug 1998 20:06:50 -0400" }, { "cves": [], "log": [ "", " * Non maintainer upload", " On a glibc2.1 system, XCASE is only defined in the ", " _IF_ '__USE_MISC' or '__USE_UNIX98' is defined.", "" ], "package": "pam", "version": "0.57b-0.3", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Turbo Fredriksson ", "date": "Sun, 16 Aug 1998 22:13:45 -0400" }, { "cves": [], "log": [ "", " * Yet another non-maintainer release.", " * Zero changes; simply a re-upload due to a rm-trigger happy release", " ``manager''.", "" ], "package": "pam", "version": "0.57b-0.2", "urgency": "high", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "James Troup ", "date": "Tue, 17 Mar 1998 19:55:16 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer release.", " * debian/control (Standards-Version): Updated to 2.4.0.0.", " * debian/control (libpam0g-dev): Also conflict with libpam-dbg.", " * debian/postinst: use case statement instead of if.", " * debian/rules (COMPAT_ARCHES): removed sparc.", " * debian/rules (binary-libc6-dev, binary-libc5-altdev): strip static libraries with", " --strip-debug, not --strip-unneeded.", " * debian/rules: each package now has it's own doc directory under", " /usr/doc/, containing at least the copyright file (Policy 5.6).", " * debian/rules: install files with `install -m 644' not `cp -p' to avoid", " read-only files.", " * debian/rules (binary-libc6-util): strip /usr/lib/*/security/*.so with", " --strip-unneeded.", " * debian/rules (binary-libc5-util): ditto.", " * debian/rules (binary-libc5): don't depend on binary-libc5.", "" ], "package": "pam", "version": "0.57b-0.1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "James Troup ", "date": "Sat, 7 Mar 1998 18:04:19 +0100" }, { "cves": [], "log": [ "", " * Non-maintainer release.", " * New upstream version.", " * Doesn't use pristine upstream source as the upstream tar ball is broken.", " * Added libc6 libraries libpam0g, libpam0g-dev, libpam0g-dbg and", " libpam0g-util. [#11697]", " * libpam-dev becomes libpam0-altdev, libpam-util -> libpam0-altutil and", " libpam-dbg is removed.", " * libpam0 depends on libpam0g because libpam0g contains the pam conffile.", " * libpam0-util depends on libpam0g-util because libpam0g contains the binary.", " * Compiled with -D_REENTRANT and link with -lc.", " * Fixed permissions on shared libraries.", " * Corrected syntax of /etc/pam.d/other. [#10497, #10758, #12030]", " * Fixed typos in postinst. [#10474, #11365]", " * Made /etc/pam.conf a conffile.", " * Updated URL in copyright file.", " * Removed over-zelaously installed README* files from libpam-doc.", "" ], "package": "pam", "version": "0.57b-0", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "James Troup ", "date": "Sat, 22 Nov 1997 17:54:30 +0100" }, { "cves": [], "log": [ "", " * Added /etc/pam.d/other with policy 'deny'.", " * Add manual pages for PAM security modules.", "" ], "package": "pam", "version": "0.56-2", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Klee Dienes ", "date": "Sat, 15 Mar 1997 22:33:22 -0500" }, { "cves": [], "log": [ "", " * New upstream release.", " * Converted to new packaging format.", " * Reorganization of package structure (-dev, -dbg, etc).", "" ], "package": "pam", "version": "0.56-1", "urgency": "low", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Klee Dienes ", "date": "Sat, 8 Mar 1997 01:21:17 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsmartcols1", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libssh-4", "from_version": { "source_package_name": "libssh", "source_package_version": "0.10.6-2ubuntu0.4", "version": "0.10.6-2ubuntu0.4" }, "to_version": { "source_package_name": "libssh", "source_package_version": "0.10.6-2ubuntu0.5", "version": "0.10.6-2ubuntu0.5" }, "cves": [ { "cve": "CVE-2026-59843", "url": "https://ubuntu.com/security/CVE-2026-59843", "cve_description": "A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59845", "url": "https://ubuntu.com/security/CVE-2026-59845", "cve_description": "A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59846", "url": "https://ubuntu.com/security/CVE-2026-59846", "cve_description": "A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.", "cve_priority": "medium", "cve_public_date": "2026-07-21 13:17:00 UTC" }, { "cve": "CVE-2026-59847", "url": "https://ubuntu.com/security/CVE-2026-59847", "cve_description": "A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59848", "url": "https://ubuntu.com/security/CVE-2026-59848", "cve_description": "A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59850", "url": "https://ubuntu.com/security/CVE-2026-59850", "cve_description": "A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-59843", "url": "https://ubuntu.com/security/CVE-2026-59843", "cve_description": "A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59845", "url": "https://ubuntu.com/security/CVE-2026-59845", "cve_description": "A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 12:18:00 UTC" }, { "cve": "CVE-2026-59846", "url": "https://ubuntu.com/security/CVE-2026-59846", "cve_description": "A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.", "cve_priority": "medium", "cve_public_date": "2026-07-21 13:17:00 UTC" }, { "cve": "CVE-2026-59847", "url": "https://ubuntu.com/security/CVE-2026-59847", "cve_description": "A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59848", "url": "https://ubuntu.com/security/CVE-2026-59848", "cve_description": "A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.", "cve_priority": "medium", "cve_public_date": "2026-07-21 14:16:00 UTC" }, { "cve": "CVE-2026-59850", "url": "https://ubuntu.com/security/CVE-2026-59850", "cve_description": "A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Denial of service via zero advertised channel packet size", " - debian/patches/CVE-2026-59843-1.patch: channels: Fail when receiving max", " packet size 0 in src/channels.c, src/messages.c.", " - debian/patches/CVE-2026-59843-2.patch: tests: Verify zero max packet size", " in channel open is rejected in tests/unittests/torture_channel.c.", " - CVE-2026-59843", " * SECURITY UPDATE: Denial of service via unchecked ProxyCommand fork() failure", " - debian/patches/CVE-2026-59845.patch: socket: Properly check fork() return", " code in src/socket.c.", " - CVE-2026-59845", " * SECURITY UPDATE: Information disclosure via ProxyCommand %r username", " expansion", " - debian/patches/CVE-2026-59846-pre1.patch: misc: Add function to check", " username syntax in include/libssh/misc.h, src/misc.c,", " tests/unittests/torture_misc.c.", " - debian/patches/CVE-2026-59846.patch: Block shell metacharacters from", " usernames in include/libssh/priv.h, src/misc.c.", " - CVE-2026-59846", " * SECURITY UPDATE: Integrity downgrade via OpenSSL AES-GCM tag verification", " - debian/patches/CVE-2026-59847-1.patch: libcrypto: Fix tag verification of", " AES-GCM ciphers in src/libcrypto.c.", " - debian/patches/CVE-2026-59847-2.patch: libcrypto: Fix symmetric issue", " during encryption in src/libcrypto.c.", " - CVE-2026-59847", " * SECURITY UPDATE: Denial of service via SFTP responses with unknown request", " IDs", " - debian/patches/CVE-2026-59848-1.patch: sftp: handle responses with unknown", " request IDs in include/libssh/sftp.h, src/sftp.c,", " tests/client/torture_sftp_request_id.c, tests/client/CMakeLists.txt.", " - debian/patches/CVE-2026-59848-2.patch: sftp: Initialize sftp_request_queue", " ptr in sftp_free in src/sftp.c.", " - CVE-2026-59848", " * SECURITY UPDATE: Use-after-free via data callbacks on closed channels", " - debian/patches/CVE-2026-59850.patch: channels: Avoid processing DATA", " packets on closed channels in src/channels.c.", " - CVE-2026-59850", "" ], "package": "libssh", "version": "0.10.6-2ubuntu0.5", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 24 Aug 2026 10:59:34 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libtinfo6", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.1", "version": "6.4+20240113-1ubuntu2.1" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.2", "version": "6.4+20240113-1ubuntu2.2" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.4+20240113-1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libuuid1", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "6.8.0-139.139", "version": "6.8.0-139.139" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 6.8.0-139.139", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- resync from main package", "" ], "package": "linux-meta", "version": "6.8.0-139.139", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:25:54 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "mount", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "ncurses-base", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.1", "version": "6.4+20240113-1ubuntu2.1" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.2", "version": "6.4+20240113-1ubuntu2.2" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.4+20240113-1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "ncurses-bin", "from_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.1", "version": "6.4+20240113-1ubuntu2.1" }, "to_version": { "source_package_name": "ncurses", "source_package_version": "6.4+20240113-1ubuntu2.2", "version": "6.4+20240113-1ubuntu2.2" }, "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2025-6141", "url": "https://ubuntu.com/security/CVE-2025-6141", "cve_description": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.", "cve_priority": "low", "cve_public_date": "2025-06-16 22:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Stack-based buffer overflow", " - debian/patches/CVE-2025-6141.patch: add a buffer-limit check in", " postprocess_termcap in ncurses/tinfo/parse_entry.c.", " - CVE-2025-6141", "" ], "package": "ncurses", "version": "6.4+20240113-1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 07:36:06 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-client", "from_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.18", "version": "1:9.6p1-3ubuntu13.18" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.19", "version": "1:9.6p1-3ubuntu13.19" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:9.6p1-3ubuntu13.19", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:38:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.18", "version": "1:9.6p1-3ubuntu13.18" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.19", "version": "1:9.6p1-3ubuntu13.19" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:9.6p1-3ubuntu13.19", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:38:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-sftp-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.18", "version": "1:9.6p1-3ubuntu13.18" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:9.6p1-3ubuntu13.19", "version": "1:9.6p1-3ubuntu13.19" }, "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-73281", "url": "https://ubuntu.com/security/CVE-2026-73281", "cve_description": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73282", "url": "https://ubuntu.com/security/CVE-2026-73282", "cve_description": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" }, { "cve": "CVE-2026-73283", "url": "https://ubuntu.com/security/CVE-2026-73283", "cve_description": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.", "cve_priority": "medium", "cve_public_date": "2026-08-11 20:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: misinteraction between agent locking and the", " session-bind@openssh.com extension", " - debian/patches/CVE-2026-73281.patch: upstream: Allow session-", " bind@openssh.com requests when the agent is in ssh-agent.c.", " - CVE-2026-73281", " * SECURITY UPDATE: se-after-free for realloc data", " - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc", " use-after-free in the client if a in ssh.c.", " - CVE-2026-73282", " * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding", " - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys", " \"restrict\" keyword apply correctly in serverloop.c.", " - CVE-2026-73283", "" ], "package": "openssh", "version": "1:9.6p1-3ubuntu13.19", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 31 Aug 2026 14:38:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "perl-base", "from_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.3", "version": "5.38.2-3.2ubuntu0.3" }, "to_version": { "source_package_name": "perl", "source_package_version": "5.38.2-3.2ubuntu0.4", "version": "5.38.2-3.2ubuntu0.4" }, "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2025-15649", "url": "https://ubuntu.com/security/CVE-2025-15649", "cve_description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48959", "url": "https://ubuntu.com/security/CVE-2026-48959", "cve_description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48962", "url": "https://ubuntu.com/security/CVE-2026-48962", "cve_description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-7017", "url": "https://ubuntu.com/security/CVE-2026-7017", "cve_description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-07 19:16:00 UTC" }, { "cve": "CVE-2026-9538", "url": "https://ubuntu.com/security/CVE-2026-9538", "cve_description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-12087", "url": "https://ubuntu.com/security/CVE-2026-12087", "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.", "cve_priority": "medium", "cve_public_date": "2026-06-15 22:16:00 UTC" }, { "cve": "CVE-2026-13221", "url": "https://ubuntu.com/security/CVE-2026-13221", "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:16:00 UTC" }, { "cve": "CVE-2026-57432", "url": "https://ubuntu.com/security/CVE-2026-57432", "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2026-57433", "url": "https://ubuntu.com/security/CVE-2026-57433", "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.", "cve_priority": "medium", "cve_public_date": "2026-07-13 17:17:00 UTC" }, { "cve": "CVE-2025-15649", "url": "https://ubuntu.com/security/CVE-2025-15649", "cve_description": "IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48959", "url": "https://ubuntu.com/security/CVE-2026-48959", "cve_description": "IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-48962", "url": "https://ubuntu.com/security/CVE-2026-48962", "cve_description": "IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.", "cve_priority": "medium", "cve_public_date": "2026-05-27 04:16:00 UTC" }, { "cve": "CVE-2026-7017", "url": "https://ubuntu.com/security/CVE-2026-7017", "cve_description": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.", "cve_priority": "medium", "cve_public_date": "2026-07-07 19:16:00 UTC" }, { "cve": "CVE-2026-9538", "url": "https://ubuntu.com/security/CVE-2026-9538", "cve_description": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.", "cve_priority": "medium", "cve_public_date": "2026-05-26 02:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source", " - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in", " pack_ip_mreq_source in cpan/Socket/Socket.xs", " - CVE-2026-12087", " * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches", " - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta", " would overflow 16 bits in regcomp_study.c, t/re/pat_advanced.t", " - CVE-2026-13221", " * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack", " - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes", " that would overflow SSize_t in pp_pack.c", " - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H", " template size math in pp_pack.c", " - CVE-2026-57432", " * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization", " - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts", " before av_extend in dist/Storable/Storable.xs", " - CVE-2026-57433", " [ LeoSilva ]", " * SECURITY UPDATE: uncaught exception in IO::Uncompress::Unzip DOS date", " parsing", " - debian/patches/CVE-2025-15649.patch: wrap _dosToUnixTime() in eval", " and return zero for empty/out-of-range date fields in", " cpan/IO-Compress/lib/IO/Uncompress/Unzip.pm", " - CVE-2025-15649", " [ LeoSilva ]", " * SECURITY UPDATE: CPU exhaustion in IO::Uncompress::Unzip fastForward", " - debian/patches/CVE-2026-48959.patch: fix per-byte read loop caused", " by comparing length $offset instead of $offset in", " cpan/IO-Compress/lib/IO/Uncompress/Unzip.pm", " - CVE-2026-48959", " [ LeoSilva ]", " * SECURITY UPDATE: arbitrary code execution in File::GlobMapper", " - debian/patches/CVE-2026-48962.patch: remove use of eval STRING in", " _parseOutputGlob/_getFiles, replacing with safe delimiter-based", " substitution in cpan/IO-Compress/lib/File/GlobMapper.pm", " - CVE-2026-48962", " [ LeoSilva ]", " * SECURITY UPDATE: credential header leakage on cross-origin redirects", " in HTTP::Tiny", " - debian/patches/CVE-2026-7017.patch: strip Authorization, Cookie and", " Proxy-Authorization headers on cross-origin redirects, refuse", " https-to-http downgrade by default in", " cpan/HTTP-Tiny/lib/HTTP/Tiny.pm", " - CVE-2026-7017", " [ LeoSilva ]", " * SECURITY UPDATE: memory exhaustion in Archive::Tar entry size handling", " - debian/patches/CVE-2026-9538.patch: add $MAX_FILE_SIZE cap to", " refuse oversized entry declarations before allocation in", " cpan/Archive-Tar/lib/Archive/Tar.pm", " - CVE-2026-9538", "" ], "package": "perl", "version": "5.38.2-3.2ubuntu0.4", "urgency": "high", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Tue, 18 Aug 2026 17:25:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "util-linux", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.5", "version": "2.39.3-9ubuntu6.5" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.39.3-9ubuntu6.6", "version": "2.39.3-9ubuntu6.6" }, "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-13595", "url": "https://ubuntu.com/security/CVE-2026-13595", "cve_description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "cve_priority": "medium", "cve_public_date": "2026-06-29 09:16:00 UTC" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53615", "url": "https://ubuntu.com/security/CVE-2026-53615", "cve_description": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * SECURITY UPDATE: Heap use-after-free via crafted block device image", " - debian/patches/CVE-2026-13595.patch: libblkid: fix use-after-free in", " nested partition probing in libblkid/src/partitions/partitions.c.", " - CVE-2026-13595", " * SECURITY UPDATE: TOCTOU in mount utility", " - debian/patches/CVE-2026-27456.patch: loopdev: add LOOPDEV_FL_NOFOLLOW to", " prevent symlink attacks in include/loopdev.h, lib/loopdev.c,", " libmount/src/hook_loopdev.c.", " - CVE-2026-27456", " * SECURITY UPDATE: Local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53612.patch: libmount: use fd-based fchownat/chmod", " in hook_owner in libmount/src/hook_owner.c.", " - CVE-2026-53612", " * SECURITY UPDATE: Another local Privilege Escalation via TOCTOU in mount", " - debian/patches/CVE-2026-53613-pre1.patch: lib/fileutils: add", " ul_open_no_symlinks() in configure.ac, include/fileutils.h,", " lib/fileutils.c, meson.build.", " - debian/patches/CVE-2026-53613.patch: libmount: add fd_target to context", " for TOCTOU prevention in libmount/src/context.c,", " libmount/src/context_mount.c, libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c, libmount/src/mountP.h.", " - CVE-2026-53613", " * SECURITY UPDATE: Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2", " Environment Variable", " - debian/patches/CVE-2026-53614.patch: libmount: fix SUID bypass via", " LIBMOUNT_FORCE_MOUNT2 and legacy mount path in libmount/src/hook_mount.c,", " libmount/src/hook_mount_legacy.c.", " - CVE-2026-53614", " * SECURITY UPDATE: Integer Overflow or Wraparound in dos.c", " - debian/patches/CVE-2026-53615.patch: libblkid: dos: validate EBR data and", " links within extended partition in libblkid/src/partitions/dos.c.", " - CVE-2026-53615", "" ], "package": "util-linux", "version": "2.39.3-9ubuntu6.6", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 19 Aug 2026 12:47:51 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "zlib1g", "from_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg-3.1ubuntu2.1", "version": "1:1.3.dfsg-3.1ubuntu2.1" }, "to_version": { "source_package_name": "zlib", "source_package_version": "1:1.3.dfsg-3.1ubuntu2.2", "version": "1:1.3.dfsg-3.1ubuntu2.2" }, "cves": [ { "cve": "CVE-2026-27171", "url": "https://ubuntu.com/security/CVE-2026-27171", "cve_description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.", "cve_priority": "low", "cve_public_date": "2026-02-18 04:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-27171", "url": "https://ubuntu.com/security/CVE-2026-27171", "cve_description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.", "cve_priority": "low", "cve_public_date": "2026-02-18 04:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: resource consumption via infinite loop", " - debian/patches/CVE-2026-27171.patch: add negative length checks to", " crc32_combine64 and crc32_combine_gen64 functions in crc32.c", " - CVE-2026-27171", "" ], "package": "zlib", "version": "1:1.3.dfsg-3.1ubuntu2.2", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Chrisa Oikonomou ", "date": "Tue, 25 Aug 2026 13:41:30 +0300" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [ { "name": "linux-image-6.8.0-139-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "6.8.0-138.138", "version": null }, "to_version": { "source_package_name": "linux-signed", "source_package_version": "6.8.0-139.139", "version": "6.8.0-139.139" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 6.8.0-139.139", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-signed", "version": "6.8.0-139.139", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 1786013 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:26:05 +0200" } ], "notes": "linux-image-6.8.0-139-generic version '6.8.0-139.139' (source package linux-signed version '6.8.0-139.139') was added. linux-image-6.8.0-139-generic version '6.8.0-139.139' has the same source package name, linux-signed, as removed package linux-image-6.8.0-138-generic. As such we can use the source package version of the removed package, '6.8.0-138.138', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-modules-6.8.0-139-generic", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-138.138", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "6.8.0-139.139", "version": "6.8.0-139.139" }, "cves": [ { "cve": "CVE-2025-71289", "url": "https://ubuntu.com/security/CVE-2025-71289", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attr_set_size() errors when truncating files If attr_set_size() fails while truncating down, the error is silently ignored and the inode may be left in an inconsistent state.", "cve_priority": "medium", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-46315", "url": "https://ubuntu.com/security/CVE-2026-46315", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: clear waitid info before copying it to userspace IORING_OP_WAITID stores its result fields in struct io_waitid::info and later copies them to userspace siginfo. The prep path initializes the request arguments, but it does not initialize info itself. If the wait operation completes without reporting a child event, the common wait code can return without writing wo_info. In that case io_waitid_finish() still copies iw->info to userspace, exposing stale bytes from the reused io_kiocb command storage. Clear the result storage during prep so the io_uring path matches the regular waitid syscall, which uses a zero-initialized struct waitid_info.", "cve_priority": "medium", "cve_public_date": "2026-06-09 09:16:00 UTC" }, { "cve": "CVE-2026-31486", "url": "https://ubuntu.com/security/CVE-2026-31486", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) Protect regulator operations with mutex The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PMBus registers and shared data but were not protected by the update_lock mutex. This could lead to race conditions. However, adding mutex protection directly to these functions causes a deadlock because pmbus_regulator_notify() (which calls regulator_notifier_call_chain()) is often called with the mutex already held (e.g., from pmbus_fault_handler()). If a regulator callback then calls one of the now-protected voltage functions, it will attempt to acquire the same mutex. Rework pmbus_regulator_notify() to utilize a worker function to send notifications outside of the mutex protection. Events are stored as atomics in a per-page bitmask and processed by the worker. Initialize the worker and its associated data during regulator registration, and ensure it is cancelled on device removal using devm_add_action_or_reset(). While at it, remove the unnecessary include of linux/of.h.", "cve_priority": "medium", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-23469", "url": "https://ubuntu.com/security/CVE-2026-23469", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Synchronize interrupts before suspending the GPU The runtime PM suspend callback doesn't know whether the IRQ handler is in progress on a different CPU core and doesn't wait for it to finish. Depending on timing, the IRQ handler could be running while the GPU is suspended, leading to kernel crashes when trying to access GPU registers. See example signature below. In a power off sequence initiated by the runtime PM suspend callback, wait for any IRQ handlers in progress on other CPU cores to finish, by calling synchronize_irq(). At the same time, remove the runtime PM resume/put calls in the threaded IRQ handler. On top of not being the right approach to begin with, and being at the wrong place as they should have wrapped all GPU register accesses, the driver would hit a deadlock between synchronize_irq() being called from a runtime PM suspend callback, holding the device power lock, and the resume callback requiring the same. Example crash signature on a TI AM68 SK platform: [ 337.241218] SError Interrupt on CPU0, code 0x00000000bf000000 -- SError [ 337.241239] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241246] Tainted: [M]=MACHINE_CHECK [ 337.241249] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241252] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 337.241256] pc : pvr_riscv_irq_pending+0xc/0x24 [ 337.241277] lr : pvr_device_irq_thread_handler+0x64/0x310 [ 337.241282] sp : ffff800085b0bd30 [ 337.241284] x29: ffff800085b0bd50 x28: ffff0008070d9eab x27: ffff800083a5ce10 [ 337.241291] x26: ffff000806e48f80 x25: ffff0008070d9eac x24: 0000000000000000 [ 337.241296] x23: ffff0008068e9bf0 x22: ffff0008068e9bd0 x21: ffff800085b0bd30 [ 337.241301] x20: ffff0008070d9e00 x19: ffff0008068e9000 x18: 0000000000000001 [ 337.241305] x17: 637365645f656c70 x16: 0000000000000000 x15: ffff000b7df9ff40 [ 337.241310] x14: 0000a585fe3c0d0e x13: 000000999704f060 x12: 000000000002771a [ 337.241314] x11: 00000000000000c0 x10: 0000000000000af0 x9 : ffff800085b0bd00 [ 337.241318] x8 : ffff0008071175d0 x7 : 000000000000b955 x6 : 0000000000000003 [ 337.241323] x5 : 0000000000000000 x4 : 0000000000000002 x3 : 0000000000000000 [ 337.241327] x2 : ffff800080e39d20 x1 : ffff800080e3fc48 x0 : 0000000000000000 [ 337.241333] Kernel panic - not syncing: Asynchronous SError Interrupt [ 337.241337] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241342] Tainted: [M]=MACHINE_CHECK [ 337.241343] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241345] Call trace: [ 337.241348] show_stack+0x18/0x24 (C) [ 337.241357] dump_stack_lvl+0x60/0x80 [ 337.241364] dump_stack+0x18/0x24 [ 337.241368] vpanic+0x124/0x2ec [ 337.241373] abort+0x0/0x4 [ 337.241377] add_taint+0x0/0xbc [ 337.241384] arm64_serror_panic+0x70/0x80 [ 337.241389] do_serror+0x3c/0x74 [ 337.241392] el1h_64_error_handler+0x30/0x48 [ 337.241400] el1h_64_error+0x6c/0x70 [ 337.241404] pvr_riscv_irq_pending+0xc/0x24 (P) [ 337.241410] irq_thread_fn+0x2c/0xb0 [ 337.241416] irq_thread+0x170/0x334 [ 337.241421] kthread+0x12c/0x210 [ 337.241428] ret_from_fork+0x10/0x20 [ 337.241434] SMP: stopping secondary CPUs [ 337.241451] Kernel Offset: disabled [ 337.241453] CPU features: 0x040000,02002800,20002001,0400421b [ 337.241456] Memory Limit: none [ 337.457921] ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]---", "cve_priority": "medium", "cve_public_date": "2026-04-03 16:16:00 UTC" }, { "cve": "CVE-2026-31560", "url": "https://ubuntu.com/security/CVE-2026-31560", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: spi: spi-dw-dma: fix print error log when wait finish transaction If an error occurs, the device may not have a current message. In this case, the system will crash. In this case, it's better to use dev from the struct ctlr (struct spi_controller*).", "cve_priority": "medium", "cve_public_date": "2026-04-24 15:16:00 UTC" }, { "cve": "CVE-2026-31420", "url": "https://ubuntu.com/security/CVE-2026-31420", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bridge: mrp: reject zero test interval to avoid OOM panic br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied interval value from netlink without validation. When interval is 0, usecs_to_jiffies(0) yields 0, causing the delayed work (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule itself with zero delay. This creates a tight loop on system_percpu_wq that allocates and transmits MRP test frames at maximum rate, exhausting all system memory and causing a kernel panic via OOM deadlock. The same zero-interval issue applies to br_mrp_start_in_test_parse() for interconnect test frames. Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the netlink attribute parsing layer before the value ever reaches the workqueue scheduling code. This is consistent with how other bridge subsystems (br_fdb, br_mst) enforce range constraints on netlink attributes.", "cve_priority": "medium", "cve_public_date": "2026-04-13 14:16:00 UTC" }, { "cve": "CVE-2026-46275", "url": "https://ubuntu.com/security/CVE-2026-46275", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and lifecycle issues by: 1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and preventing the tx_skb double-free. 2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears down the state. 3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent vendor-level UAFs. 4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device unregistration. 5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before hci_uart_flush() is invoked via the HCI core. 6. Utilizing cancel_work_sync() instead of disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities.", "cve_priority": "high", "cve_public_date": "2026-06-08 16:16:00 UTC" }, { "cve": "CVE-2026-46170", "url": "https://ubuntu.com/security/CVE-2026-46170", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: free sk if last When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(), and released at the end. If at that moment, it was the last reference being held, the sk would not be freed. sock_put() should then be called instead of __sock_put(). But that's not enough: if it is the last reference, sock_put() will call sk_free(), which will end up calling sk_stop_timer_sync() on the same timer, and waiting indefinitely to finish. So it is needed to mark that the timer is done at the end of the timer handler when it has not been rescheduled, not to call sk_stop_timer_sync() on \"itself\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-46158", "url": "https://ubuntu.com/security/CVE-2026-46158", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end. Some (unlikely) checks were returning directly instead of calling sock_put() to decrease the refcount. Jump to a new 'exit' label to call __sock_put() (which will become sock_put() in the next commit) to fix this potential leak. While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as \"unlikely\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46242", "url": "https://ubuntu.com/security/CVE-2026-46242", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s \"*pprev = next\" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays.", "cve_priority": "high", "cve_public_date": "2026-05-30 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52931", "url": "https://ubuntu.com/security/CVE-2026-52931", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-52914", "url": "https://ubuntu.com/security/CVE-2026-52914", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service. Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs. The fix was verified against the original reproducer and against valid fragment reassembly paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-46325", "url": "https://ubuntu.com/security/CVE-2026-46325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > PAGE_SIZE: Split MR pages into multiple system pages - page_size <= PAGE_SIZE: Store offset within system page 4. Add boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access. Tests on 4K and 64K PAGE_SIZE hosts: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/", "cve_priority": "low", "cve_public_date": "2026-06-09 14:16:00 UTC" }, { "cve": "CVE-2026-43465", "url": "https://ubuntu.com/security/CVE-2026-43465", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The referenced commit in the fixes tag corrected the assumption in the mlx5 driver that the XDP buffer layout doesn't change during a program execution. However, this fix introduced another issue: the dropped fragments still need to be counted on the driver side to avoid page fragment reference counting issues. The issue was discovered by the drivers/net/xdp.py selftest, more specifically the test_xdp_native_tx_mb: - The mlx5 driver allocates a page_pool page and initializes it with a frag counter of 64 (pp_ref_count=64) and the internal frag counter to 0. - The test sends one packet with no payload. - On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP buffer with the packet data starting in the first fragment which is the page mentioned above. - The XDP program runs and calls bpf_xdp_pull_data() which moves the header into the linear part of the XDP buffer. As the packet doesn't contain more data, the program drops the tail fragment since it no longer contains any payload (pp_ref_count=63). - mlx5 device skips counting this fragment. Internal frag counter remains 0. - mlx5 releases all 64 fragments of the page but page pp_ref_count is 63 => negative reference counting error. Resulting splat during the test: WARNING: CPU: 0 PID: 188225 at ./include/net/page_pool/helpers.h:297 mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] Modules linked in: [...] CPU: 0 UID: 0 PID: 188225 Comm: ip Not tainted 6.18.0-rc7_for_upstream_min_debug_2025_12_08_11_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] [...] Call Trace: mlx5e_free_rx_mpwqe+0x20a/0x250 [mlx5_core] mlx5e_dealloc_rx_mpwqe+0x37/0xb0 [mlx5_core] mlx5e_free_rx_descs+0x11a/0x170 [mlx5_core] mlx5e_close_rq+0x78/0xa0 [mlx5_core] mlx5e_close_queues+0x46/0x2a0 [mlx5_core] mlx5e_close_channel+0x24/0x90 [mlx5_core] mlx5e_close_channels+0x5d/0xf0 [mlx5_core] mlx5e_safe_switch_params+0x2ec/0x380 [mlx5_core] mlx5e_change_mtu+0x11d/0x490 [mlx5_core] mlx5e_change_nic_mtu+0x19/0x30 [mlx5_core] netif_set_mtu_ext+0xfc/0x240 do_setlink.isra.0+0x226/0x1100 rtnl_newlink+0x7a9/0xba0 rtnetlink_rcv_msg+0x220/0x3c0 netlink_rcv_skb+0x4b/0xf0 netlink_unicast+0x255/0x380 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1e8/0x240 ___sys_sendmsg+0x7c/0xb0 [...] __sys_sendmsg+0x5f/0xb0 do_syscall_64+0x55/0xc70 The problem applies for XDP_PASS as well which is handled in a different code path in the driver. This patch fixes the issue by doing page frag counting on all the original XDP buffer fragments for all relevant XDP actions (XDP_TX , XDP_REDIRECT and XDP_PASS). This is basically reverting to the original counting before the commit in the fixes tag. As frag_page is still pointing to the original tail, the nr_frags parameter to xdp_update_skb_frags_info() needs to be calculated in a different way to reflect the new nr_frags.", "cve_priority": "low", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43197", "url": "https://ubuntu.com/security/CVE-2026-43197", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 (\"netconsole: convert to NBCON console infrastructure\") the message would be placed in printk_shared_pbufs, a static global buffer, so KASAN had harder time catching OOB accesses. Now we see: printk: console [netcon_ext0] enabled BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240 Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594 CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9 Call Trace: kasan_report+0xe4/0x120 string+0x1f7/0x240 vsnprintf+0x655/0xba0 scnprintf+0xba/0x120 netconsole_write+0x3fe/0xa10 nbcon_emit_next_record+0x46e/0x860 nbcon_kthread_func+0x623/0x750 Allocated by task 1: nbcon_alloc+0x1ea/0x450 register_console+0x26b/0xe10 init_netconsole+0xbb0/0xda0 The buggy address belongs to the object at ffff88813b6d4000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 0 bytes to the right of allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)", "cve_priority": "negligible", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43083", "url": "https://ubuntu.com/security/CVE-2026-43083", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.bit6) { ... queue = skb_get_tx_queue(dev, skb); qdisc = rcu_dereference(queue->qdisc); This code can lead to an out-of-bounds access of the dev->_tx[] array when is_input is true. In such a case, the packet is on the RX path and skb->queue_mapping contains the RX queue index of the ingress device. If the ingress device has more RX queues than the egress device (dev) has TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues. Add a check to avoid this situation since skb_get_tx_queue() does not clamp the index. This issue has also revealed that per queue visibility cannot be accurate and will be replaced later as a new feature. While at it, add missing lock around qdisc_qstats_qlen_backlog(). The function __ioam6_fill_trace_data() is called from both softirq and process contexts, hence the use of spin_lock_bh() here.", "cve_priority": "high", "cve_public_date": "2026-05-06 10:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2162466, 1786013, 2072994, 2159608, 2160302, 2158920, 2139686, 2158462, 2155609, 2142613, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250 ], "changes": [ { "cves": [ { "cve": "CVE-2025-71289", "url": "https://ubuntu.com/security/CVE-2025-71289", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attr_set_size() errors when truncating files If attr_set_size() fails while truncating down, the error is silently ignored and the inode may be left in an inconsistent state.", "cve_priority": "medium", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-46315", "url": "https://ubuntu.com/security/CVE-2026-46315", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: clear waitid info before copying it to userspace IORING_OP_WAITID stores its result fields in struct io_waitid::info and later copies them to userspace siginfo. The prep path initializes the request arguments, but it does not initialize info itself. If the wait operation completes without reporting a child event, the common wait code can return without writing wo_info. In that case io_waitid_finish() still copies iw->info to userspace, exposing stale bytes from the reused io_kiocb command storage. Clear the result storage during prep so the io_uring path matches the regular waitid syscall, which uses a zero-initialized struct waitid_info.", "cve_priority": "medium", "cve_public_date": "2026-06-09 09:16:00 UTC" }, { "cve": "CVE-2026-31486", "url": "https://ubuntu.com/security/CVE-2026-31486", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) Protect regulator operations with mutex The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PMBus registers and shared data but were not protected by the update_lock mutex. This could lead to race conditions. However, adding mutex protection directly to these functions causes a deadlock because pmbus_regulator_notify() (which calls regulator_notifier_call_chain()) is often called with the mutex already held (e.g., from pmbus_fault_handler()). If a regulator callback then calls one of the now-protected voltage functions, it will attempt to acquire the same mutex. Rework pmbus_regulator_notify() to utilize a worker function to send notifications outside of the mutex protection. Events are stored as atomics in a per-page bitmask and processed by the worker. Initialize the worker and its associated data during regulator registration, and ensure it is cancelled on device removal using devm_add_action_or_reset(). While at it, remove the unnecessary include of linux/of.h.", "cve_priority": "medium", "cve_public_date": "2026-04-22 14:16:00 UTC" }, { "cve": "CVE-2026-23469", "url": "https://ubuntu.com/security/CVE-2026-23469", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Synchronize interrupts before suspending the GPU The runtime PM suspend callback doesn't know whether the IRQ handler is in progress on a different CPU core and doesn't wait for it to finish. Depending on timing, the IRQ handler could be running while the GPU is suspended, leading to kernel crashes when trying to access GPU registers. See example signature below. In a power off sequence initiated by the runtime PM suspend callback, wait for any IRQ handlers in progress on other CPU cores to finish, by calling synchronize_irq(). At the same time, remove the runtime PM resume/put calls in the threaded IRQ handler. On top of not being the right approach to begin with, and being at the wrong place as they should have wrapped all GPU register accesses, the driver would hit a deadlock between synchronize_irq() being called from a runtime PM suspend callback, holding the device power lock, and the resume callback requiring the same. Example crash signature on a TI AM68 SK platform: [ 337.241218] SError Interrupt on CPU0, code 0x00000000bf000000 -- SError [ 337.241239] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241246] Tainted: [M]=MACHINE_CHECK [ 337.241249] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241252] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 337.241256] pc : pvr_riscv_irq_pending+0xc/0x24 [ 337.241277] lr : pvr_device_irq_thread_handler+0x64/0x310 [ 337.241282] sp : ffff800085b0bd30 [ 337.241284] x29: ffff800085b0bd50 x28: ffff0008070d9eab x27: ffff800083a5ce10 [ 337.241291] x26: ffff000806e48f80 x25: ffff0008070d9eac x24: 0000000000000000 [ 337.241296] x23: ffff0008068e9bf0 x22: ffff0008068e9bd0 x21: ffff800085b0bd30 [ 337.241301] x20: ffff0008070d9e00 x19: ffff0008068e9000 x18: 0000000000000001 [ 337.241305] x17: 637365645f656c70 x16: 0000000000000000 x15: ffff000b7df9ff40 [ 337.241310] x14: 0000a585fe3c0d0e x13: 000000999704f060 x12: 000000000002771a [ 337.241314] x11: 00000000000000c0 x10: 0000000000000af0 x9 : ffff800085b0bd00 [ 337.241318] x8 : ffff0008071175d0 x7 : 000000000000b955 x6 : 0000000000000003 [ 337.241323] x5 : 0000000000000000 x4 : 0000000000000002 x3 : 0000000000000000 [ 337.241327] x2 : ffff800080e39d20 x1 : ffff800080e3fc48 x0 : 0000000000000000 [ 337.241333] Kernel panic - not syncing: Asynchronous SError Interrupt [ 337.241337] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT [ 337.241342] Tainted: [M]=MACHINE_CHECK [ 337.241343] Hardware name: Texas Instruments AM68 SK (DT) [ 337.241345] Call trace: [ 337.241348] show_stack+0x18/0x24 (C) [ 337.241357] dump_stack_lvl+0x60/0x80 [ 337.241364] dump_stack+0x18/0x24 [ 337.241368] vpanic+0x124/0x2ec [ 337.241373] abort+0x0/0x4 [ 337.241377] add_taint+0x0/0xbc [ 337.241384] arm64_serror_panic+0x70/0x80 [ 337.241389] do_serror+0x3c/0x74 [ 337.241392] el1h_64_error_handler+0x30/0x48 [ 337.241400] el1h_64_error+0x6c/0x70 [ 337.241404] pvr_riscv_irq_pending+0xc/0x24 (P) [ 337.241410] irq_thread_fn+0x2c/0xb0 [ 337.241416] irq_thread+0x170/0x334 [ 337.241421] kthread+0x12c/0x210 [ 337.241428] ret_from_fork+0x10/0x20 [ 337.241434] SMP: stopping secondary CPUs [ 337.241451] Kernel Offset: disabled [ 337.241453] CPU features: 0x040000,02002800,20002001,0400421b [ 337.241456] Memory Limit: none [ 337.457921] ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]---", "cve_priority": "medium", "cve_public_date": "2026-04-03 16:16:00 UTC" }, { "cve": "CVE-2026-31560", "url": "https://ubuntu.com/security/CVE-2026-31560", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: spi: spi-dw-dma: fix print error log when wait finish transaction If an error occurs, the device may not have a current message. In this case, the system will crash. In this case, it's better to use dev from the struct ctlr (struct spi_controller*).", "cve_priority": "medium", "cve_public_date": "2026-04-24 15:16:00 UTC" }, { "cve": "CVE-2026-31420", "url": "https://ubuntu.com/security/CVE-2026-31420", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bridge: mrp: reject zero test interval to avoid OOM panic br_mrp_start_test() and br_mrp_start_in_test() accept the user-supplied interval value from netlink without validation. When interval is 0, usecs_to_jiffies(0) yields 0, causing the delayed work (br_mrp_test_work_expired / br_mrp_in_test_work_expired) to reschedule itself with zero delay. This creates a tight loop on system_percpu_wq that allocates and transmits MRP test frames at maximum rate, exhausting all system memory and causing a kernel panic via OOM deadlock. The same zero-interval issue applies to br_mrp_start_in_test_parse() for interconnect test frames. Use NLA_POLICY_MIN(NLA_U32, 1) in the nla_policy tables for both IFLA_BRIDGE_MRP_START_TEST_INTERVAL and IFLA_BRIDGE_MRP_START_IN_TEST_INTERVAL, so zero is rejected at the netlink attribute parsing layer before the value ever reaches the workqueue scheduling code. This is consistent with how other bridge subsystems (br_fdb, br_mst) enforce range constraints on netlink attributes.", "cve_priority": "medium", "cve_public_date": "2026-04-13 14:16:00 UTC" }, { "cve": "CVE-2026-46275", "url": "https://ubuntu.com/security/CVE-2026-46275", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and lifecycle issues by: 1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and preventing the tx_skb double-free. 2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears down the state. 3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent vendor-level UAFs. 4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device unregistration. 5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before hci_uart_flush() is invoked via the HCI core. 6. Utilizing cancel_work_sync() instead of disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities.", "cve_priority": "high", "cve_public_date": "2026-06-08 16:16:00 UTC" }, { "cve": "CVE-2026-46170", "url": "https://ubuntu.com/security/CVE-2026-46170", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: free sk if last When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(), and released at the end. If at that moment, it was the last reference being held, the sk would not be freed. sock_put() should then be called instead of __sock_put(). But that's not enough: if it is the last reference, sock_put() will call sk_free(), which will end up calling sk_stop_timer_sync() on the same timer, and waiting indefinitely to finish. So it is needed to mark that the timer is done at the end of the timer handler when it has not been rescheduled, not to call sk_stop_timer_sync() on \"itself\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-46158", "url": "https://ubuntu.com/security/CVE-2026-46158", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount When an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(). It should then be released in all cases at the end. Some (unlikely) checks were returning directly instead of calling sock_put() to decrease the refcount. Jump to a new 'exit' label to call __sock_put() (which will become sock_put() in the next commit) to fix this potential leak. While at it, drop the '!msk' check which cannot happen because it is never reset, and explicitly mark the remaining one as \"unlikely\".", "cve_priority": "medium", "cve_public_date": "2026-05-28 10:16:00 UTC" }, { "cve": "CVE-2026-64531", "url": "https://ubuntu.com/security/CVE-2026-64531", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff (\"net: openvswitch: remove misbehaving actions length check\") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.", "cve_priority": "high", "cve_public_date": "2026-07-27 08:16:00 UTC" }, { "cve": "CVE-2026-53247", "url": "https://ubuntu.com/security/CVE-2026-53247", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.", "cve_priority": "low", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53224", "url": "https://ubuntu.com/security/CVE-2026-53224", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53246", "url": "https://ubuntu.com/security/CVE-2026-53246", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53225", "url": "https://ubuntu.com/security/CVE-2026-53225", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 (\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").", "cve_priority": "negligible", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53228", "url": "https://ubuntu.com/security/CVE-2026-53228", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.", "cve_priority": "medium", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-46242", "url": "https://ubuntu.com/security/CVE-2026-46242", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s \"*pprev = next\" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays.", "cve_priority": "high", "cve_public_date": "2026-05-30 13:16:00 UTC" }, { "cve": "CVE-2026-46331", "url": "https://ubuntu.com/security/CVE-2026-46331", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined.", "cve_priority": "high", "cve_public_date": "2026-06-16 08:16:00 UTC" }, { "cve": "CVE-2026-53212", "url": "https://ubuntu.com/security/CVE-2026-53212", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53359", "url": "https://ubuntu.com/security/CVE-2026-53359", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due to unexpected GFN\") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.", "cve_priority": "high", "cve_public_date": "2026-07-04 12:17:00 UTC" }, { "cve": "CVE-2026-53151", "url": "https://ubuntu.com/security/CVE-2026-53151", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52924", "url": "https://ubuntu.com/security/CVE-2026-52924", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-53215", "url": "https://ubuntu.com/security/CVE-2026-53215", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM.", "cve_priority": "critical", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-53176", "url": "https://ubuntu.com/security/CVE-2026-53176", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added.", "cve_priority": "high", "cve_public_date": "2026-06-25 09:16:00 UTC" }, { "cve": "CVE-2026-52931", "url": "https://ubuntu.com/security/CVE-2026-52931", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.", "cve_priority": "medium", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-52914", "url": "https://ubuntu.com/security/CVE-2026-52914", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service. Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs. The fix was verified against the original reproducer and against valid fragment reassembly paths.", "cve_priority": "high", "cve_public_date": "2026-06-24 08:16:00 UTC" }, { "cve": "CVE-2026-46325", "url": "https://ubuntu.com/security/CVE-2026-46325", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > PAGE_SIZE: Split MR pages into multiple system pages - page_size <= PAGE_SIZE: Store offset within system page 4. Add boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access. Tests on 4K and 64K PAGE_SIZE hosts: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/", "cve_priority": "low", "cve_public_date": "2026-06-09 14:16:00 UTC" }, { "cve": "CVE-2026-43465", "url": "https://ubuntu.com/security/CVE-2026-43465", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The referenced commit in the fixes tag corrected the assumption in the mlx5 driver that the XDP buffer layout doesn't change during a program execution. However, this fix introduced another issue: the dropped fragments still need to be counted on the driver side to avoid page fragment reference counting issues. The issue was discovered by the drivers/net/xdp.py selftest, more specifically the test_xdp_native_tx_mb: - The mlx5 driver allocates a page_pool page and initializes it with a frag counter of 64 (pp_ref_count=64) and the internal frag counter to 0. - The test sends one packet with no payload. - On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP buffer with the packet data starting in the first fragment which is the page mentioned above. - The XDP program runs and calls bpf_xdp_pull_data() which moves the header into the linear part of the XDP buffer. As the packet doesn't contain more data, the program drops the tail fragment since it no longer contains any payload (pp_ref_count=63). - mlx5 device skips counting this fragment. Internal frag counter remains 0. - mlx5 releases all 64 fragments of the page but page pp_ref_count is 63 => negative reference counting error. Resulting splat during the test: WARNING: CPU: 0 PID: 188225 at ./include/net/page_pool/helpers.h:297 mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] Modules linked in: [...] CPU: 0 UID: 0 PID: 188225 Comm: ip Not tainted 6.18.0-rc7_for_upstream_min_debug_2025_12_08_11_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] [...] Call Trace: mlx5e_free_rx_mpwqe+0x20a/0x250 [mlx5_core] mlx5e_dealloc_rx_mpwqe+0x37/0xb0 [mlx5_core] mlx5e_free_rx_descs+0x11a/0x170 [mlx5_core] mlx5e_close_rq+0x78/0xa0 [mlx5_core] mlx5e_close_queues+0x46/0x2a0 [mlx5_core] mlx5e_close_channel+0x24/0x90 [mlx5_core] mlx5e_close_channels+0x5d/0xf0 [mlx5_core] mlx5e_safe_switch_params+0x2ec/0x380 [mlx5_core] mlx5e_change_mtu+0x11d/0x490 [mlx5_core] mlx5e_change_nic_mtu+0x19/0x30 [mlx5_core] netif_set_mtu_ext+0xfc/0x240 do_setlink.isra.0+0x226/0x1100 rtnl_newlink+0x7a9/0xba0 rtnetlink_rcv_msg+0x220/0x3c0 netlink_rcv_skb+0x4b/0xf0 netlink_unicast+0x255/0x380 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1e8/0x240 ___sys_sendmsg+0x7c/0xb0 [...] __sys_sendmsg+0x5f/0xb0 do_syscall_64+0x55/0xc70 The problem applies for XDP_PASS as well which is handled in a different code path in the driver. This patch fixes the issue by doing page frag counting on all the original XDP buffer fragments for all relevant XDP actions (XDP_TX , XDP_REDIRECT and XDP_PASS). This is basically reverting to the original counting before the commit in the fixes tag. As frag_page is still pointing to the original tail, the nr_frags parameter to xdp_update_skb_frags_info() needs to be calculated in a different way to reflect the new nr_frags.", "cve_priority": "low", "cve_public_date": "2026-05-08 15:16:00 UTC" }, { "cve": "CVE-2026-43198", "url": "https://ubuntu.com/security/CVE-2026-43198", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.", "cve_priority": "high", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43197", "url": "https://ubuntu.com/security/CVE-2026-43197", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 (\"netconsole: convert to NBCON console infrastructure\") the message would be placed in printk_shared_pbufs, a static global buffer, so KASAN had harder time catching OOB accesses. Now we see: printk: console [netcon_ext0] enabled BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240 Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594 CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9 Call Trace: kasan_report+0xe4/0x120 string+0x1f7/0x240 vsnprintf+0x655/0xba0 scnprintf+0xba/0x120 netconsole_write+0x3fe/0xa10 nbcon_emit_next_record+0x46e/0x860 nbcon_kthread_func+0x623/0x750 Allocated by task 1: nbcon_alloc+0x1ea/0x450 register_console+0x26b/0xe10 init_netconsole+0xbb0/0xda0 The buggy address belongs to the object at ffff88813b6d4000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 0 bytes to the right of allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)", "cve_priority": "negligible", "cve_public_date": "2026-05-06 12:16:00 UTC" }, { "cve": "CVE-2026-43083", "url": "https://ubuntu.com/security/CVE-2026-43083", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.bit6) { ... queue = skb_get_tx_queue(dev, skb); qdisc = rcu_dereference(queue->qdisc); This code can lead to an out-of-bounds access of the dev->_tx[] array when is_input is true. In such a case, the packet is on the RX path and skb->queue_mapping contains the RX queue index of the ingress device. If the ingress device has more RX queues than the egress device (dev) has TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues. Add a check to avoid this situation since skb_get_tx_queue() does not clamp the index. This issue has also revealed that per queue visibility cannot be accurate and will be replaced later as a new feature. While at it, add missing lock around qdisc_qstats_qlen_backlog(). The function __ioam6_fill_trace_data() is called from both softirq and process contexts, hence the use of spin_lock_bh() here.", "cve_priority": "high", "cve_public_date": "2026-05-06 10:16:00 UTC" } ], "log": [ "", " * noble/linux: 6.8.0-139.139 -proposed tracker (LP: #2162466)", "", " * Packaging resync (LP: #1786013)", " - [Packaging] update annotations scripts", " - [Packaging] debian.master/dkms-versions -- update from kernel-versions", " (main/2026.08.03)", "", " * kselftests_net.net:test_bpf.sh fails on ppc64el (LP: #2072994)", " - powerpc64/bpf: jit support for 32bit offset jmp instruction", " - powerpc64/bpf: jit support for unconditional byte swap", " - powerpc64/bpf: jit support for sign extended load", " - powerpc64/bpf: jit support for sign extended mov", " - powerpc64/bpf: jit support for signed division and modulo", "", " * noble/linux-raspi FTBFS: bcmasp phylib managed-EEE backport missing", " prerequisites (LP: #2159608)", " - SAUCE: Revert \"net: bcm: asp2: convert to phylib managed EEE\"", " - SAUCE: Revert \"net: bcm: asp2: remove tx_lpi_enabled\"", " - SAUCE: Revert \"net: bcm: asp2: fix LPI timer handling\"", "", " * Drop DEP-8 tests from kernel packages (LP: #2160302)", " - [Packaging] Drop DEP-8 tests from kernel source", "", " * noble-stable-2026-06-16 dropped a bracket causing FTBFS (LP: #2158920)", " - SAUCE: drm/v3d: Fix bracket drop FTBFS for non-generic kernels", "", " * ubuntu_bpf failed to build on Noble ( error: ‘XDP_UMEM_TX_METADATA_LEN’", " undeclared ) (LP: #2139686)", " - selftests/bpf: Add XDP_UMEM_TX_METADATA_LEN to XSK TX metadata test", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * net/tls: Three upstream fixes without CVE missing from Ubuntu", " 6.8.0-124-generic (LP: #2155609)", " - net: tls: fix silent data drop under pipe back-pressure", "", " * net:fcnal-test.sh fails because it can't find wait_local_port_listen on", " noble (LP: #2142613)", " - selftests: net: move wait_local_port_listen to lib.sh", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250)", " - mptcp: sync the msk->sndbuf at accept() time", " - mptcp: pm: ADD_ADDR rtx: allow ID 0", " - s390/debug: Reject zero-length input before trimming a newline", " - Revert \"x86/vdso: Fix output operand size of RDPID\"", " - Revert \"s390/cio: Update purge function to unregister the unused", " subchannels\"", " - sysfs: don't remove existing directory on update failure", " - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()", " - smb: client: protect tc_count increment in", " smb2_find_smb_sess_tcon_unlocked()", " - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close", " - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX", " - ALSA: ua101: Reject too-short USB descriptors", " - ALSA: pcm: Don't setup bogus iov_iter for silencing", " - ALSA: asihpi: Fix potential OOB array access at reading cache", " - efi: Allocate runtime workqueue before ACPI init", " - drivers/base/memory: fix memory block reference leak in poison", " accounting", " - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()", " - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()", " - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START", " - Bluetooth: bnep: Fix UAF read of dev->name", " - Bluetooth: MGMT: validate Add Extended Advertising Data length", " - Bluetooth: serialize accept_q access", " - phonet/pep: disable BH around forwarded sk_receive_skb()", " - net: bcmgenet: keep RBUF EEE/PM disabled", " - net: ifb: report ethtool stats over num_tx_queues", " - netfilter: ip6t_hbh: reject oversized option lists", " - netfilter: nf_queue: hold bridge skb->dev while queued", " - netfilter: ipset: stop hash:* range iteration at end", " - qed: fix double free in qed_cxt_tables_alloc()", " - ring-buffer: Fix reporting of missed events in iterator", " - vsock/vmci: fix UAF when peer resets connection during handshake", " - vsock/virtio: reset connection on receiving queue overflow", " - wifi: ath11k: clear shared SRNG pointer state on restart", " - ipv4: raw: reject IP_HDRINCL packets with ihl < 5", " - ixgbevf: fix use-after-free in VEPA multicast source pruning", " - ice: fix setting promisc mode while adding VID filter", " - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()", " - cifs: Fix busy dentry used after unmounting", " - tracing: Do not call map->ops->elt_free() if elt_alloc() fails", " - arm64: probes: Handle probes on hinted conditional branch instructions", " - KVM: arm64: vgic-its: Reject restored DTE with out-of-range", " num_eventid_bits", " - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe", " - spi: qup: fix error pointer deref after DMA setup failure", " - phy: tegra: xusb: Fix per-pad high-speed termination calibration", " - scsi: isci: Fix use-after-free in device removal path", " - spi: sprd: fix error pointer deref after DMA setup failure", " - spi: ti-qspi: fix use-after-free after DMA setup failure", " - RDMA/siw: Reject MPA FPDU length underflow before signed receive math", " - LoongArch: Remove unused code to avoid build warning", " - device property: set fwnode->secondary to NULL in fwnode_init()", " - drm/virtio: use uninterruptible resv lock for plane updates", " - drm/bridge: it66121: acquire reset GPIO in probe", " - drm/bridge: megachips: remove bridge when irq request fails", " - drm/amd/display: Fix integer overflow in bios_get_image()", " - drm/amd/display: Validate GPIO pin LUT table size before iterating", " - drm/amd/display: Validate payload length and link_index in", " dc_process_dmub_aux_transfer_async", " - batman-adv: mcast: fix use-after-free in orig_node RCU release", " - batman-adv: clear current gateway during teardown", " - batman-adv: dat: handle forward allocation error", " - batman-adv: fix tp_meter counter underflow during shutdown", " - batman-adv: frag: disallow unicast fragment in fragment", " - batman-adv: bla: fix report_work leak on backbone_gw purge", " - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown", " - batman-adv: tp_meter: fix race condition in send error reporting", " - batman-adv: tt: fix negative last_changeset_len", " - batman-adv: tt: fix negative tt_buff_len", " - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock", " - hwmon: (pmbus/adm1266) reject implausible blackbox record_count", " - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer", " - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized", " buffer", " - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR", " - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in", " get_multiple", " - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()", " - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()", " - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO", " accessors", " - HID: uclogic: Fix regression of input name assignment", " - firmware: arm_ffa: Check for NULL FF-A ID table while driver", " registration", " - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure", " - kunit: config: Enable KUNIT_DEBUGFS by default", " - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS", " - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150", " - ARM: integrator: Fix early initialization", " - ALSA: hda: cs35l56: Put ACPI device after setting companion", " - netfilter: x_tables: unregister the templates first", " - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()", " - test_kprobes: clear kprobes between test runs", " - tcp: Fix imbalanced icsk_accept_queue count.", " - ice: fix locking in ice_dcb_rebuild()", " - net: lan966x: avoid unregistering netdev on register failure", " - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register", " access", " - irqchip/ath79-cpu: Remove unused function", " - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT", " - zonefs: handle integer overflow in zonefs_fname_to_fno", " - netfs: Fix overrun check in netfs_extract_user_iter()", " - net: ethernet: cortina: Make RX SKB per-port", " - net: ethernet: cortina: Drop half-assembled SKB", " - net: ethernet: cortina: Carry over frag counter", " - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference", " - wifi: ath11k: fix error path leaks in some WMI WOW calls", " - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()", " - accel/qaic: Add overflow check to remap_pfn_range during mmap", " - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint", " - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics", " - drm/msm/dsi: don't dump registers past the mapped region", " - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN", " - powerpc/time: Remove redundant preempt_disable|enable() calls from", " arch_irq_work_raise()", " - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot", " - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring", " - net: tls: prevent chain-after-chain in plain text SG", " - net: phy: DP83TC811: add reading of abilities", " - x86/xen: Fix xen_e820_swap_entry_with_ram()", " - tls: Preserve sk_err across recvmsg() when data has been copied", " - net/mlx5: Do not restore destination-less TC rules", " - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()", " - drm/msm/snapshot: fix dumping of the unaligned regions", " - wifi: ath11k: fix peer resolution on rx path when peer_id=0", " - net: dsa: mt7530: fix FDB entries not aging out with short timeout", " - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw", " - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames", " - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer", " - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL", " - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL", " - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL", " - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL", " - RDMA/rtrs: Fix use-after-free in path file creation cleanup", " - net: bridge: Flush multicast groups when snooping is disabled", " - bridge: mcast: Fix a possible use-after-free when removing a bridge port", " - pds_core: fix error handling in pdsc_devcmd_wait", " - pds_core: fix debugfs_lookup dentry leak and error handling", " - ALSA: seq: ump: Use guard() for locking", " - ALSA: seq: Serialize UMP output teardown with event_input", " - Bluetooth: btmtk: add the function to get the fw name", " - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset", " - Bluetooth: btmtk: rename btmediatek_data", " - Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c", " - Bluetooth: btmtk: fix urb->setup_packet leak in error paths", " - net: ag71xx: check error for platform_get_irq", " - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx", " - string: add mem_is_zero() helper to check if memory area is all zeros", " - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)", " - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed", " - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()", " - net: mana: validate rx_req_idx to prevent out-of-bounds array access", " - pds_core: ensure null-termination for firmware version strings", " - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions", " - security/keys: fix missed RCU read section on lookup", " - ata: libata-scsi: improve readability of ata_scsi_qc_issue()", " - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT", " - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS", " - ata: libata-scsi: do not needlessly defer commands when using PMP with", " FBS", " - perf parse-events: Expose/rename config_term_name", " - net/mlx5e: Trigger neighbor resolution for unresolved destinations", " - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC", " init", " - ksmbd: validate SID in parent security descriptor during ACL inheritance", " - smb: client: require net admin for CIFS SWN netlink", " - smb: client: use data_len for SMB2 READ encrypted folioq copy", " - mm/memory_hotplug: fix memory block reference leak on remove", " - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer", " - cgroup/cpuset: Reset DL migration state on can_attach() failure", " - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()", " - lsm: hold cred_guard_mutex for lsm_set_self_attr()", " - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index", " - ice: restore PTP Rx timestamp config after ethtool set-channels", " - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()", " - ARM: dts: renesas: genmai: Drop superfluous cells", " - ARM: dts: renesas: rskrza1: Drop superfluous cells", " - riscv: mm: Fixup no5lvl failure when vaddr is invalid", " - ALSA: hda: cs35l41: Put ACPI device on missing physical node", " - ice: fix setting RSS VSI hash for E830", " - tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().", " - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST", " - netfs: Fix trimming of streaming-write folios in netfs_inval_folio()", " - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes", " gone", " - wifi: ath10k: skip WMI and beacon transmission when device is wedged", " - scsi: sd: Fix return code handling in sd_spinup_disk()", " - ALSA: scarlett2: Add missing error check when initialise Autogain Status", " - btrfs: fix squota accounting during enable generation", " - landlock: Fix TCP handling of short AF_UNSPEC addresses", " - Upstream stable to v6.6.142, v6.12.92", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2025-71289", " - fs/ntfs3: handle attr_set_size() errors when truncating files", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46315", " - io_uring/waitid: clear waitid info before copying it to userspace", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-31486", " - hwmon: (pmbus/core) Protect regulator operations with mutex", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-23469", " - drm/imagination: Synchronize interrupts before suspending the GPU", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-31560", " - spi: spi-dw-dma: fix print error log when wait finish transaction", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-31420", " - bridge: mrp: reject zero test interval to avoid OOM panic", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46275", " - Bluetooth: hci_uart: fix UAFs and race conditions in close and init", " paths", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46170", " - mptcp: pm: ADD_ADDR rtx: free sk if last", "", " * Noble update: upstream stable patchset 2026-07-09 (LP: #2160250) //", " CVE-2026-46158", " - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount", "", " * CVE-2026-64531", " - net: openvswitch: reject oversized nested action attrs", "", " * CVE-2026-53247", " - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown", "", " * CVE-2026-53224", " - sctp: validate embedded INIT chunk and address list lengths in cookie", "", " * CVE-2026-53246", " - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing", "", " * CVE-2026-53225", " - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()", "", " * CVE-2026-53228", " - ipv6: sit: reload inner IPv6 header after GSO offloads", "", " * CVE-2026-46242", " - eventpoll: fix ep_remove struct eventpoll / struct file UAF", "", " * CVE-2026-46331", " - net/sched: fix pedit partial COW leading to page cache corruption", "", " * CVE-2026-53212", " - netfilter: nft_tunnel: fix use-after-free on object destroy", "", " * CVE-2026-53359", " - KVM: x86: Fix shadow paging use-after-free due to unexpected role", "", " * CVE-2026-53151", " - rxrpc: Fix the ACK parser to extract the SACK table for parsing", "", " * CVE-2026-52924", " - sctp: purge outqueue on stale COOKIE-ECHO handling", "", " * CVE-2026-53215", " - net: mvpp2: refill RX buffers before XDP or skb use", "", " * CVE-2026-53176", " - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN", "", " * CVE-2026-52931", " - batman-adv: tp_meter: avoid use of uninit sender vars", "", " * CVE-2026-52914", " - batman-adv: fix fragment reassembly length accounting", "", " * CVE-2026-46325", " - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE", "", " * CVE-2026-43465", " - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ", "", " * CVE-2026-43198", " - tcp: fix potential race in tcp_v6_syn_recv_sock()", "", " * CVE-2026-43197", " - netconsole: avoid OOB reads, msg is not nul-terminated", "", " * CVE-2026-43083", " - net: ioam6: fix OOB and missing lock", "" ], "package": "linux", "version": "6.8.0-139.139", "urgency": "medium", "distributions": "noble", "launchpad_bugs_fixed": [ 2162466, 1786013, 2072994, 2159608, 2160302, 2158920, 2139686, 2158462, 2155609, 2142613, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250, 2160250 ], "author": "Edoardo Canepa ", "date": "Sat, 01 Aug 2026 04:25:37 +0200" } ], "notes": "linux-modules-6.8.0-139-generic version '6.8.0-139.139' (source package linux version '6.8.0-139.139') was added. linux-modules-6.8.0-139-generic version '6.8.0-139.139' has the same source package name, linux, as removed package linux-modules-6.8.0-138-generic. As such we can use the source package version of the removed package, '6.8.0-138.138', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false } ], "snap": [] }, "removed": { "deb": [ { "name": "linux-image-6.8.0-138-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-modules-6.8.0-138-generic", "from_version": { "source_package_name": "linux", "source_package_version": "6.8.0-138.138", "version": "6.8.0-138.138" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "notes": "Changelog diff for Ubuntu 24.04 noble image from release image serial 20260826 to 20260905", "from_series": "noble", "to_series": "noble", "from_serial": "20260826", "to_serial": "20260905", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }