CVEvulnerability

CVE-2006-0056

7.5 HIGH Published 2006-02-13 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2006-02-13
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-119

Description

Double free vulnerability in the authentication and authentication token alteration code in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords, which lead to a double free of a pointer that was created by the pam_get_item function. NOTE: this issue only occurs in certain configurations in which there are multiple PAM modules, PAM-MySQL is not evaluated first, and there are no requisite modules before PAM-MySQL.

Affected configurations

• pam-mysql pam-mysql 0.1 • pam-mysql pam-mysql 0.2 • pam-mysql pam-mysql 0.3 • pam-mysql pam-mysql 0.4 • pam-mysql pam-mysql 0.4.7 • pam-mysql pam-mysql 0.5 • pam-mysql pam-mysql 0.6 • pam-mysql pam-mysql 0.7 pre1 • pam-mysql pam-mysql 0.7 pre2

Related

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References