CVE-2005-2977: Pam

Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days.

The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unix_chkpwd, which does not log failed guesses or delay its responses.

Affected products

• Pam Pam: up to and including 0.80

Published 2005-11-01. Last modified 2026-06-16.