CVE-2006-0056: Pam-MySQL

High severity, CVSS 7.5. EPSS: 6.3% chance of exploitation in the next 30 days.

Double free vulnerability in the authentication and authentication token alteration code in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords, which lead to a double free of a pointer that was created by the pam_get_item function. NOTE: this issue only occurs in certain configurations in which there are multiple PAM modules, PAM-MySQL is not evaluated first, and there are no requisite modules before PAM-MySQL.

Affected products

• Pam-MySQL Pam-MySQL: version 0.1 only; version 0.2 only; version 0.3 only; version 0.4 only; version 0.4.7 only; version 0.5 only; …

Published 2006-02-13. Last modified 2026-06-16.