CVE-2011-3149: Linux-Pam

Low severity, CVSS 2.1. EPSS: 0.5% chance of exploitation in the next 30 days.

The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).

Affected products

• Linux-Pam Linux-Pam: up to and including 1.1.4; version 0.99.1.0 only; version 0.99.2.0 only; version 0.99.2.1 only; version 0.99.3.0 only; version 0.99.4.0 only; …

Published 2012-07-22. Last modified 2026-06-16.