CVE-2020-27678: Illumos

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_user_name in lib/libpam/pam_framework.c.

Affected products

• Illumos Illumos: before 2020-10-22 (fixed in 2020-10-22)
• Joyent Smartos: before 20201022 (fixed in 20201022)
• Omniosce Omnios: before r151030by (fixed in r151030by); from r151032, up to and including r151032ay; from r151034, before r151034y (fixed in r151034y)

Published 2020-10-26. Last modified 2026-06-17.