Every CVE Search/ Get API key

CVE-2010-4707

The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and...

4.9 MediumFix available

The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service (resource consumption) via a special file.

Exploit likelihood

0.36%Down 0.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.9

The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service (resource consumption) via a special file.

Record
CVE-2010-4707
CVSS 2.0
4.9 MediumAV:L/AC:L/Au:N/C:C/I:N/A:N
Weakness
CWE-399
Updated
2026-11-02
CVE List No score

The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service (resource consumption) via a special file.

Record
CVE-2010-4707
Updated
2026-11-02
EUVDEUVD-2010-4672 No score

The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service (resource consumption) via a special file.

Record
EUVD-2010-4672
Updated
2026-11-03
GitHub AdvisoriesGHSA-frff-99c9-q6rc No score

The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and...

The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service (resource consumption) via a special file.

Record
GHSA-frff-99c9-q6rc
Updated
2026-11-02
OSVBELL-CVE-2010-4707 4.9

CVE-2010-4707 does not affect BellSoft software

Record
BELL-CVE-2010-4707
CVSS 2.0
4.9 MediumAV:L/AC:L/Au:N/C:C/I:N/A:N
Updated
2026-11-02
OSV No score

The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service (resource consumption) via a special file.

Record
CVE-2010-4707
Updated
2026-11-02
OSVDEBIAN-CVE-2010-4707 No score

The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service (resource consumption) via a special file.

Record
DEBIAN-CVE-2010-4707
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pam
Debian:12
 before 1.1.3-1
1.1.3-1
pam
Debian:13
 before 1.1.3-1
1.1.3-1
pam
Debian:14
 before 1.1.3-1
1.1.3-1
pam
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.99.6.2-6.el5_5.2
0:0.99.6.2-6.el5_5.2
pam-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.99.6.2-6.el5_5.2
0:0.99.6.2-6.el5_5.2
pam-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.99.6.2-6.el5_5.2
0:0.99.6.2-6.el5_5.2
pam
Red Hat:enterprise_linux:5::client
 before 0:0.99.6.2-6.el5_5.2
0:0.99.6.2-6.el5_5.2
pam-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:0.99.6.2-6.el5_5.2
0:0.99.6.2-6.el5_5.2
pam
Red Hat:enterprise_linux:5::server
 before 0:0.99.6.2-6.el5_5.2
0:0.99.6.2-6.el5_5.2
pam-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:0.99.6.2-6.el5_5.2
0:0.99.6.2-6.el5_5.2
Show 13 moreShow less
Affected packages
PackageAffectedFixed
pam-devel
Red Hat:enterprise_linux:5::server
 before 0:0.99.6.2-6.el5_5.2
0:0.99.6.2-6.el5_5.2
pam
Red Hat:enterprise_linux:6::client
 before 0:1.1.1-4.el6_0.1
0:1.1.1-4.el6_0.1
pam-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:1.1.1-4.el6_0.1
0:1.1.1-4.el6_0.1
pam-devel
Red Hat:enterprise_linux:6::client
 before 0:1.1.1-4.el6_0.1
0:1.1.1-4.el6_0.1
pam
Red Hat:enterprise_linux:6::computenode
 before 0:1.1.1-4.el6_0.1
0:1.1.1-4.el6_0.1
pam-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:1.1.1-4.el6_0.1
0:1.1.1-4.el6_0.1
pam-devel
Red Hat:enterprise_linux:6::computenode
 before 0:1.1.1-4.el6_0.1
0:1.1.1-4.el6_0.1
pam
Red Hat:enterprise_linux:6::server
 before 0:1.1.1-4.el6_0.1
0:1.1.1-4.el6_0.1
pam-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:1.1.1-4.el6_0.1
0:1.1.1-4.el6_0.1
pam-devel
Red Hat:enterprise_linux:6::server
 before 0:1.1.1-4.el6_0.1
0:1.1.1-4.el6_0.1
pam
Red Hat:enterprise_linux:6::workstation
 before 0:1.1.1-4.el6_0.1
0:1.1.1-4.el6_0.1
pam-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:1.1.1-4.el6_0.1
0:1.1.1-4.el6_0.1
pam-devel
Red Hat:enterprise_linux:6::workstation
 before 0:1.1.1-4.el6_0.1
0:1.1.1-4.el6_0.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2010-4707 is a medium vulnerability (CVSS 4.9) in Linux-pam, published January 24, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in pam 1.1.3-1.

References

Show 29 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open