|Date: (C)2009-03-12 (M)2017-08-18|
|CVSS Score: 6.6||Access Vector: LOCAL|
|Exploitability Subscore: 2.7||Access Complexity: MEDIUM|
|Impact Subscore: 10.0||Authentication: SINGLE_INSTANCE|
| ||Confidentiality: COMPLETE|
| ||Integrity: COMPLETE|
| ||Availability: COMPLETE|
Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.