https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 00:12:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-328612 EUVD-2026-328612 https://cve.radiocsirt.org/vuln/euvd-2026-328612 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48985 <p>pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_loginctl_local() can cause a NULL dereference crash when parsing loginctl output. The function calls popen() and reads the result; if the Remote field is only a newline, fgets() succeeds but strtok_r(buf, &#34;\n&#34;, &amp;saveptr) returns NULL. A subsequent strcmp(is_remote, &#34;no&#34;) then dereferences NULL, causing undefined behavior (typically SIGSEGV) and crashing the PAM module. This can crash the authenticating process (e.g., sudo, login) and, depending on PAM stack configuration, deny access for all users of the affected service. This issue has been fixed in version 0.9.2.</p> <p>pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_loginctl_local() can cause a NULL dereference crash when parsing loginctl output. The function calls popen() and reads the result; if the Remote field is only a newline, fgets() succeeds but strtok_r(buf, &#34;\n&#34;, &amp;saveptr) returns NULL. A subsequent strcmp(is_remote, &#34;no&#34;) then dereferences NULL, causing undefined behavior (typically SIGSEGV) and crashing the PAM module. This can crash the authenticating process (e.g., sudo, login) and, depending on PAM stack configuration, deny access for all users of the affected service. This issue has been fixed in version 0.9.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48985