CVE-2004-2394: Undefined Security Weakness

Off-by-one error in passwd 0.68 and earlier, when using the --stdin option, causes passwd to use the first 78 characters of a password instead of the first 79, which results in a small reduction of the search space required for brute force attacks...

CVE-2004-2396: Undefined Security Weakness

passwd 0.68 does not check the return code for the pamstart function, which has unknown impact and attack vectors that may prevent "safe and proper operation" of PAM...