Amazon Linux 2023 : liboath, liboath-devel, libpskc (ALAS2023-2024-722)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-722 advisory. oath-toolkit: Local root exploit in a PAM module CVE-2024-47191 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested...

liboath-devel-2.6.11.12-1.1 on GA media (moderate)

liboath-devel-2.6.11.12-1.1 on GA media Announcement ID: openSUSE-SU-2024:14389-1 Rating: moderate Cross-References: CVE-2024-47191 CVSS scores: CVE-2024-47191 SUSE : 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVE-2024-47191 SUSE : 7.2...

OPENSUSE-SU-2024:14389-1 liboath-devel-2.6.11.12-1.1 on GA media

These are all security issues fixed in the liboath-devel-2.6.11.12-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11104-1 liboath-devel-2.6.7-1.3 on GA media

These are all security issues fixed in the liboath-devel-2.6.7-1.3 package on the GA media of openSUSE Tumbleweed...

CVE-2013-7322

usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password OTP type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay...

CVE-2013-7322

usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password OTP type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay...

Deserialization of untrusted data

usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password OTP type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay...

CVE-2013-7322

usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password OTP type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay...

CVE-2013-7322

CVE-2013-7322 affects the OATH Toolkit, specifically the liboath component (usersfile.c). The issue arises when processing an invalid OTP type and a username in /etc/users.oath, causing the wrong line to be updated during OTP invalidation. This can enable context-dependent attackers to perform re...