CVE catalog

CVE-2005-4713

pam-mysql: CVE-2005-4713

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.90% · Oct 25, 2026

Unspecified vulnerability in the SQL logging facility in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors, probably involving the pam_mysql_sql_log function when being used in vsftpd, which does not include the IP address argument to an sprintf call.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpam-mysqlsid0.8.2-3fixed
Debianpam-mysqlforky0.8.2-3fixed
Debianpam-mysqltrixie0.8.2-2.1fixed
Debianpam-mysqlbookworm0.8.2-2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpam-mysqlsourcesid0.6.2-1lowNot reported[353589]
Debianpam-mysqlsourceforky0.6.2-1lowNot reported[353589]
Debianpam-mysqlsourcetrixie0.6.2-1lowNot reported[353589]
Debianpam-mysqlsourcebookworm0.6.2-1lowNot reported[353589]

[Debian bug #353589]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libpam-mysql]Fixed

    Source package: [pam-mysql]

    Details (2)

    • 0.8.2-2 · amd64 · bookworm

      Fixed · Fixed: 0.6.2-1

      dsa · pam-mysql · debian · bookworm; dsa · pam-mysql · debian · 12

    • 0.8.2-2 · arm64 · bookworm

      Fixed · Fixed: 0.6.2-1

      dsa · pam-mysql · debian · bookworm; dsa · pam-mysql · debian · 12

[Debian 13 (Trixie)]

  • [libpam-mysql]Fixed

    Source package: [pam-mysql]

    Details (2)

    • 0.8.2-2.1+b2 · amd64 · trixie

      Fixed · Fixed: 0.6.2-1

      dsa · pam-mysql · debian · 13

    • 0.8.2-2.1+b2 · arm64 · trixie

      Fixed · Fixed: 0.6.2-1

      dsa · pam-mysql · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]