CVE-2018-9275
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2018-9275
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through 2.25, successful logins can leak file descriptors to the auth mapping file, which can lead to information disclosure (serial number of a device) and/or DoS (reaching the maximum number of file descriptors).
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Yubico PAM模块信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Yubico PAM module（又名pam_yubico）是一个PAM身份认证模块，它能够将YubiKey集成到现有用户认证基础设施中。 Yubico PAM模块 2.18版本至2.25版本中的util.c文件的check_user_token中存在信息泄露漏洞，该漏洞源于登陆成功可能会导致文件描述符泄露到auth映射文件中。攻击者可利用该漏洞泄露信息（设备序列号）和/或造成拒绝服务（达到文件描述符的最大数量）。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2018-9275
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-9275
Please Login to view more intelligence information
- https://bugzilla.opensuse.org/show_bug.cgi?id=1088027x_refsource_CONFIRM
- https://github.com/Yubico/yubico-pam/issues/136x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2018-9275
Same Patch Batch · n/a · 2018-04-04 · 51 CVEs total
| CVE-2018-6873 | Auth0 authentication service 安全漏洞 | |
| CVE-2018-9035 | WordPress Contact Form 7 to Database Extension插件输入验证错误漏洞 | |
| CVE-2018-1002150 | Koji 访问控制错误漏洞 | |
| CVE-2018-9303 | Exiv2 输入验证错误漏洞 | |
| CVE-2018-9304 | Exiv2 安全漏洞 | |
| CVE-2018-9305 | Exiv2 缓冲区错误漏洞 | |
| CVE-2018-9307 | dsmall 跨站脚本漏洞 | |
| CVE-2018-9285 | 多款ASUS产品操作系统命令注入漏洞 | |
| CVE-2016-8487 | Android Qualcomm组件权限许可和访问控制漏洞 | |
| CVE-2018-6874 | Auth0 authentication service 跨站请求伪造漏洞 | |
| CVE-2018-9284 | D-Link DIR-868L设备缓冲区错误漏洞 | |
| CVE-2017-18257 | Linux kernel 安全漏洞 | |
| CVE-2018-9249 | FiberHome VDSL2 Modem HG 150-UB 安全漏洞 | |
| CVE-2018-9248 | FiberHome VDSL2 Modem HG 150-UB 安全漏洞 | |
| CVE-2018-8814 | WolfCMS 跨站请求伪造漏洞 | |
| CVE-2018-8813 | WolfCMS 安全漏洞 | |
| CVE-2018-9274 | Wireshark 安全漏洞 | |
| CVE-2018-9273 | Wireshark 安全漏洞 | |
| CVE-2018-9272 | Wireshark 安全漏洞 | |
| CVE-2018-9271 | Wireshark 安全漏洞 |
Showing top 20 of 51 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: n/a
- CVE-2026-8196
JeecgBoot mLogin Endpoint LoginController.java authorization - CVE-2026-8195
JeecgBoot SVG File CommonController.java cross site scriptin - CVE-2026-8194
osTicket Dispatcher class.dispatcher.php cross-site request - CVE-2026-8193
Akaunting Invoice PDF Rendering dompdf.php server-side reque - CVE-2026-8186
Open5GS NF client.c ogs_sbi_client_send_via_scp_or_sepp out-
V. Comments for CVE-2018-9275
No comments yet