Protecting Privacy Build Trust

Protecting Privacy Build Trust
Menu
  • Contact Us
Request Demo
Protecting Privacy Build Trust

CyberSecurity

on June 16, 2026 at 8:01 am — CVE-2026-54411 Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module’s plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate’s length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext. 

Leave a Comment / Threats & Vulnerabilities /

Information published. 

on June 16, 2026 at 8:01 am — CVE-2026-54411 Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module’s plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate’s length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.  Read More »

on June 15, 2026 at 2:00 pm — Chromium: CVE-2026-12016 Insufficient validation of untrusted input  DevTools 

Leave a Comment / Threats & Vulnerabilities /

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/search/label/Desktop%20Update) for more information. 

on June 15, 2026 at 2:00 pm — Chromium: CVE-2026-12016 Insufficient validation of untrusted input  DevTools  Read More »

on June 15, 2026 at 2:00 pm — Chromium: CVE-2026-12008 Use after free  DigitalCredentials 

Leave a Comment / Threats & Vulnerabilities /

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/search/label/Desktop%20Update) for more information. 

on June 15, 2026 at 2:00 pm — Chromium: CVE-2026-12008 Use after free  DigitalCredentials  Read More »