Double free security issue

[Marc Deslauriers]

LSE discovered that by supplying a password containing a NULL-byte to the PyPAM module, a double-free condition is triggered. This leads to undefined behaviour and may allow remote code execution.

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-pam - 0.4.2-12.2ubuntu4

---------------
python-pam (0.4.2-12.2ubuntu4) precise; urgency=low

  * SECURITY UPDATE: possible code execution via double-free (LP: #949218)
    - PAMmodule.c: prevent double free in PyPAM_conv().
    - Thanks to Markus Vervier for the notification and the patch.
    - CVE-2012-1502
 -- Marc Deslauriers <email address hidden> Thu, 08 Mar 2012 08:06:43 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-pam - 0.4.2-12.2ubuntu2.11.10.1

---------------
python-pam (0.4.2-12.2ubuntu2.11.10.1) oneiric-security; urgency=low

  * SECURITY UPDATE: possible code execution via double-free (LP: #949218)
    - PAMmodule.c: prevent double free in PyPAM_conv().
    - Thanks to Markus Vervier for the notification and the patch.
    - CVE-2012-1502
 -- Marc Deslauriers <email address hidden> Thu, 08 Mar 2012 08:07:00 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-pam - 0.4.2-12.2ubuntu2.11.04.1

---------------
python-pam (0.4.2-12.2ubuntu2.11.04.1) natty-security; urgency=low

  * SECURITY UPDATE: possible code execution via double-free (LP: #949218)
    - PAMmodule.c: prevent double free in PyPAM_conv().
    - Thanks to Markus Vervier for the notification and the patch.
    - CVE-2012-1502
 -- Marc Deslauriers <email address hidden> Thu, 08 Mar 2012 08:05:24 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-pam - 0.4.2-12.1ubuntu1.10.10.1

---------------
python-pam (0.4.2-12.1ubuntu1.10.10.1) maverick-security; urgency=low

  * SECURITY UPDATE: possible code execution via double-free (LP: #949218)
    - PAMmodule.c: prevent double free in PyPAM_conv().
    - Thanks to Markus Vervier for the notification and the patch.
    - CVE-2012-1502
 -- Marc Deslauriers <email address hidden> Thu, 08 Mar 2012 09:11:03 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-pam - 0.4.2-12.1ubuntu1.10.04.1

---------------
python-pam (0.4.2-12.1ubuntu1.10.04.1) lucid-security; urgency=low

  * SECURITY UPDATE: possible code execution via double-free (LP: #949218)
    - PAMmodule.c: prevent double free in PyPAM_conv().
    - Thanks to Markus Vervier for the notification and the patch.
    - CVE-2012-1502
 -- Marc Deslauriers <email address hidden> Thu, 08 Mar 2012 09:42:55 -0500