Stack-based buffer overflow in the assembleline function in modules/pamenv/pamenv.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pamenvironment file.

The expandarg function in the pamenv module (modules/pamenv/pamenv.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).