Malte Kraus discovered that liblibpam-python, a PAM module allowing PAM modules to be written in Python, didn"t sanitise environment variables which could result in local privilege escalation if used with a setuid binary.