Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 150

Export CSV
CVE-2023-39975

krb5: double-free in KDC TGS processing

kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos 5 Enterprise Linux
CVE-2018-5729

krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data

MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.

CVSS 3.1 · 4.7 Medium EPSS 2.6% KEV · Not listed
Vendors
Debian Fedoraproject Mit and 1 more
Products
Debian Linux Fedora Kerberos 5 and 4 more
CVE-2018-5730

krb5: DN container check bypass by supplying special crafted data

MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN.

CVSS 3.1 · 3.8 Low EPSS 2.2% KEV · Not listed
Vendors
Debian Fedoraproject Mit and 1 more
Products
Debian Linux Fedora Kerberos 5 and 4 more
CVE-2017-15088

krb5: Buffer overflow in get_matching_data()

plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.

CVSS 3.1 · 9.8 Critical EPSS 8.6% KEV · Not listed
Vendors
Mit
Products
Kerberos 5
CVE-2017-11368

krb5: Invalid S4U2Self or S4U2Proxy request causes assertion failure

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

CVSS 3.0 · 6.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Fedoraproject Mit Redhat
Products
Fedora Kerberos Kerberos 5 and 1 more
CVE-2017-11462

krb5: Automatic sec context deletion could lead to double-free

Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.

CVSS 3.0 · 9.8 Critical EPSS 5.5% KEV · Not listed
Vendors
Fedoraproject Mit
Products
Fedora Kerberos 5
CVE-2015-2695

krb5: SPNEGO context aliasing bugs

lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.

CVSS 2.0 · 5.0 Medium EPSS 6.0% KEV · Not listed
Vendors
Canonical Debian Mit and 3 more
Products
Ubuntu Linux Debian Linux Kerberos 5 and 6 more
CVE-2015-2696

krb5: IAKERB context aliasing flaw

lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call.

CVSS 2.0 · 7.1 High EPSS 4.5% KEV · Not listed
Vendors
Canonical Debian Mit and 2 more
Products
Ubuntu Linux Debian Linux Kerberos 5 and 5 more
CVE-2015-2697

krb5: build_principal() memory flaw

The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.

CVSS 2.0 · 4.0 Medium EPSS 4.0% KEV · Not listed
Vendors
Canonical Debian Mit and 3 more
Products
Ubuntu Linux Debian Linux Kerberos 5 and 6 more
CVE-2015-2698

krb5: IAKERB context export/import

The iakerb_gss_export_sec_context function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) 1.14 pre-release 2015-09-14 improperly accesses a certain pointer, which allows remote authenticated users to cause a denial of service (memory corruption) or possibly have unspecified other impact by interacting with an application that calls the gss_export_sec_context function. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-2696.

CVSS 2.0 · 8.5 High EPSS 2.9% KEV · Not listed
Vendors
Mit
Products
Kerberos 5
CVE-2015-8629

krb5: xdr_nullstring() doesn't check for terminating null character

The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.

CVSS 3.1 · 5.3 Medium EPSS 3.7% KEV · Not listed
Vendors
Debian Mit Opensuse and 2 more
Products
Debian Linux Kerberos 5 Leap and 10 more
CVE-2015-8630

krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask

The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by specifying KADM5_POLICY with a NULL policy name.

CVSS 3.0 · 7.5 High EPSS 4.3% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos 5 Enterprise Linux
CVE-2015-8631

krb5: Memory leak caused by supplying a null principal name in request

Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name.

CVSS 3.1 · 6.5 Medium EPSS 4.7% KEV · Not listed
Vendors
Debian Mit Opensuse and 2 more
Products
Debian Linux Kerberos 5 Leap and 9 more
CVE-2016-3119

krb5: null pointer dereference in kadmin

The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal.

CVSS 3.0 · 5.3 Medium EPSS 39.8% KEV · Not listed
Vendors
Mit Opensuse Redhat
Products
Kerberos 5 Leap Opensuse and 1 more
CVE-2016-3120

krb5: S4U2Self KDC crash when anon is restricted

The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.

CVSS 3.0 · 6.5 Medium EPSS 4.6% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos 5 Enterprise Linux
CVE-2014-4341

krb5: denial of service flaws when handling padding length longer than the plaintext

MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session.

CVSS 2.0 · 5.0 Medium EPSS 7.1% KEV · Not listed
Vendors
Debian Fedoraproject Mit and 1 more
Products
Debian Linux Fedora Kerberos 5 and 8 more
CVE-2014-4342

krb5: denial of service flaws when handling RFC 1964 tokens

MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session.

CVSS 2.0 · 5.0 Medium EPSS 6.5% KEV · Not listed
Vendors
Debian Mit Redhat
Products
Debian Linux Kerberos Kerberos 5 and 5 more
CVE-2014-4343

krb5: double-free flaw in SPNEGO initiators

Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.

CVSS 2.0 · 7.6 High EPSS 6.4% KEV · Not listed
Vendors
Debian Mit Redhat
Products
Debian Linux Kerberos 5 Enterprise Linux and 4 more