CVE-2016-3119
- EPSS 5.72%
- Veröffentlicht 26.03.2016 01:59:05
- Zuletzt bearbeitet 12.04.2025 10:46:40
The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users...
CVE-2015-8631
- EPSS 1.56%
- Veröffentlicht 13.02.2016 02:59:02
- Zuletzt bearbeitet 12.04.2025 10:46:40
Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL pr...
CVE-2015-8630
- EPSS 0.75%
- Veröffentlicht 13.02.2016 02:59:01
- Zuletzt bearbeitet 12.04.2025 10:46:40
The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a de...
CVE-2015-8629
- EPSS 0.68%
- Veröffentlicht 13.02.2016 02:59:00
- Zuletzt bearbeitet 12.04.2025 10:46:40
The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensit...
CVE-2015-2698
- EPSS 1.17%
- Veröffentlicht 13.11.2015 03:59:00
- Zuletzt bearbeitet 12.04.2025 10:46:40
The iakerb_gss_export_sec_context function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) 1.14 pre-release 2015-09-14 improperly accesses a certain pointer, which allows remote authenticated users to cause a denial of service (memory corrup...
- EPSS 6.39%
- Veröffentlicht 09.11.2015 03:59:03
- Zuletzt bearbeitet 12.04.2025 10:46:40
The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field...
CVE-2015-2696
- EPSS 8.28%
- Veröffentlicht 09.11.2015 03:59:02
- Zuletzt bearbeitet 12.04.2025 10:46:40
lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mis...
- EPSS 4.77%
- Veröffentlicht 09.11.2015 03:59:00
- Zuletzt bearbeitet 12.04.2025 10:46:40
lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that...
CVE-2015-2694
- EPSS 0.13%
- Veröffentlicht 25.05.2015 19:59:02
- Zuletzt bearbeitet 12.04.2025 10:46:40
The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1...
- EPSS 3.59%
- Veröffentlicht 20.02.2015 11:59:00
- Zuletzt bearbeitet 12.04.2025 10:46:40
MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a ...