CVE-2015-2697

2015-11-0903:59:03

Debian Security Bug Tracker

security-tracker.debian.org

0.835 High

EPSS

Percentile

98.5%

JSON

The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial ‘\0’ character in a long realm field within a TGS request.

OSVersionArchitecturePackageVersionFilename
Debian12allkrb5< 1.13.2+dfsg-3krb5_1.13.2+dfsg-3_all.deb
Debian11allkrb5< 1.13.2+dfsg-3krb5_1.13.2+dfsg-3_all.deb
Debian10allkrb5< 1.13.2+dfsg-3krb5_1.13.2+dfsg-3_all.deb
Debian999allkrb5< 1.13.2+dfsg-3krb5_1.13.2+dfsg-3_all.deb
Debian13allkrb5< 1.13.2+dfsg-3krb5_1.13.2+dfsg-3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	krb5	< 1.13.2+dfsg-3	krb5_1.13.2+dfsg-3_all.deb
Debian	11	all	krb5	< 1.13.2+dfsg-3	krb5_1.13.2+dfsg-3_all.deb
Debian	10	all	krb5	< 1.13.2+dfsg-3	krb5_1.13.2+dfsg-3_all.deb
Debian	999	all	krb5	< 1.13.2+dfsg-3	krb5_1.13.2+dfsg-3_all.deb
Debian	13	all	krb5	< 1.13.2+dfsg-3	krb5_1.13.2+dfsg-3_all.deb

CVE-2015-2697

Related