krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092

SO-AND-SO reports:

CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after
gss_process_context_token() is used to process a valid context
deletion token, the caller is left with a security context handle
containing a dangling pointer. Further uses of this handle will
result in use-after-free and double-free memory access violations.
libgssrpc server applications such as kadmind are vulnerable as
they can be instructed to call gss_process_context_token().
CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR
data from an authenticated user, it may perform use-after-free and
double-free memory access violations while cleaning up the partial
deserialization results. Other libgssrpc server applications may
also be vulnerable if they contain insufficiently defensive XDR
functions.
CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepts
authentications to two-component server principals whose first
component is a left substring of “kadmin” or whose realm is a left
prefix of the default realm.
CVE-2014-9423: libgssrpc applications including kadmind output
four or eight bytes of uninitialized memory to the network as
part of an unused “handle” field in replies to clients.