1115 matches found
PT-2023-20161
Name of the Vulnerable Software and Affected Versions GSS-NTLMSSP versions prior to 1.2.0 Description GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integ...
PT-2023-20162
Name of the Vulnerable Software and Affected Versions GSS-NTLMSSP versions prior to 1.2.0 Description The issue is related to memory corruption that can be triggered when decoding UTF16 strings. The variable outlen was not initialized, which could cause writing a zero to an arbitrary place in...
PT-2023-20163
Name of the Vulnerable Software and Affected Versions GSS-NTLMSSP versions prior to 1.2.0 Description The issue is related to an incorrect free when decoding target information, which can trigger a denial of service. This occurs because the error condition incorrectly assumes the cb and sh buffer...
EulerOS 2.0 SP10 : samba (EulerOS-SA-2023-1399)
According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrapdes and unwrapdes3 routines of Heimdal. The DES and...
EulerOS 2.0 SP8 : krb5 (EulerOS-SA-2023-1321)
According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - PAC parsing in MIT Kerberos 5 aka krb5 before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution in KDC,...
EulerOS Virtualization 3.0.2.2 : bind (EulerOS-SA-2023-1244)
According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In BIND 9.0.0 - 9.11.21, 9.12.0 - 9.16.5, 9.17.0 - 9.17.3, also affects 9.9.3-S1 - 9.11.21-S1 of the BIND 9 Supported Preview...
PT-2023-34371
Name of the Vulnerable Software and Affected Versions Linux Kernel versions 3.10 through 5.10.162 Description The issue is related to a memory leak in the SUNRPC component when the gss read proxy verf function fails. The actual impact and attack plausibility have not yet been proven...
PT-2023-34029
Name of the Vulnerable Software and Affected Versions Linux Kernel versions 3.10 through 5.15.86 Description The issue is related to a memory leak in the SUNRPC component when the gss read proxy verf function fails. The actual impact and attack plausibility have not yet been proven. Recommendatio...
PT-2023-33578
Name of the Vulnerable Software and Affected Versions Linux Kernel versions 3.10 through 6.0.16 Description The issue is related to a memory leak in the SUNRPC component when the gss read proxy verf function fails. The actual impact and attack plausibility have not yet been proven. Recommendation...
CVE-2022-42898
PAC parsing in MIT Kerberos 5 aka krb5 before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution in KDC, kadmind, or a GSS or Kerberos application server on 32-bit platforms which have a resultant heap-based buffer overflow, and cause a denial of service ...
krb5: integer overflow vulnerabilities in PAC parsing
A vulnerability was found in MIT krb5. This flaw allows an authenticated attacker to cause a KDC or kadmind process to crash by reading beyond the bounds of allocated memory, creating a denial of service. A privileged attacker may similarly be able to cause a Kerberos or GSS application service t...
krb5: integer overflow vulnerabilities in PAC parsing
A vulnerability was found in MIT krb5. This flaw allows an authenticated attacker to cause a KDC or kadmind process to crash by reading beyond the bounds of allocated memory, creating a denial of service. A privileged attacker may similarly be able to cause a Kerberos or GSS application service t...
CVE-2022-42898
A vulnerability was found in MIT krb5. This flaw allows an authenticated attacker to cause a KDC or kadmind process to crash by reading beyond the bounds of allocated memory, creating a denial of service. A privileged attacker may similarly be able to cause a Kerberos or GSS application service t...
OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JGSS. Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated...
OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JGSS. Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated...
OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JGSS. Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated...
OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JGSS. Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated...
Nutanix AHV : (NXSA-AHV-20201105.1161)
The version of AHV installed on the remote host is prior to 20201105.1161. It is, therefore, affected by a vulnerability as referenced in the NXSA-AHV-20201105.1161 advisory. - BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a...
