MIT Kerberos 5 Buffer Overflow Vulnerability

MIT Kerberos 5 also known as krb5 is the United States Massachusetts Institute of Technology MIT developed a set of network authentication protocols, which uses a client/server structure, and the client and server side can be authenticated to each other i.e., double authentication to prevent...

Out-of-Bounds

Overview Affected versions of this package are vulnerable to Out-of-Bounds. The iakerbgssexportseccontext function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 aka krb5 1.14 pre-release 2015-09-14 improperly accesses a certain pointer, which allows remote authenticated users to cause a denial of...

DEBIAN-CVE-2015-2698

The iakerbgssexportseccontext function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 aka krb5 1.14 pre-release 2015-09-14 improperly accesses a certain pointer, which allows remote authenticated users to cause a denial of service memory corruption or possibly have unspecified other impact by...

MIT krb5 lib/gssapi/spnego/spnego_mech.c denial of service vulnerability

MIT Kerberos is a widely used super-strong encryption to authenticate client-side and server-side network protocols. A security vulnerability in lib/gssapi/spnego/spnegomech.c in MIT Kerberos 5 krb5 versions prior to 1.14 allows a remote attacker with a constructed SPNEGO message, when incorrectl...

DEBIAN-CVE-2015-2696

lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 aka krb5 before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service incorrect pointer read and process crash via a crafted IAKERB packet that is mishandled during a gssinquirecontext call...

Debian DLA-340-1 : krb5 security update

CVE-2015-2695 It was discovered that applications which call gssinquirecontext on a partially-established SPNEGO context can cause the GSS-API library to read from a pointer using the wrong type, leading to a process crash. CVE-2015-2697 It was discovered that the buildprincipalva function...

Debian DSA-3395-1 : krb5 - security update

Several vulnerabilities were discovered in krb5, the MIT implementation of Kerberos. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2015-2695 It was discovered that applications which call gssinquirecontext on a partially-established SPNEGO context can...

UBUNTU-CVE-2015-2696

lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 aka krb5 before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service incorrect pointer read and process crash via a crafted IAKERB packet that is mishandled during a gssinquirecontext call...

MGASA-2015-0436 Updated krb5 packages fix security vulnerabilities

Updated krb5 packages fix security vulnerabilities: In MIT krb5 1.5 and later, applications which call gssinquirecontext on a partially-established SPNEGO context can cause the GSS-API library to read from a pointer using the wrong type, generally causing a process crash. This bug may go unnotice...

DLA-340-1 krb5 - security update

Bulletin has no description...

SUSE-SU-2015:1897-1 Security update for krb5

krb5 was updated to fix three security issues. These security issues were fixed: - CVE-2015-2695: Applications which call gssinquirecontext on a partially-established SPNEGO context could have caused the GSS-API library to read from a pointer using the wrong type, generally causing a process cras...

CVE-2006-6144

The "mechglue" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon kadmind and other products that use this library, allows remote attackers to cause a denial of service crash via unspecified vectors that cause mechglue to free...

OpenJDK: kerberos realm name leak (JGSS, 8048030)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JGSS...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.4 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.4 and fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. Common...

CVE-2015-5689

CVE-2015-5689 affects Symantec Ghost Solutions Suite and related components (Ghost Explorer Utility; DS) prior to specific HF builds. The issue is improper sign-extension before array-element accesses, enabling remote code execution, application DoS, or potential information disclosure via a craf...

krb5: gss_process_context_token() incorrectly frees context (MITKRB5-SA-2015-001)

A use-after-free flaw was found in the way the MIT Kerberos libgssapikrb5 library processed valid context deletion tokens. An attacker able to make an application using the GSS-API library libgssapi call the gssprocesscontexttoken function could use this flaw to crash that application...

openSUSE Security Update : curl (openSUSE-2015-125)

was updated to version 7.40.0 to fix two security issues. These security issues were fixed : - CVE-2014-8150: CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allowed remote attackers to inject arbitrary HTTP headers and conduct HTTP response...

OpenJDK: insufficient checks of KDC replies (JGSS, 8014341)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via vectors related to JGSS...

OpenJDK: insufficient checks of KDC replies (JGSS, 8014341)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via vectors related to JGSS...

Debian Security Advisory DSA 2592-1 (elinks - programming error)

Marko Myllynen discovered that ELinks, a powerful text-mode browser, incorrectly delegates user credentials during GSS-Negotiate. OpenVAS Vulnerability Test $Id: deb25921.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2592-1 using nvtgen 1.0 Script version: 1.0 Author:...