Lucene search

K
suseSuseSUSE-SU-2015:0257-1
HistoryFeb 11, 2015 - 6:08 p.m.

Security update for krb5 (important)

2015-02-1118:08:30
lists.opensuse.org
23

0.018 Low

EPSS

Percentile

86.8%

krb5 has been updated to fix four security issues:

   * CVE-2014-5352: gss_process_context_token() incorrectly frees context
     (bsc#912002)
   * CVE-2014-9421: kadmind doubly frees partial deserialization results
     (bsc#912002)
   * CVE-2014-9422: kadmind incorrectly validates server principal name
     (bsc#912002)
   * CVE-2014-9423: libgssrpc server applications leak uninitialized
     bytes (bsc#912002)

Additionally, these non-security issues have been fixed:

   * Winbind process hangs indefinitely without DC. (bsc#872912)
   * Hanging winbind processes. (bsc#906557)

Security Issues:

   * CVE-2014-5352
     &lt;<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5352">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5352</a>&gt;
   * CVE-2014-9421
     &lt;<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9421">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9421</a>&gt;
   * CVE-2014-9422
     &lt;<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9422">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9422</a>&gt;
   * CVE-2014-9423
     &lt;<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9423">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9423</a>&gt;