Double Free Affecting krb5 package, versions <1.12.1+dfsg-5


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
3.26% (92nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Double Free vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-DEBIAN8-KRB5-395855
  • published14 Aug 2014
  • disclosed14 Aug 2014

Introduced: 14 Aug 2014

CVE-2014-4343  (opens in a new tab)
CWE-415  (opens in a new tab)

How to fix?

Upgrade Debian:8 krb5 to version 1.12.1+dfsg-5 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Debian. See How to fix? for Debian:8 relevant fixed versions and status.

Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.

CVSS Scores

version 3.1