GCVE - cpe:2.3:a:openafs:openafs:1.4.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:openafs:openafs:1.4.3:*:*:*:*:*:*:*

part: a version: 1.4.3 update: *

Vendor	Openafs (`2895e3fb-afe6-580a-bba4-9bdf01c03987`)
Product	Openafs (`56f758e7-9c22-5c93-8066-8e1d0b3bd6d0`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/openafs/openafs`	purl2cpe	2026-06-01 10:12:59.389504
`pkg:openafs/openafs`	purl2cpe	2026-06-01 10:12:59.389505
`pkg:rpm/opensuse/openafs`	purl2cpe	2026-06-01 10:12:59.389507

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-4134`	vulnerable	2026-06-08 05:04:34.128123	Details available OpenAFS before 1.4.15, 1.6.x before 1.6.5, and 1.7.x before 1.7.26 uses weak encryption (DES) for Kerberos keys, which makes it easier for remote attackers to obtain the service key. Published: 2013-11-05T21:00:00.000Z Updated: 2024-08-06T16:30:50.014Z Open on db.gcve.eu Reference links http://www.debian.org/security/2013/dsa-2729 http://www.mandriva.com/security/advisories?name=MDVSA-2014:244 http://www.openafs.org/pages/security/OPENAFS-SA-2013-003.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-1251`	vulnerable	2026-06-08 04:51:14.089005	Details available Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via an RX response containing more data than specified in a request, related to use of XDR arrays. Published: 2009-04-09T00:00:00.000Z Updated: 2024-08-07T05:04:49.383Z Open on db.gcve.eu Reference links http://www.vupen.com/english/advisories/2011/0117 http://www.openafs.org/security/OPENAFS-SA-2009-001.txt http://www.openafs.org/security/openafs-sa-2009-001.patch http://www.vupen.com/english/advisories/2009/0984 http://www.mandriva.com/security/advisories?name=MDVSA-2009:099	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-1250`	vulnerable	2026-06-08 04:51:14.069397	Details available The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro. Published: 2009-04-09T00:00:00.000Z Updated: 2024-08-07T05:04:49.436Z Open on db.gcve.eu Reference links http://www.vupen.com/english/advisories/2011/0117 http://www.openafs.org/security/openafs-sa-2009-002.patch http://www.openafs.org/security/OPENAFS-SA-2009-002.txt http://www.vupen.com/english/advisories/2009/0984 http://www.mandriva.com/security/advisories?name=MDVSA-2009:099	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-1507`	vulnerable	2026-06-08 04:49:42.751652	Details available The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by spoofing a response to an AFS cache manager FetchStatus request, and setting setuid and root ownership for files in the cache. Published: 2007-03-20T10:00:00.000Z Updated: 2024-08-07T12:59:08.608Z Open on db.gcve.eu Reference links http://www.vupen.com/english/advisories/2007/1033 http://secunia.com/advisories/24582 http://www.securitytracker.com/id?1017807 http://www.openafs.org/pipermail/openafs-announce/2007/000186.html https://exchange.xforce.ibmcloud.com/vulnerabilities/33180	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

OpenAFS 1.4.3

Notes

PURL mappings

Vulnerability references

Contribute