GCVE - cpe:2.3:a:mit:kerberos_5:1.4.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mit:kerberos_5:1.4.3:*:*:*:*:*:*:*

part: a version: 1.4.3 update: *

Vendor	Mit (`82b7f5d9-694f-5ac9-86aa-26958677636b`)
Product	Kerberos 5 (`774ea4a1-4fda-5d25-92ac-c66a6356a1e3`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/krb5/krb5`	purl2cpe	2026-06-01 10:16:02.498613
`pkg:rpm/fedora/krb5`	purl2cpe	2026-06-01 10:16:02.498614

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-3119`	vulnerable	2026-06-08 05:07:44.513008	Details available The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal. Published: 2016-03-26T01:00:00.000Z Updated: 2024-08-05T23:47:57.271Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html http://www.securitytracker.com/id/1035399 http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html http://rhn.redhat.com/errata/RHSA-2016-2591.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-5355`	vulnerable	2026-06-08 05:05:47.733481	Details available MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c. Published: 2015-02-20T11:00:00.000Z Updated: 2024-08-06T11:41:49.279Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2015-0794.html https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html https://github.com/krb5/krb5/commit/102bb6ebf20f9174130c85c3b052ae104e5073ec	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-1323`	vulnerable	2026-06-08 04:54:07.214684	Details available MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to modify user-visible prompt text, modify a response to a Key Distribution Center (KDC), or forge a KRB-SAFE message via certain checksums that (1) are unkeyed or (2) use RC4 keys. Published: 2010-12-02T16:00:00.000Z Updated: 2024-08-07T01:21:18.474Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html http://www.vupen.com/english/advisories/2010/3094 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.mandriva.com/security/advisories?name=MDVSA-2010:246 http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051999.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4212`	vulnerable	2026-06-08 04:51:47.606203	Details available Multiple integer underflows in the (1) AES and (2) RC4 decryption functionality in the crypto library in MIT Kerberos 5 (aka krb5) 1.3 through 1.6.3, and 1.7 before 1.7.1, allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by providing ciphertext with a length that is too short to be valid. Published: 2010-01-13T19:00:00.000Z Updated: 2024-08-07T06:54:10.078Z Open on db.gcve.eu Reference links http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html http://secunia.com/advisories/38140 http://www.vupen.com/english/advisories/2010/0096 http://support.avaya.com/css/P8/documents/100074869 http://secunia.com/advisories/38126	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-0947`	vulnerable	2026-06-08 04:50:18.327076	Details available Buffer overflow in the RPC library used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.4 through 1.6.3 allows remote attackers to execute arbitrary code by triggering a large number of open file descriptors. Published: 2008-03-19T00:00:00.000Z Updated: 2024-08-07T08:01:40.133Z Open on db.gcve.eu Reference links http://securityreason.com/securityalert/3752 http://www.us-cert.gov/cas/techalerts/TA08-079B.html http://secunia.com/advisories/29457 http://www.mandriva.com/security/advisories?name=MDVSA-2008:069 http://www.securityfocus.com/archive/1/489784/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-4743`	vulnerable	2026-06-08 04:49:57.085558	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-3999`	vulnerable	2026-06-08 04:49:55.525107	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-6143`	vulnerable	2026-06-08 04:49:22.174253	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-3084`	vulnerable	2026-06-08 04:49:08.283140	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-3083`	vulnerable	2026-06-08 04:49:08.281029	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.