Mit Kerberos 5 1.11.3
Approved changes feed: RSS · Atom
cpe:2.3:a:mit:kerberos_5:1.11.3:*:*:*:*:*:*:*
part: a version: 1.11.3 update: *
| Vendor | Mit (82b7f5d9-694f-5ac9-86aa-26958677636b) |
|---|---|
| Product | Kerberos 5 (774ea4a1-4fda-5d25-92ac-c66a6356a1e3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/krb5/krb5 |
purl2cpe | 2026-06-01 10:16:02.475398 |
pkg:rpm/fedora/krb5 |
purl2cpe | 2026-06-01 10:16:02.475400 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2017-11368 |
vulnerable | 2026-06-08 05:08:37.486885 |
Details available
In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.
Published: 2017-08-09T18:00:00.000Z
Updated: 2024-08-05T18:05:30.590Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-3119 |
vulnerable | 2026-06-08 05:07:44.530193 |
Details available
The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal.
Published: 2016-03-26T01:00:00.000Z
Updated: 2024-08-05T23:47:57.271Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9423 |
vulnerable | 2026-06-08 05:06:11.630225 |
Details available
The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field.
Published: 2015-02-19T11:00:00.000Z
Updated: 2024-08-06T13:47:41.334Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9422 |
vulnerable | 2026-06-08 05:06:11.629562 |
Details available
The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial "kadmind" substring, as demonstrated by a "ka/x" principal.
Published: 2015-02-19T11:00:00.000Z
Updated: 2024-08-06T13:47:40.890Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9421 |
vulnerable | 2026-06-08 05:06:11.625743 |
Details available
The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind.
Published: 2015-02-19T11:00:00.000Z
Updated: 2024-08-06T13:47:41.430Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-5355 |
vulnerable | 2026-06-08 05:05:47.736781 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-5352 |
vulnerable | 2026-06-08 05:05:47.708733 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-4345 |
vulnerable | 2026-06-08 05:05:44.645759 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-4344 |
vulnerable | 2026-06-08 05:05:44.640298 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-4343 |
vulnerable | 2026-06-08 05:05:44.637089 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-4342 |
vulnerable | 2026-06-08 05:05:44.634321 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-1417 |
vulnerable | 2026-06-08 05:03:53.878058 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.