GCVE - cpe:2.3:a:mit:kerberos_5:1.14:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mit:kerberos_5:1.14:*:*:*:*:*:*:*

part: a version: 1.14 update: *

Vendor	Mit (`82b7f5d9-694f-5ac9-86aa-26958677636b`)
Product	Kerberos 5 (`774ea4a1-4fda-5d25-92ac-c66a6356a1e3`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/krb5/krb5`	purl2cpe	2026-06-01 10:16:02.475447
`pkg:rpm/fedora/krb5`	purl2cpe	2026-06-01 10:16:02.475449

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-11462`	vulnerable	2026-06-08 05:08:37.815656	Details available Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error. Published: 2017-09-13T16:00:00.000Z Updated: 2024-08-05T18:12:39.893Z Open on db.gcve.eu Reference links https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/ https://bugzilla.redhat.com/show_bug.cgi?id=1488873	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-11368`	vulnerable	2026-06-08 05:08:37.494746	Details available In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests. Published: 2017-08-09T18:00:00.000Z Updated: 2024-08-05T18:05:30.590Z Open on db.gcve.eu Reference links https://github.com/krb5/krb5/commit/ffb35baac6981f9e8914f8f3bffd37f284b85970 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4HNWXM6OQU7G23MG7XWIOBRGP43ECLDT/ https://access.redhat.com/errata/RHSA-2018:0666 http://www.securityfocus.com/bid/100291 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBUTXMNZWMVJLQ4NDX5OQFPUVCJRLV3W/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-3120`	vulnerable	2026-06-08 05:07:44.541700	Details available The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request. Published: 2016-08-01T01:00:00.000Z Updated: 2024-08-05T23:47:57.164Z Open on db.gcve.eu Reference links https://github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7 http://www.securityfocus.com/bid/92132 https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html http://lists.opensuse.org/opensuse-updates/2016-09/msg00035.html http://krbdev.mit.edu/rt/Ticket/Display.html?id=8458	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-8630`	vulnerable	2026-06-08 05:07:04.565532	Details available The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by specifying KADM5_POLICY with a NULL policy name. Published: 2016-02-13T02:00:00.000Z Updated: 2024-08-06T08:20:43.695Z Open on db.gcve.eu Reference links http://www.debian.org/security/2016/dsa-3466 http://krbdev.mit.edu/rt/Ticket/Display.html?id=8342 http://www.securitytracker.com/id/1034915 http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html http://lists.opensuse.org/opensuse-updates/2016-02/msg00059.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.