cbcvebase.
CVE-2015-2697
published 2015-11-09

CVE-2015-2697: The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of…

medium4CVSS 3.1
AVNACLAuSCNINAP
The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.

Affected

21 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
debiandebian_linux
debiandebian_linux
debiankrb5< krb5 1.13.2+dfsg-3 (bookworm)krb5 1.13.2+dfsg-3 (bookworm)
mitkerberos_5< 1.141.14
mitkrb5>= 0 < 1.13.2+dfsg-31.13.2+dfsg-3
mitkrb5>= 0 < 1.13.2+dfsg-31.13.2+dfsg-3
mitkrb5>= 0 < 1.13.2+dfsg-31.13.2+dfsg-3
mitkrb5>= 0 < 1.13.2+dfsg-31.13.2+dfsg-3
mitkrb5>= 0 < 1.12+dfsg-2ubuntu5.21.12+dfsg-2ubuntu5.2
opensuseleap
opensuseopensuse
opensuseopensuse
oraclesolaris
suselinux_enterprise_desktop
suselinux_enterprise_server
suselinux_enterprise_software_development_kit

CVSS provenance

nvd4.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
osv5.0MEDIUM