lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade krb5 | Aug 30, 2017 | Nov 8, 2015 |
| Debian | — | Upgrade krb5 | Nov 9, 2015 | Nov 6, 2015 |
| Gentoo Linux | — | Upgrade app-crypt/mit-krb5. | Oct 30, 2017 | Nov 8, 2015 |
| Oracle Solaris | — | Upgrade system/security/kerberos-5 to version 0.5.11-0.175.3.8.0.4.0 on Solaris 11.3Upgrade system/kernel/security/gss to version 0.5.11-0.175.3.8.0.2.0 on Solaris 11.3Upgrade system/library/security/gss/spnego to version 0.5.11-0.175.3.8.0.2.0 on Solaris 11.3Upgrade service/security/kerberos-5 to version 0.5.11-0.175.3.8.0.2.0 on Solaris 11.3 | May 29, 2017 | Nov 8, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 14, 2015 |
| Suse | — | Upgrade krb5-devel-32bitUpgrade krb5-x86Upgrade krb5-apps-clientsUpgrade krb5-develUpgrade krb5-plugin-preauth-pkinitUpgrade krb5-clientUpgrade krb5-plugin-preauth-otpUpgrade krb5-plugin-kdb-ldapUpgrade krb5Upgrade krb5-docUpgrade krb5-apps-serversUpgrade krb5-32bitUpgrade krb5-server | Dec 18, 2015 | Nov 4, 2015 |
| Ubuntu | — | Upgrade libkrb53Upgrade libkrb5-3Upgrade libgssrpc4Upgrade libkadm5clnt-mit8Upgrade krb5-kdc-ldapUpgrade libgssapi-krb5-2Upgrade libkdb5-6Upgrade libkrb5support0Upgrade krb5-userUpgrade krb5-k5tlsUpgrade krb5-otpUpgrade krb5-pkinitUpgrade libkdb5-8Upgrade krb5-admin-serverUpgrade libkrad0Upgrade krb5-kdcUpgrade libkdb5-7Upgrade libkadm5clnt-mit9Upgrade libk5crypto3 | Nov 16, 2015 | Nov 8, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub