Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade heimdal | Mar 26, 2024 | Dec 26, 2022 |
| Debian | — | Upgrade heimdal | Nov 24, 2022 | Nov 24, 2022 |
| Freebsd | — | Upgrade FreeBSD | Aug 31, 2023 | Aug 31, 2023 |
| Gentoo Linux | — | Upgrade app-crypt/heimdal. | Oct 10, 2023 | Dec 26, 2022 |
| Suse | — | Upgrade libheimbase1Upgrade libsl0Upgrade libkafs0Upgrade libgssapi3Upgrade libasn1-8Upgrade libroken18Upgrade libhdb9Upgrade libkrb5-26Upgrade libkdc2Upgrade libhx509-5Upgrade libkadm5srv8Upgrade libheimdal-develUpgrade libheimedit0Upgrade libotp0Upgrade libheimntlm0Upgrade libhcrypto4Upgrade libwind0Upgrade libkadm5clnt7 | Aug 9, 2024 | Dec 26, 2022 |
| Ubuntu | — | Upgrade libasn1-8-heimdal (Ubuntu Pro)Upgrade libkrb5-26-heimdal (Ubuntu Pro)Upgrade libgssapi3-heimdalUpgrade libhdb9-heimdalUpgrade libhx509-5-heimdalUpgrade libkrb5-26-heimdalUpgrade libhdb9-heimdal (Ubuntu Pro)Upgrade libgssapi3-heimdal (Ubuntu Pro)Upgrade libhx509-5-heimdal (Ubuntu Pro)Upgrade libasn1-8-heimdal | Jan 13, 2023 | Dec 26, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub