Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade heimdal | Mar 26, 2024 | Dec 26, 2022 |
| Debian | — | Upgrade heimdal | Nov 24, 2022 | Nov 24, 2022 |
| Freebsd | — | Upgrade FreeBSD | Aug 31, 2023 | Aug 31, 2023 |
| Gentoo Linux | — | Upgrade app-crypt/heimdal. | Oct 10, 2023 | Dec 26, 2022 |
| Suse | — | Upgrade libkadm5srv8Upgrade libwind0Upgrade libotp0Upgrade libheimedit0Upgrade libheimntlm0Upgrade libhcrypto4Upgrade libkadm5clnt7Upgrade libheimdal-develUpgrade libkdc2Upgrade libkafs0Upgrade libasn1-8Upgrade libgssapi3Upgrade libheimbase1Upgrade libhdb9Upgrade libhx509-5Upgrade libroken18Upgrade libkrb5-26Upgrade libsl0 | Aug 9, 2024 | Dec 26, 2022 |
| Ubuntu | — | Upgrade libasn1-8-heimdal (Ubuntu Pro)Upgrade libgssapi3-heimdalUpgrade libkrb5-26-heimdal (Ubuntu Pro)Upgrade libhdb9-heimdalUpgrade libhx509-5-heimdalUpgrade libhx509-5-heimdal (Ubuntu Pro)Upgrade libhdb9-heimdal (Ubuntu Pro)Upgrade libasn1-8-heimdalUpgrade libkrb5-26-heimdalUpgrade libgssapi3-heimdal (Ubuntu Pro) | Jan 13, 2023 | Dec 26, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub