Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade heimdal | Mar 26, 2024 | Dec 26, 2022 |
| Debian | — | Upgrade heimdal | Nov 24, 2022 | Nov 24, 2022 |
| Freebsd | — | Upgrade FreeBSD | Aug 31, 2023 | Aug 31, 2023 |
| Gentoo Linux | — | Upgrade app-crypt/heimdal. | Oct 10, 2023 | Dec 26, 2022 |
| Suse | — | Upgrade libkadm5clnt7Upgrade libwind0Upgrade libheimedit0Upgrade libkadm5srv8Upgrade libheimdal-develUpgrade libhcrypto4Upgrade libheimntlm0Upgrade libotp0Upgrade libkdc2Upgrade libgssapi3Upgrade libkafs0Upgrade libhx509-5Upgrade libasn1-8Upgrade libroken18Upgrade libkrb5-26Upgrade libhdb9Upgrade libheimbase1Upgrade libsl0 | Aug 9, 2024 | Dec 26, 2022 |
| Ubuntu | — | Upgrade libasn1-8-heimdal (Ubuntu Pro)Upgrade libhx509-5-heimdalUpgrade libkrb5-26-heimdal (Ubuntu Pro)Upgrade libgssapi3-heimdalUpgrade libhdb9-heimdalUpgrade libhdb9-heimdal (Ubuntu Pro)Upgrade libasn1-8-heimdalUpgrade libhx509-5-heimdal (Ubuntu Pro)Upgrade libgssapi3-heimdal (Ubuntu Pro)Upgrade libkrb5-26-heimdal | Jan 13, 2023 | Dec 26, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub