Vulnerability-Lookup

CVE-2014-5352 (GCVE-0-2014-5352)

Vulnerability from cvelistv5 – Published: 2015-02-19 11:00 – Updated: 2024-08-06 11:41

Summary

The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2319 records in the last 180 days details

References

14 references

URL	Tags
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://web.mit.edu/kerberos/advisories/MITKRB5-SA…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-0794.html	vendor-advisoryx_refsource_REDHAT
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.debian.org/security/2015/dsa-3153	vendor-advisoryx_refsource_DEBIAN
http://lists.opensuse.org/opensuse-updates/2015-0…	vendor-advisoryx_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2015-0439.html	vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://www.ubuntu.com/usn/USN-2498-1	vendor-advisoryx_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/72495	vdb-entryx_refsource_BID
https://github.com/krb5/krb5/commit/82dc33da50338…	x_refsource_CONFIRM
http://web.mit.edu/kerberos/advisories/2015-001-p…	x_refsource_CONFIRM

Date Public

2015-02-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:41:48.869Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2015-2347",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
          },
          {
            "name": "RHSA-2015:0794",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
          },
          {
            "name": "FEDORA-2015-2382",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
          },
          {
            "name": "DSA-3153",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2015/dsa-3153"
          },
          {
            "name": "openSUSE-SU-2015:0255",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
          },
          {
            "name": "RHSA-2015:0439",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
          },
          {
            "name": "SUSE-SU-2015:0290",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
          },
          {
            "name": "MDVSA-2015:069",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
          },
          {
            "name": "USN-2498-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2498-1"
          },
          {
            "name": "SUSE-SU-2015:0257",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
          },
          {
            "name": "72495",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/72495"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-02-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-30T15:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "FEDORA-2015-2347",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
        },
        {
          "name": "RHSA-2015:0794",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
        },
        {
          "name": "FEDORA-2015-2382",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
        },
        {
          "name": "DSA-3153",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2015/dsa-3153"
        },
        {
          "name": "openSUSE-SU-2015:0255",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
        },
        {
          "name": "RHSA-2015:0439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
        },
        {
          "name": "SUSE-SU-2015:0290",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
        },
        {
          "name": "MDVSA-2015:069",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
        },
        {
          "name": "USN-2498-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2498-1"
        },
        {
          "name": "SUSE-SU-2015:0257",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
        },
        {
          "name": "72495",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/72495"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-5352",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "FEDORA-2015-2347",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
            },
            {
              "name": "RHSA-2015:0794",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
            },
            {
              "name": "FEDORA-2015-2382",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
            },
            {
              "name": "DSA-3153",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2015/dsa-3153"
            },
            {
              "name": "openSUSE-SU-2015:0255",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
            },
            {
              "name": "RHSA-2015:0439",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
            },
            {
              "name": "SUSE-SU-2015:0290",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
            },
            {
              "name": "MDVSA-2015:069",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
            },
            {
              "name": "USN-2498-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2498-1"
            },
            {
              "name": "SUSE-SU-2015:0257",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
            },
            {
              "name": "72495",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/72495"
            },
            {
              "name": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-5352",
    "datePublished": "2015-02-19T11:00:00.000Z",
    "dateReserved": "2014-08-19T00:00:00.000Z",
    "dateUpdated": "2024-08-06T11:41:48.869Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2014-5352",
      "date": "2026-10-29",
      "epss": "0.06213",
      "percentile": "0.93508"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:mit:kerberos_5:1.11:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2D554BDC-CD7D-4572-B1E8-5F627F2C5916",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mit:kerberos_5:1.11.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "65BCD38A-33AD-4FD7-AF5B-8470B24C4139",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mit:kerberos_5:1.11.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E11F9209-799A-428B-9513-DBD0F19C7BF4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mit:kerberos_5:1.11.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "1DA40FAA-B858-4282-8438-247E99FBB002",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mit:kerberos_5:1.11.4:*:*:*:*:*:*:*",
                  "matchCriteriaId": "65795542-D886-46C4-8ECB-4630078DF66A",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mit:kerberos_5:1.11.5:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D0A4C436-C3D7-469E-8895-8EEC9569EE86",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mit:kerberos_5:1.12:*:*:*:*:*:*:*",
                  "matchCriteriaId": "79A9FAE9-7219-4D6A-9E94-FFE20223537D",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mit:kerberos_5:1.12.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "EA68BC90-FCFC-4C9B-8574-9029DB2358E9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mit:kerberos_5:1.12.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "9D0A28CB-173D-4676-B083-E3718213B840",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mit:kerberos_5:1.13:*:*:*:*:*:*:*",
                  "matchCriteriaId": "169D00BD-344F-453C-BE7C-9DF0740080BB",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind."
        },
        {
          "lang": "es",
          "value": "La funci\u00f3n krb5_gss_process_context_token en lib/gssapi/krb5/process_context_token.c en la librar\u00eda libgssapi_krb5 en MIT Kerberos 5 (tambi\u00e9n conocido como krb5) hasta 1.11.5, 1.12.x hasta 1.12.2, y 1.13.x anterior a 1.13.1 no mantiene correctamente los manejos en el contexto de seguridad, lo que permite a usuarios remotos autenticados causar una denegaci\u00f3n de servicio (uso despu\u00e9s de liberaci\u00f3n y doble liberaci\u00f3n, y ca\u00edda del demonio) o posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de trafico GSSAPI manipulado, tal y como fue demostrado por trafico a kadmind."
        }
      ],
      "evaluatorComment": "\u003ca href=\"http://cwe.mitre.org/data/definitions/416.html\"\u003eCWE-416: Use After Free\u003c/a\u003e",
      "id": "CVE-2014-5352",
      "lastModified": "2024-11-21T02:11:54.160",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "HIGH",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "SINGLE",
              "availabilityImpact": "COMPLETE",
              "baseScore": 9.0,
              "confidentialityImpact": "COMPLETE",
              "integrityImpact": "COMPLETE",
              "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
              "version": "2.0"
            },
            "exploitabilityScore": 8.0,
            "impactScore": 10.0,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ]
      },
      "published": "2015-02-19T11:59:00.047",
      "references": [
        {
          "source": "cve@mitre.org",
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://www.debian.org/security/2015/dsa-3153"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://www.securityfocus.com/bid/72495"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://www.ubuntu.com/usn/USN-2498-1"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.debian.org/security/2015/dsa-3153"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.securityfocus.com/bid/72495"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.ubuntu.com/usn/USN-2498-1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a"
        }
      ],
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "NVD-CWE-Other"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mit:kerberos_5:1.11:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2D554BDC-CD7D-4572-B1E8-5F627F2C5916",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mit:kerberos_5:1.11.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "65BCD38A-33AD-4FD7-AF5B-8470B24C4139",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mit:kerberos_5:1.11.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E11F9209-799A-428B-9513-DBD0F19C7BF4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mit:kerberos_5:1.11.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1DA40FAA-B858-4282-8438-247E99FBB002",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mit:kerberos_5:1.11.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "65795542-D886-46C4-8ECB-4630078DF66A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mit:kerberos_5:1.11.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D0A4C436-C3D7-469E-8895-8EEC9569EE86",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mit:kerberos_5:1.12:*:*:*:*:*:*:*",
                    "matchCriteriaId": "79A9FAE9-7219-4D6A-9E94-FFE20223537D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mit:kerberos_5:1.12.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EA68BC90-FCFC-4C9B-8574-9029DB2358E9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mit:kerberos_5:1.12.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9D0A28CB-173D-4676-B083-E3718213B840",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mit:kerberos_5:1.13:*:*:*:*:*:*:*",
                    "matchCriteriaId": "169D00BD-344F-453C-BE7C-9DF0740080BB",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind."
          },
          {
            "lang": "es",
            "value": "La funci\u00f3n krb5_gss_process_context_token en lib/gssapi/krb5/process_context_token.c en la librar\u00eda libgssapi_krb5 en MIT Kerberos 5 (tambi\u00e9n conocido como krb5) hasta 1.11.5, 1.12.x hasta 1.12.2, y 1.13.x anterior a 1.13.1 no mantiene correctamente los manejos en el contexto de seguridad, lo que permite a usuarios remotos autenticados causar una denegaci\u00f3n de servicio (uso despu\u00e9s de liberaci\u00f3n y doble liberaci\u00f3n, y ca\u00edda del demonio) o posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de trafico GSSAPI manipulado, tal y como fue demostrado por trafico a kadmind."
          }
        ],
        "evaluatorComment": "\u003ca href=\"http://cwe.mitre.org/data/definitions/416.html\"\u003eCWE-416: Use After Free\u003c/a\u003e",
        "id": "CVE-2014-5352",
        "lastModified": "2026-05-06T22:30:45.220",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "COMPLETE",
                "baseScore": 9.0,
                "confidentialityImpact": "COMPLETE",
                "integrityImpact": "COMPLETE",
                "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
                "version": "2.0"
              },
              "exploitabilityScore": 8.0,
              "impactScore": 10.0,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2015-02-19T11:59:00.047",
        "references": [
          {
            "source": "cve@mitre.org",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.debian.org/security/2015/dsa-3153"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/bid/72495"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.ubuntu.com/usn/USN-2498-1"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.debian.org/security/2015/dsa-3153"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/bid/72495"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.ubuntu.com/usn/USN-2498-1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T22:02:43+00:00",
      "cve": "CVE-2014-5352",
      "id": "CVE-2014-5352",
      "initial_release_date": "2014-01-01T00:00:00+00:00",
      "product_status:fixed": "151",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "krb5: gss_process_context_token() incorrectly frees context (MITKRB5-SA-2015-001)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2014/cve-2014-5352.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-17T02:34:53Z",
      "cve": "CVE-2014-5352",
      "id": "CVE-2014-5352",
      "initial_release_date": "2023-02-15T05:27:17Z",
      "product_status:known_affected": "321",
      "product_status:known_not_affected": "162",
      "product_status:recommended": "761",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2014-5352",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2023/cve-2014-5352.json",
      "version": "41"
    }
  }
}

CNVD-2015-00927

Vulnerability from cnvd - Published: 2015-02-06

Title

MIT krb5 kadmind远程代码执行漏洞

Description

MIT krb5（又名MIT Kerberos 5）是美国麻省理工学院（MIT）开发的一套网络认证协议，它采用客户端/服务器结构，并且客户端和服务器端均可对对方进行身份认证（即双重验证），可防止窃听、防止replay攻击等。kadmind是其中的一个用于启动Kerberos管理服务器的服务程序，它运行在主Kerberos服务器，存储于KDC数据库中。 MIT krb5 kadmind中存在远程代码执行漏洞。攻击者可利用该漏洞在受影响库的应用程序上下文中执行任意代码，也可能造成拒绝服务。

Severity

高

Patch Name

MIT krb5 kadmind远程代码执行漏洞的补丁

Patch Description

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，详情请关注厂商主页： http://web.mit.edu/~kerberos/

Reference

http://www.securityfocus.com/bid/72495

Impacted products

Name
MIT krb5 kadmind

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "72495"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2014-5352"
    }
  },
  "description": "MIT krb5\uff08\u53c8\u540dMIT Kerberos 5\uff09\u662f\u7f8e\u56fd\u9ebb\u7701\u7406\u5de5\u5b66\u9662\uff08MIT\uff09\u5f00\u53d1\u7684\u4e00\u5957\u7f51\u7edc\u8ba4\u8bc1\u534f\u8bae\uff0c\u5b83\u91c7\u7528\u5ba2\u6237\u7aef/\u670d\u52a1\u5668\u7ed3\u6784\uff0c\u5e76\u4e14\u5ba2\u6237\u7aef\u548c\u670d\u52a1\u5668\u7aef\u5747\u53ef\u5bf9\u5bf9\u65b9\u8fdb\u884c\u8eab\u4efd\u8ba4\u8bc1\uff08\u5373\u53cc\u91cd\u9a8c\u8bc1\uff09\uff0c\u53ef\u9632\u6b62\u7a83\u542c\u3001\u9632\u6b62replay\u653b\u51fb\u7b49\u3002kadmind\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7528\u4e8e\u542f\u52a8Kerberos\u7ba1\u7406\u670d\u52a1\u5668\u7684\u670d\u52a1\u7a0b\u5e8f\uff0c\u5b83\u8fd0\u884c\u5728\u4e3bKerberos\u670d\u52a1\u5668\uff0c\u5b58\u50a8\u4e8eKDC\u6570\u636e\u5e93\u4e2d\u3002\r\n\r\nMIT krb5 kadmind\u4e2d\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u5e93\u7684\u5e94\u7528\u7a0b\u5e8f\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u4e5f\u53ef\u80fd\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
  "discovererName": "Nico Williams",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttp://web.mit.edu/~kerberos/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-00927",
  "openTime": "2015-02-06",
  "patchDescription": "MIT krb5\uff08\u53c8\u540dMIT Kerberos 5\uff09\u662f\u7f8e\u56fd\u9ebb\u7701\u7406\u5de5\u5b66\u9662\uff08MIT\uff09\u5f00\u53d1\u7684\u4e00\u5957\u7f51\u7edc\u8ba4\u8bc1\u534f\u8bae\uff0c\u5b83\u91c7\u7528\u5ba2\u6237\u7aef/\u670d\u52a1\u5668\u7ed3\u6784\uff0c\u5e76\u4e14\u5ba2\u6237\u7aef\u548c\u670d\u52a1\u5668\u7aef\u5747\u53ef\u5bf9\u5bf9\u65b9\u8fdb\u884c\u8eab\u4efd\u8ba4\u8bc1\uff08\u5373\u53cc\u91cd\u9a8c\u8bc1\uff09\uff0c\u53ef\u9632\u6b62\u7a83\u542c\u3001\u9632\u6b62replay\u653b\u51fb\u7b49\u3002kadmind\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7528\u4e8e\u542f\u52a8Kerberos\u7ba1\u7406\u670d\u52a1\u5668\u7684\u670d\u52a1\u7a0b\u5e8f\uff0c\u5b83\u8fd0\u884c\u5728\u4e3bKerberos\u670d\u52a1\u5668\uff0c\u5b58\u50a8\u4e8eKDC\u6570\u636e\u5e93\u4e2d\u3002\r\nMIT krb5 kadmind\u4e2d\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u5e93\u7684\u5e94\u7528\u7a0b\u5e8f\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u4e5f\u53ef\u80fd\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "MIT krb5 kadmind\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "MIT krb5 kadmind"
  },
  "referenceLink": "http://www.securityfocus.com/bid/72495",
  "serverity": "\u9ad8",
  "submitTime": "2015-02-05",
  "title": "MIT krb5 kadmind\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

FKIE_CVE-2014-5352

Vulnerability from fkie_nvd - Published: 2015-02-19 11:59 - Updated: 2026-06-17 00:11

Severity

Summary

References

URL	Tags
cve@mitre.org	http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html
cve@mitre.org	http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html
cve@mitre.org	http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html
cve@mitre.org	http://rhn.redhat.com/errata/RHSA-2015-0439.html
cve@mitre.org	http://rhn.redhat.com/errata/RHSA-2015-0794.html
cve@mitre.org	http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt
cve@mitre.org	http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt
cve@mitre.org	http://www.debian.org/security/2015/dsa-3153
cve@mitre.org	http://www.mandriva.com/security/advisories?name=MDVSA-2015:069
cve@mitre.org	http://www.securityfocus.com/bid/72495
cve@mitre.org	http://www.ubuntu.com/usn/USN-2498-1
cve@mitre.org	https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html
af854a3a-2127-422b-91ae-364da2661108	http://rhn.redhat.com/errata/RHSA-2015-0439.html
af854a3a-2127-422b-91ae-364da2661108	http://rhn.redhat.com/errata/RHSA-2015-0794.html
af854a3a-2127-422b-91ae-364da2661108	http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt
af854a3a-2127-422b-91ae-364da2661108	http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt
af854a3a-2127-422b-91ae-364da2661108	http://www.debian.org/security/2015/dsa-3153
af854a3a-2127-422b-91ae-364da2661108	http://www.mandriva.com/security/advisories?name=MDVSA-2015:069
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/72495
af854a3a-2127-422b-91ae-364da2661108	http://www.ubuntu.com/usn/USN-2498-1
af854a3a-2127-422b-91ae-364da2661108	https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a	Vendor Advisory

Impacted products

Vendor	Product	Version
mit	kerberos_5	1.11
mit	kerberos_5	1.11.1
mit	kerberos_5	1.11.2
mit	kerberos_5	1.11.3
mit	kerberos_5	1.11.4
mit	kerberos_5	1.11.5
mit	kerberos_5	1.12
mit	kerberos_5	1.12.1
mit	kerberos_5	1.12.2
mit	kerberos_5	1.13

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D554BDC-CD7D-4572-B1E8-5F627F2C5916",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.11.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "65BCD38A-33AD-4FD7-AF5B-8470B24C4139",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.11.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E11F9209-799A-428B-9513-DBD0F19C7BF4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.11.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "1DA40FAA-B858-4282-8438-247E99FBB002",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.11.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "65795542-D886-46C4-8ECB-4630078DF66A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.11.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "D0A4C436-C3D7-469E-8895-8EEC9569EE86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "79A9FAE9-7219-4D6A-9E94-FFE20223537D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.12.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA68BC90-FCFC-4C9B-8574-9029DB2358E9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.12.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D0A28CB-173D-4676-B083-E3718213B840",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "169D00BD-344F-453C-BE7C-9DF0740080BB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n krb5_gss_process_context_token en lib/gssapi/krb5/process_context_token.c en la librar\u00eda libgssapi_krb5 en MIT Kerberos 5 (tambi\u00e9n conocido como krb5) hasta 1.11.5, 1.12.x hasta 1.12.2, y 1.13.x anterior a 1.13.1 no mantiene correctamente los manejos en el contexto de seguridad, lo que permite a usuarios remotos autenticados causar una denegaci\u00f3n de servicio (uso despu\u00e9s de liberaci\u00f3n y doble liberaci\u00f3n, y ca\u00edda del demonio) o posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de trafico GSSAPI manipulado, tal y como fue demostrado por trafico a kadmind."
    }
  ],
  "evaluatorComment": "\u003ca href=\"http://cwe.mitre.org/data/definitions/416.html\"\u003eCWE-416: Use After Free\u003c/a\u003e",
  "id": "CVE-2014-5352",
  "lastModified": "2026-06-17T00:11:25.663",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2015-02-19T11:59:00.047",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2015/dsa-3153"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/72495"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/USN-2498-1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2015/dsa-3153"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/72495"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-2498-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-VMGH-H88M-58MJ

Vulnerability from github – Published: 2022-05-13 01:28 – Updated: 2022-05-13 01:28

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2014-5352"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-02-19T11:59:00Z",
    "severity": "HIGH"
  },
  "details": "The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind.",
  "id": "GHSA-vmgh-h88m-58mj",
  "modified": "2022-05-13T01:28:50Z",
  "published": "2022-05-13T01:28:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5352"
    },
    {
      "type": "WEB",
      "url": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
    },
    {
      "type": "WEB",
      "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
    },
    {
      "type": "WEB",
      "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2015/dsa-3153"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/72495"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2498-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2014-5352

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Aliases

CVE-2014-5352

Aliases

CVE-2014-5352

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2014-5352",
    "description": "The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind.",
    "id": "GSD-2014-5352",
    "references": [
      "https://www.suse.com/security/cve/CVE-2014-5352.html",
      "https://www.debian.org/security/2015/dsa-3153",
      "https://access.redhat.com/errata/RHSA-2015:0794",
      "https://access.redhat.com/errata/RHSA-2015:0439",
      "https://ubuntu.com/security/CVE-2014-5352",
      "https://advisories.mageia.org/CVE-2014-5352.html",
      "https://alas.aws.amazon.com/cve/html/CVE-2014-5352.html",
      "https://linux.oracle.com/cve/CVE-2014-5352.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2014-5352"
      ],
      "details": "The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind.",
      "id": "GSD-2014-5352",
      "modified": "2023-12-13T01:22:51.898889Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2014-5352",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "FEDORA-2015-2347",
            "refsource": "FEDORA",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
          },
          {
            "name": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt",
            "refsource": "CONFIRM",
            "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
          },
          {
            "name": "RHSA-2015:0794",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
          },
          {
            "name": "FEDORA-2015-2382",
            "refsource": "FEDORA",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
          },
          {
            "name": "DSA-3153",
            "refsource": "DEBIAN",
            "url": "http://www.debian.org/security/2015/dsa-3153"
          },
          {
            "name": "openSUSE-SU-2015:0255",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
          },
          {
            "name": "RHSA-2015:0439",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
          },
          {
            "name": "SUSE-SU-2015:0290",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
          },
          {
            "name": "MDVSA-2015:069",
            "refsource": "MANDRIVA",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
          },
          {
            "name": "USN-2498-1",
            "refsource": "UBUNTU",
            "url": "http://www.ubuntu.com/usn/USN-2498-1"
          },
          {
            "name": "SUSE-SU-2015:0257",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
          },
          {
            "name": "72495",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/72495"
          },
          {
            "name": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a",
            "refsource": "CONFIRM",
            "url": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a"
          },
          {
            "name": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt",
            "refsource": "CONFIRM",
            "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.11.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.11.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.11.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.12.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.12.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.11.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.11.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mit:kerberos_5:1.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-5352"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt"
            },
            {
              "name": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a"
            },
            {
              "name": "SUSE-SU-2015:0290",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html"
            },
            {
              "name": "DSA-3153",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "http://www.debian.org/security/2015/dsa-3153"
            },
            {
              "name": "SUSE-SU-2015:0257",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html"
            },
            {
              "name": "FEDORA-2015-2382",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html"
            },
            {
              "name": "RHSA-2015:0439",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
            },
            {
              "name": "openSUSE-SU-2015:0255",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html"
            },
            {
              "name": "USN-2498-1",
              "refsource": "UBUNTU",
              "tags": [],
              "url": "http://www.ubuntu.com/usn/USN-2498-1"
            },
            {
              "name": "FEDORA-2015-2347",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html"
            },
            {
              "name": "MDVSA-2015:069",
              "refsource": "MANDRIVA",
              "tags": [],
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069"
            },
            {
              "name": "RHSA-2015:0794",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html"
            },
            {
              "name": "72495",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/72495"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2020-01-21T15:46Z",
      "publishedDate": "2015-02-19T11:59Z"
    }
  }
}

OPENSUSE-SU-2024:10004-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-10-18 10:25

Summary

krb5-1.15-1.1 on GA media

Severity

Moderate

Scope

54 vulnerabilities in this advisory, including CVE-2014-5352.

CVE-2014-5352

Recommended: 48 products

Open the full advisory

RHSA-2015:0439

Vulnerability from csaf_opensuse - Published: 2015-03-05 00:00 - Updated: 2026-09-20 10:54

Summary

security update for krb5

Severity

Moderate

Scope

10 vulnerabilities in this advisory, including CVE-2014-5352.

CVE-2014-5352

Recommended: 8 products

Open the full advisory

RHSA-2015:0794

Vulnerability from csaf_redhat - Published: 2015-04-09 05:09 - Updated: 2026-08-04 22:00

Summary

Red Hat Security Advisory: krb5 security update

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2014-5352.

CVE-2014-5352

A use-after-free flaw was found in the way the MIT Kerberos libgssapi_krb5 library processed valid context deletion tokens. An attacker able to make an application using the GSS-API library (libgssapi) call the gss_process_context_token() function could use this flaw to crash that application.

6.5 ()


                
                  AV:N/AC:L/Au:S/C:P/I:P/A:P

Fixed: 83 products

https://access.redhat.com/errata/RHSA-2015:0794

Open the full advisory

RHSA-2015_0439

Vulnerability from csaf_redhat - Published: 2015-03-05 09:38 - Updated: 2024-11-22 08:51

Summary

Red Hat Security Advisory: krb5 security, bug fix and enhancement update

Severity

Moderate

Scope

10 vulnerabilities in this advisory, including CVE-2014-5352.

CVE-2014-5352

6.5 ()


                
                  AV:N/AC:L/Au:S/C:P/I:P/A:P

Fixed: 186 products

https://access.redhat.com/errata/RHSA-2015:0439

Open the full advisory

RHSA-2015_0794

Vulnerability from csaf_redhat - Published: 2015-04-09 05:09 - Updated: 2024-11-22 08:51

Summary

Red Hat Security Advisory: krb5 security update

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2014-5352.

CVE-2014-5352

6.5 ()


                
                  AV:N/AC:L/Au:S/C:P/I:P/A:P

Fixed: 222 products

https://access.redhat.com/errata/RHSA-2015:0794

Open the full advisory

SUSE-SU-2015:0257-1

Vulnerability from csaf_suse - Published: 2015-02-06 09:35 - Updated: 2026-09-20 12:00

Summary

Security update for krb5

Severity

Moderate

Scope

4 vulnerabilities in this advisory, including CVE-2014-5352.

CVE-2014-5352

Recommended: 80 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2014-5352 (GCVE-0-2014-5352)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour