Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2006-6144 (GCVE-0-2006-6144)
Vulnerability from cvelistv5
Published
2007-01-10 00:00
Modified
2024-08-07 20:19
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The "mechglue" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-07T20:19:33.965Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "kerberos-gssapi-code-execution(31417)", "tags": [ "vdb-entry", "x_refsource_XF", "x_transferred" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31417" }, { "name": "102772", "tags": [ "vendor-advisory", "x_refsource_SUNALERT", "x_transferred" ], "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102772-1" }, { "name": "201294", "tags": [ "vendor-advisory", "x_refsource_SUNALERT", "x_transferred" ], "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-201294-1" }, { "name": "TA07-009B", "tags": [ "third-party-advisory", "x_refsource_CERT", "x_transferred" ], "url": "http://www.us-cert.gov/cas/techalerts/TA07-009B.html" }, { "name": "23690", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/23690" }, { "name": "SUSE-SA:2007:004", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html" }, { "name": "1017494", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "url": "http://securitytracker.com/id?1017494" }, { "name": "23706", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/23706" }, { "name": "20070109 MITKRB5-SA-2006-003: kadmind (via GSS-API lib) frees uninitialized pointers", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "url": "http://www.securityfocus.com/archive/1/456409/100/0/threaded" }, { "name": "23903", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/23903" }, { "name": "GLSA-200701-21", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "http://security.gentoo.org/glsa/glsa-200701-21.xml" }, { "name": "OpenPKG-SA-2007.006", "tags": [ "vendor-advisory", "x_refsource_OPENPKG", "x_transferred" ], "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.006.html" }, { "name": "FEDORA-2007-033", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "http://fedoranews.org/cms/node/2375" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-003-mechglue.txt" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://issues.rpath.com/browse/RPL-925" }, { "name": "ADV-2007-0112", "tags": [ "vdb-entry", "x_refsource_VUPEN", "x_transferred" ], "url": "http://www.vupen.com/english/advisories/2007/0112" }, { "name": "31280", "tags": [ "vdb-entry", "x_refsource_OSVDB", "x_transferred" ], "url": "http://osvdb.org/31280" }, { "name": "35151", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/35151" }, { "name": "21975", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/21975" }, { "name": "ADV-2007-0111", "tags": [ "vdb-entry", "x_refsource_VUPEN", "x_transferred" ], "url": "http://www.vupen.com/english/advisories/2007/0111" }, { "name": "VU#831452", "tags": [ "third-party-advisory", "x_refsource_CERT-VN", "x_transferred" ], "url": "http://www.kb.cert.org/vuls/id/831452" }, { "name": "23701", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/23701" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2007-01-09T00:00:00", "descriptions": [ { "lang": "en", "value": "The \"mechglue\" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2018-10-17T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "name": "kerberos-gssapi-code-execution(31417)", "tags": [ "vdb-entry", "x_refsource_XF" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31417" }, { "name": "102772", "tags": [ "vendor-advisory", "x_refsource_SUNALERT" ], "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102772-1" }, { "name": "201294", "tags": [ "vendor-advisory", "x_refsource_SUNALERT" ], "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-201294-1" }, { "name": "TA07-009B", "tags": [ "third-party-advisory", "x_refsource_CERT" ], "url": "http://www.us-cert.gov/cas/techalerts/TA07-009B.html" }, { "name": "23690", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/23690" }, { "name": "SUSE-SA:2007:004", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html" }, { "name": "1017494", "tags": [ "vdb-entry", "x_refsource_SECTRACK" ], "url": "http://securitytracker.com/id?1017494" }, { "name": "23706", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/23706" }, { "name": "20070109 MITKRB5-SA-2006-003: kadmind (via GSS-API lib) frees uninitialized pointers", "tags": [ "mailing-list", "x_refsource_BUGTRAQ" ], "url": "http://www.securityfocus.com/archive/1/456409/100/0/threaded" }, { "name": "23903", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/23903" }, { "name": "GLSA-200701-21", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "http://security.gentoo.org/glsa/glsa-200701-21.xml" }, { "name": "OpenPKG-SA-2007.006", "tags": [ "vendor-advisory", "x_refsource_OPENPKG" ], "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.006.html" }, { "name": "FEDORA-2007-033", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "http://fedoranews.org/cms/node/2375" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-003-mechglue.txt" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://issues.rpath.com/browse/RPL-925" }, { "name": "ADV-2007-0112", "tags": [ "vdb-entry", "x_refsource_VUPEN" ], "url": "http://www.vupen.com/english/advisories/2007/0112" }, { "name": "31280", "tags": [ "vdb-entry", "x_refsource_OSVDB" ], "url": "http://osvdb.org/31280" }, { "name": "35151", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/35151" }, { "name": "21975", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/21975" }, { "name": "ADV-2007-0111", "tags": [ "vdb-entry", "x_refsource_VUPEN" ], "url": "http://www.vupen.com/english/advisories/2007/0111" }, { "name": "VU#831452", "tags": [ "third-party-advisory", "x_refsource_CERT-VN" ], "url": "http://www.kb.cert.org/vuls/id/831452" }, { "name": "23701", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/23701" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-6144", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The \"mechglue\" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "kerberos-gssapi-code-execution(31417)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31417" }, { "name": "102772", "refsource": "SUNALERT", "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102772-1" }, { "name": "201294", "refsource": "SUNALERT", "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-201294-1" }, { "name": "TA07-009B", "refsource": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA07-009B.html" }, { "name": "23690", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23690" }, { "name": "SUSE-SA:2007:004", "refsource": "SUSE", "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html" }, { "name": "1017494", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1017494" }, { "name": "23706", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23706" }, { "name": "20070109 MITKRB5-SA-2006-003: kadmind (via GSS-API lib) frees uninitialized pointers", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/456409/100/0/threaded" }, { "name": "23903", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23903" }, { "name": "GLSA-200701-21", "refsource": "GENTOO", "url": "http://security.gentoo.org/glsa/glsa-200701-21.xml" }, { "name": "OpenPKG-SA-2007.006", "refsource": "OPENPKG", "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.006.html" }, { "name": "FEDORA-2007-033", "refsource": "FEDORA", "url": "http://fedoranews.org/cms/node/2375" }, { "name": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-003-mechglue.txt", "refsource": "CONFIRM", "url": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-003-mechglue.txt" }, { "name": "https://issues.rpath.com/browse/RPL-925", "refsource": "CONFIRM", "url": "https://issues.rpath.com/browse/RPL-925" }, { "name": "ADV-2007-0112", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/0112" }, { "name": "31280", "refsource": "OSVDB", "url": "http://osvdb.org/31280" }, { "name": "35151", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/35151" }, { "name": "21975", "refsource": "BID", "url": "http://www.securityfocus.com/bid/21975" }, { "name": "ADV-2007-0111", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/0111" }, { "name": "VU#831452", "refsource": "CERT-VN", "url": "http://www.kb.cert.org/vuls/id/831452" }, { "name": "23701", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23701" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-6144", "datePublished": "2007-01-10T00:00:00", "dateReserved": "2006-11-28T00:00:00", "dateUpdated": "2024-08-07T20:19:33.965Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2006-6144\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2006-12-31T05:00:00.000\",\"lastModified\":\"2025-04-09T00:30:58.490\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The \\\"mechglue\\\" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers.\"},{\"lang\":\"es\",\"value\":\"La abstracci\u00f3n de interfaz \\\"mechglue\\\" de la biblioteca GSS-API para Kerberos 5 1.5 hasta 1.5.1, tal y como se usan en el demonio de administraci\u00f3n Kerberos (kadmind) y otros productos que utilizan esta biblioteca, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda) mediante vectores desconocidos que provoca que mechglue libere punteros sin inicializar.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.5\",\"versionEndIncluding\":\"1.5.1\",\"matchCriteriaId\":\"41C9B47F-522F-4966-AC17-967769F66712\"}]}]}],\"references\":[{\"url\":\"http://fedoranews.org/cms/node/2375\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://osvdb.org/31280\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://secunia.com/advisories/23690\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/23701\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/23706\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/23903\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/35151\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://security.gentoo.org/glsa/glsa-200701-21.xml\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://securitytracker.com/id?1017494\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102772-1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-26-201294-1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-003-mechglue.txt\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.kb.cert.org/vuls/id/831452\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.006.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/archive/1/456409/100/0/threaded\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/bid/21975\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.us-cert.gov/cas/techalerts/TA07-009B.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/0111\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/0112\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/31417\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://issues.rpath.com/browse/RPL-925\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://fedoranews.org/cms/node/2375\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://osvdb.org/31280\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://secunia.com/advisories/23690\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/23701\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/23706\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/23903\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/35151\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://security.gentoo.org/glsa/glsa-200701-21.xml\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://securitytracker.com/id?1017494\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102772-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-26-201294-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-003-mechglue.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.kb.cert.org/vuls/id/831452\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.006.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/archive/1/456409/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/bid/21975\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.us-cert.gov/cas/techalerts/TA07-009B.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/0111\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/0112\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/31417\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://issues.rpath.com/browse/RPL-925\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]}],\"vendorComments\":[{\"organization\":\"Red Hat\",\"comment\":\"Not vulnerable. Red Hat Enterprise Linux 2.1, 3, and 4 ship with versions of Kerberos 5 prior to version 1.4 and are therefore not affected by these vulnerabilities.\\n\\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\",\"lastModified\":\"2007-03-14T00:00:00\"},{\"organization\":\"Mandriva\",\"comment\":\"Not vulnerable. Mandriva 2007.0 and earlier ship with Kerberos 5 version 1.4.x and as a result are not vulnerable to these issues.\\n\",\"lastModified\":\"2007-01-19T00:00:00\"}]}}" } }
opensuse-su-2024:10899-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
krb5-1.19.2-2.2 on GA media
Notes
Title of the patch
krb5-1.19.2-2.2 on GA media
Description of the patch
These are all security issues fixed in the krb5-1.19.2-2.2 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-10899
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "krb5-1.19.2-2.2 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the krb5-1.19.2-2.2 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-10899", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10899-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2006-6143 page", "url": "https://www.suse.com/security/cve/CVE-2006-6143/" }, { "category": "self", "summary": "SUSE CVE CVE-2006-6144 page", "url": "https://www.suse.com/security/cve/CVE-2006-6144/" }, { "category": "self", "summary": "SUSE CVE CVE-2007-0956 page", "url": "https://www.suse.com/security/cve/CVE-2007-0956/" }, { "category": "self", "summary": "SUSE CVE CVE-2007-0957 page", "url": "https://www.suse.com/security/cve/CVE-2007-0957/" }, { "category": "self", "summary": "SUSE CVE CVE-2007-1216 page", "url": "https://www.suse.com/security/cve/CVE-2007-1216/" }, { "category": "self", "summary": "SUSE CVE CVE-2007-2442 page", "url": "https://www.suse.com/security/cve/CVE-2007-2442/" }, { "category": "self", "summary": "SUSE CVE CVE-2007-2798 page", "url": "https://www.suse.com/security/cve/CVE-2007-2798/" }, { "category": "self", "summary": "SUSE CVE CVE-2007-3999 page", "url": "https://www.suse.com/security/cve/CVE-2007-3999/" }, { "category": "self", "summary": "SUSE CVE CVE-2007-4000 page", "url": "https://www.suse.com/security/cve/CVE-2007-4000/" }, { "category": "self", "summary": "SUSE CVE CVE-2007-5894 page", "url": "https://www.suse.com/security/cve/CVE-2007-5894/" }, { "category": "self", "summary": "SUSE CVE CVE-2007-5902 page", "url": "https://www.suse.com/security/cve/CVE-2007-5902/" }, { "category": "self", "summary": "SUSE CVE CVE-2007-5971 page", "url": "https://www.suse.com/security/cve/CVE-2007-5971/" }, { "category": "self", "summary": "SUSE CVE CVE-2007-5972 page", "url": "https://www.suse.com/security/cve/CVE-2007-5972/" }, { "category": "self", "summary": "SUSE CVE CVE-2008-0062 page", "url": "https://www.suse.com/security/cve/CVE-2008-0062/" }, { "category": "self", "summary": "SUSE CVE CVE-2008-0947 page", "url": "https://www.suse.com/security/cve/CVE-2008-0947/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-11368 page", "url": "https://www.suse.com/security/cve/CVE-2017-11368/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-11462 page", "url": "https://www.suse.com/security/cve/CVE-2017-11462/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-5729 page", "url": "https://www.suse.com/security/cve/CVE-2018-5729/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-36222 page", "url": "https://www.suse.com/security/cve/CVE-2021-36222/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37750 page", "url": "https://www.suse.com/security/cve/CVE-2021-37750/" } ], "title": "krb5-1.19.2-2.2 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:10899-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "krb5-1.19.2-2.2.aarch64", "product": { "name": "krb5-1.19.2-2.2.aarch64", "product_id": "krb5-1.19.2-2.2.aarch64" } }, { "category": "product_version", "name": "krb5-32bit-1.19.2-2.2.aarch64", "product": { "name": "krb5-32bit-1.19.2-2.2.aarch64", "product_id": "krb5-32bit-1.19.2-2.2.aarch64" } }, { "category": "product_version", "name": "krb5-client-1.19.2-2.2.aarch64", "product": { "name": "krb5-client-1.19.2-2.2.aarch64", "product_id": "krb5-client-1.19.2-2.2.aarch64" } }, { "category": "product_version", "name": "krb5-devel-1.19.2-2.2.aarch64", "product": { "name": "krb5-devel-1.19.2-2.2.aarch64", "product_id": "krb5-devel-1.19.2-2.2.aarch64" } }, { "category": "product_version", "name": "krb5-devel-32bit-1.19.2-2.2.aarch64", "product": { "name": "krb5-devel-32bit-1.19.2-2.2.aarch64", "product_id": "krb5-devel-32bit-1.19.2-2.2.aarch64" } }, { "category": "product_version", "name": "krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "product": { "name": "krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "product_id": "krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64" } }, { "category": "product_version", "name": "krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "product": { "name": "krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "product_id": "krb5-plugin-preauth-otp-1.19.2-2.2.aarch64" } }, { "category": "product_version", "name": "krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "product": { "name": "krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "product_id": "krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64" } }, { "category": "product_version", "name": "krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "product": { "name": "krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "product_id": "krb5-plugin-preauth-spake-1.19.2-2.2.aarch64" } }, { "category": "product_version", "name": "krb5-server-1.19.2-2.2.aarch64", "product": { "name": "krb5-server-1.19.2-2.2.aarch64", "product_id": "krb5-server-1.19.2-2.2.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "krb5-1.19.2-2.2.ppc64le", "product": { "name": "krb5-1.19.2-2.2.ppc64le", "product_id": "krb5-1.19.2-2.2.ppc64le" } }, { "category": "product_version", "name": "krb5-32bit-1.19.2-2.2.ppc64le", "product": { "name": "krb5-32bit-1.19.2-2.2.ppc64le", "product_id": "krb5-32bit-1.19.2-2.2.ppc64le" } }, { "category": "product_version", "name": "krb5-client-1.19.2-2.2.ppc64le", "product": { "name": "krb5-client-1.19.2-2.2.ppc64le", "product_id": "krb5-client-1.19.2-2.2.ppc64le" } }, { "category": "product_version", "name": "krb5-devel-1.19.2-2.2.ppc64le", "product": { "name": "krb5-devel-1.19.2-2.2.ppc64le", "product_id": "krb5-devel-1.19.2-2.2.ppc64le" } }, { "category": "product_version", "name": "krb5-devel-32bit-1.19.2-2.2.ppc64le", "product": { "name": "krb5-devel-32bit-1.19.2-2.2.ppc64le", "product_id": "krb5-devel-32bit-1.19.2-2.2.ppc64le" } }, { "category": "product_version", "name": "krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "product": { "name": "krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "product_id": "krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le" } }, { "category": "product_version", "name": "krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "product": { "name": "krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "product_id": "krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le" } }, { "category": "product_version", "name": "krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "product": { "name": "krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "product_id": "krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le" } }, { "category": "product_version", "name": "krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "product": { "name": "krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "product_id": "krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le" } }, { "category": "product_version", "name": "krb5-server-1.19.2-2.2.ppc64le", "product": { "name": "krb5-server-1.19.2-2.2.ppc64le", "product_id": "krb5-server-1.19.2-2.2.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "krb5-1.19.2-2.2.s390x", "product": { "name": "krb5-1.19.2-2.2.s390x", "product_id": "krb5-1.19.2-2.2.s390x" } }, { "category": "product_version", "name": "krb5-32bit-1.19.2-2.2.s390x", "product": { "name": "krb5-32bit-1.19.2-2.2.s390x", "product_id": "krb5-32bit-1.19.2-2.2.s390x" } }, { "category": "product_version", "name": "krb5-client-1.19.2-2.2.s390x", "product": { "name": "krb5-client-1.19.2-2.2.s390x", "product_id": "krb5-client-1.19.2-2.2.s390x" } }, { "category": "product_version", "name": "krb5-devel-1.19.2-2.2.s390x", "product": { "name": "krb5-devel-1.19.2-2.2.s390x", "product_id": "krb5-devel-1.19.2-2.2.s390x" } }, { "category": "product_version", "name": "krb5-devel-32bit-1.19.2-2.2.s390x", "product": { "name": "krb5-devel-32bit-1.19.2-2.2.s390x", "product_id": "krb5-devel-32bit-1.19.2-2.2.s390x" } }, { "category": "product_version", "name": "krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "product": { "name": "krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "product_id": "krb5-plugin-kdb-ldap-1.19.2-2.2.s390x" } }, { "category": "product_version", "name": "krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "product": { "name": "krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "product_id": "krb5-plugin-preauth-otp-1.19.2-2.2.s390x" } }, { "category": "product_version", "name": "krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "product": { "name": "krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "product_id": "krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x" } }, { "category": "product_version", "name": "krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "product": { "name": "krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "product_id": "krb5-plugin-preauth-spake-1.19.2-2.2.s390x" } }, { "category": "product_version", "name": "krb5-server-1.19.2-2.2.s390x", "product": { "name": "krb5-server-1.19.2-2.2.s390x", "product_id": "krb5-server-1.19.2-2.2.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "krb5-1.19.2-2.2.x86_64", "product": { "name": "krb5-1.19.2-2.2.x86_64", "product_id": "krb5-1.19.2-2.2.x86_64" } }, { "category": "product_version", "name": "krb5-32bit-1.19.2-2.2.x86_64", "product": { "name": "krb5-32bit-1.19.2-2.2.x86_64", "product_id": "krb5-32bit-1.19.2-2.2.x86_64" } }, { "category": "product_version", "name": "krb5-client-1.19.2-2.2.x86_64", "product": { "name": "krb5-client-1.19.2-2.2.x86_64", "product_id": "krb5-client-1.19.2-2.2.x86_64" } }, { "category": "product_version", "name": "krb5-devel-1.19.2-2.2.x86_64", "product": { "name": "krb5-devel-1.19.2-2.2.x86_64", "product_id": "krb5-devel-1.19.2-2.2.x86_64" } }, { "category": "product_version", "name": "krb5-devel-32bit-1.19.2-2.2.x86_64", "product": { "name": "krb5-devel-32bit-1.19.2-2.2.x86_64", "product_id": "krb5-devel-32bit-1.19.2-2.2.x86_64" } }, { "category": "product_version", "name": "krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "product": { "name": "krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "product_id": "krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64" } }, { "category": "product_version", "name": "krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "product": { "name": "krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "product_id": "krb5-plugin-preauth-otp-1.19.2-2.2.x86_64" } }, { "category": "product_version", "name": "krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "product": { "name": "krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "product_id": "krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64" } }, { "category": "product_version", "name": "krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "product": { "name": "krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "product_id": "krb5-plugin-preauth-spake-1.19.2-2.2.x86_64" } }, { "category": "product_version", "name": "krb5-server-1.19.2-2.2.x86_64", "product": { "name": "krb5-server-1.19.2-2.2.x86_64", "product_id": "krb5-server-1.19.2-2.2.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "krb5-1.19.2-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64" }, "product_reference": "krb5-1.19.2-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-1.19.2-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le" }, "product_reference": "krb5-1.19.2-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-1.19.2-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x" }, "product_reference": "krb5-1.19.2-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-1.19.2-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64" }, "product_reference": "krb5-1.19.2-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-32bit-1.19.2-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64" }, "product_reference": "krb5-32bit-1.19.2-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-32bit-1.19.2-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le" }, "product_reference": "krb5-32bit-1.19.2-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-32bit-1.19.2-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x" }, "product_reference": "krb5-32bit-1.19.2-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-32bit-1.19.2-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64" }, "product_reference": "krb5-32bit-1.19.2-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-client-1.19.2-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64" }, "product_reference": "krb5-client-1.19.2-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-client-1.19.2-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le" }, "product_reference": "krb5-client-1.19.2-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-client-1.19.2-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x" }, "product_reference": "krb5-client-1.19.2-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-client-1.19.2-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64" }, "product_reference": "krb5-client-1.19.2-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-devel-1.19.2-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64" }, "product_reference": "krb5-devel-1.19.2-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-devel-1.19.2-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le" }, "product_reference": "krb5-devel-1.19.2-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-devel-1.19.2-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x" }, "product_reference": "krb5-devel-1.19.2-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-devel-1.19.2-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64" }, "product_reference": "krb5-devel-1.19.2-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-devel-32bit-1.19.2-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64" }, "product_reference": "krb5-devel-32bit-1.19.2-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-devel-32bit-1.19.2-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le" }, "product_reference": "krb5-devel-32bit-1.19.2-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-devel-32bit-1.19.2-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x" }, "product_reference": "krb5-devel-32bit-1.19.2-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-devel-32bit-1.19.2-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64" }, "product_reference": "krb5-devel-32bit-1.19.2-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64" }, "product_reference": "krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le" }, "product_reference": "krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-kdb-ldap-1.19.2-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x" }, "product_reference": "krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64" }, "product_reference": "krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-preauth-otp-1.19.2-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64" }, "product_reference": "krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le" }, "product_reference": "krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-preauth-otp-1.19.2-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x" }, "product_reference": "krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-preauth-otp-1.19.2-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64" }, "product_reference": "krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64" }, "product_reference": "krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le" }, "product_reference": "krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x" }, "product_reference": "krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64" }, "product_reference": "krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-preauth-spake-1.19.2-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64" }, "product_reference": "krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le" }, "product_reference": "krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-preauth-spake-1.19.2-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x" }, "product_reference": "krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-plugin-preauth-spake-1.19.2-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64" }, "product_reference": "krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-server-1.19.2-2.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64" }, "product_reference": "krb5-server-1.19.2-2.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-server-1.19.2-2.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le" }, "product_reference": "krb5-server-1.19.2-2.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-server-1.19.2-2.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x" }, "product_reference": "krb5-server-1.19.2-2.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "krb5-server-1.19.2-2.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" }, "product_reference": "krb5-server-1.19.2-2.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2006-6143", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2006-6143" } ], "notes": [ { "category": "general", "text": "The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2006-6143", "url": "https://www.suse.com/security/cve/CVE-2006-6143" }, { "category": "external", "summary": "SUSE Bug 225990 for CVE-2006-6143", "url": "https://bugzilla.suse.com/225990" }, { "category": "external", "summary": "SUSE Bug 225992 for CVE-2006-6143", "url": "https://bugzilla.suse.com/225992" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2006-6143" }, { "cve": "CVE-2006-6144", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2006-6144" } ], "notes": [ { "category": "general", "text": "The \"mechglue\" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2006-6144", "url": "https://www.suse.com/security/cve/CVE-2006-6144" }, { "category": "external", "summary": "SUSE Bug 225990 for CVE-2006-6144", "url": "https://bugzilla.suse.com/225990" }, { "category": "external", "summary": "SUSE Bug 225992 for CVE-2006-6144", "url": "https://bugzilla.suse.com/225992" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2006-6144" }, { "cve": "CVE-2007-0956", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2007-0956" } ], "notes": [ { "category": "general", "text": "The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a \u0027-\u0027 character, a similar issue to CVE-2007-0882.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2007-0956", "url": "https://www.suse.com/security/cve/CVE-2007-0956" }, { "category": "external", "summary": "SUSE Bug 247765 for CVE-2007-0956", "url": "https://bugzilla.suse.com/247765" }, { "category": "external", "summary": "SUSE Bug 256319 for CVE-2007-0956", "url": "https://bugzilla.suse.com/256319" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2007-0956" }, { "cve": "CVE-2007-0957", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2007-0957" } ], "notes": [ { "category": "general", "text": "Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC), in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via crafted arguments, possibly involving certain format string specifiers.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2007-0957", "url": "https://www.suse.com/security/cve/CVE-2007-0957" }, { "category": "external", "summary": "SUSE Bug 253548 for CVE-2007-0957", "url": "https://bugzilla.suse.com/253548" }, { "category": "external", "summary": "SUSE Bug 256319 for CVE-2007-0957", "url": "https://bugzilla.suse.com/256319" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2007-0957" }, { "cve": "CVE-2007-1216", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2007-1216" } ], "notes": [ { "category": "general", "text": "Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an \"an invalid direction encoding\".", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2007-1216", "url": "https://www.suse.com/security/cve/CVE-2007-1216" }, { "category": "external", "summary": "SUSE Bug 252487 for CVE-2007-1216", "url": "https://bugzilla.suse.com/252487" }, { "category": "external", "summary": "SUSE Bug 256319 for CVE-2007-1216", "url": "https://bugzilla.suse.com/256319" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2007-1216" }, { "cve": "CVE-2007-2442", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2007-2442" } ], "notes": [ { "category": "general", "text": "The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC credential, which causes kadmind to free an uninitialized pointer during cleanup.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2007-2442", "url": "https://www.suse.com/security/cve/CVE-2007-2442" }, { "category": "external", "summary": "SUSE Bug 271191 for CVE-2007-2442", "url": "https://bugzilla.suse.com/271191" }, { "category": "external", "summary": "SUSE Bug 283681 for CVE-2007-2442", "url": "https://bugzilla.suse.com/283681" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2007-2442" }, { "cve": "CVE-2007-2798", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2007-2798" } ], "notes": [ { "category": "general", "text": "Stack-based buffer overflow in the rename_principal_2_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2007-2798", "url": "https://www.suse.com/security/cve/CVE-2007-2798" }, { "category": "external", "summary": "SUSE Bug 278689 for CVE-2007-2798", "url": "https://bugzilla.suse.com/278689" }, { "category": "external", "summary": "SUSE Bug 283681 for CVE-2007-2798", "url": "https://bugzilla.suse.com/283681" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2007-2798" }, { "cve": "CVE-2007-3999", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2007-3999" } ], "notes": [ { "category": "general", "text": "Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the RPCSEC_GSS RPC library (librpcsecgss) in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and some third-party applications that use krb5, allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long string in an RPC message.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2007-3999", "url": "https://www.suse.com/security/cve/CVE-2007-3999" }, { "category": "external", "summary": "SUSE Bug 302377 for CVE-2007-3999", "url": "https://bugzilla.suse.com/302377" }, { "category": "external", "summary": "SUSE Bug 305261 for CVE-2007-3999", "url": "https://bugzilla.suse.com/305261" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2007-3999" }, { "cve": "CVE-2007-4000", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2007-4000" } ], "notes": [ { "category": "general", "text": "The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the \"modify policy\" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2007-4000", "url": "https://www.suse.com/security/cve/CVE-2007-4000" }, { "category": "external", "summary": "SUSE Bug 302377 for CVE-2007-4000", "url": "https://bugzilla.suse.com/302377" }, { "category": "external", "summary": "SUSE Bug 305261 for CVE-2007-4000", "url": "https://bugzilla.suse.com/305261" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2007-4000" }, { "cve": "CVE-2007-5894", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2007-5894" } ], "notes": [ { "category": "general", "text": "** DISPUTED ** The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors. NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used. NOTE: the vendor disputes this issue, stating \" The \u0027length\u0027 variable is only uninitialized if \u0027auth_type\u0027 is neither the \u0027KERBEROS_V4\u0027 nor \u0027GSSAPI\u0027; this condition cannot occur in the unmodified source code.\"", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2007-5894", "url": "https://www.suse.com/security/cve/CVE-2007-5894" }, { "category": "external", "summary": "SUSE Bug 346745 for CVE-2007-5894", "url": "https://bugzilla.suse.com/346745" }, { "category": "external", "summary": "SUSE Bug 346749 for CVE-2007-5894", "url": "https://bugzilla.suse.com/346749" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2007-5894" }, { "cve": "CVE-2007-5902", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2007-5902" } ], "notes": [ { "category": "general", "text": "Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2007-5902", "url": "https://www.suse.com/security/cve/CVE-2007-5902" }, { "category": "external", "summary": "SUSE Bug 346747 for CVE-2007-5902", "url": "https://bugzilla.suse.com/346747" }, { "category": "external", "summary": "SUSE Bug 346749 for CVE-2007-5902", "url": "https://bugzilla.suse.com/346749" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2007-5902" }, { "cve": "CVE-2007-5971", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2007-5971" } ], "notes": [ { "category": "general", "text": "Double free vulnerability in the gss_krb5int_make_seal_token_v3 function in lib/gssapi/krb5/k5sealv3.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2007-5971", "url": "https://www.suse.com/security/cve/CVE-2007-5971" }, { "category": "external", "summary": "SUSE Bug 346748 for CVE-2007-5971", "url": "https://bugzilla.suse.com/346748" }, { "category": "external", "summary": "SUSE Bug 346749 for CVE-2007-5971", "url": "https://bugzilla.suse.com/346749" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2007-5971" }, { "cve": "CVE-2007-5972", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2007-5972" } ], "notes": [ { "category": "general", "text": "Double free vulnerability in the krb5_def_store_mkey function in lib/kdb/kdb_default.c in MIT Kerberos 5 (krb5) 1.5 has unknown impact and remote authenticated attack vectors. NOTE: the free operations occur in code that stores the krb5kdc master key, and so the attacker must have privileges to store this key.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2007-5972", "url": "https://www.suse.com/security/cve/CVE-2007-5972" }, { "category": "external", "summary": "SUSE Bug 346749 for CVE-2007-5972", "url": "https://bugzilla.suse.com/346749" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2007-5972" }, { "cve": "CVE-2008-0062", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2008-0062" } ], "notes": [ { "category": "general", "text": "KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2008-0062", "url": "https://www.suse.com/security/cve/CVE-2008-0062" }, { "category": "external", "summary": "SUSE Bug 361373 for CVE-2008-0062", "url": "https://bugzilla.suse.com/361373" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2008-0062" }, { "cve": "CVE-2008-0947", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2008-0947" } ], "notes": [ { "category": "general", "text": "Buffer overflow in the RPC library used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.4 through 1.6.3 allows remote attackers to execute arbitrary code by triggering a large number of open file descriptors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2008-0947", "url": "https://www.suse.com/security/cve/CVE-2008-0947" }, { "category": "external", "summary": "SUSE Bug 363151 for CVE-2008-0947", "url": "https://bugzilla.suse.com/363151" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2008-0947" }, { "cve": "CVE-2017-11368", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-11368" } ], "notes": [ { "category": "general", "text": "In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-11368", "url": "https://www.suse.com/security/cve/CVE-2017-11368" }, { "category": "external", "summary": "SUSE Bug 1049819 for CVE-2017-11368", "url": "https://bugzilla.suse.com/1049819" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-11368" }, { "cve": "CVE-2017-11462", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-11462" } ], "notes": [ { "category": "general", "text": "Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-11462", "url": "https://www.suse.com/security/cve/CVE-2017-11462" }, { "category": "external", "summary": "SUSE Bug 1056995 for CVE-2017-11462", "url": "https://bugzilla.suse.com/1056995" }, { "category": "external", "summary": "SUSE Bug 1122468 for CVE-2017-11462", "url": "https://bugzilla.suse.com/1122468" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-11462" }, { "cve": "CVE-2018-5729", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-5729" } ], "notes": [ { "category": "general", "text": "MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-5729", "url": "https://www.suse.com/security/cve/CVE-2018-5729" }, { "category": "external", "summary": "SUSE Bug 1076211 for CVE-2018-5729", "url": "https://bugzilla.suse.com/1076211" }, { "category": "external", "summary": "SUSE Bug 1083926 for CVE-2018-5729", "url": "https://bugzilla.suse.com/1083926" }, { "category": "external", "summary": "SUSE Bug 1122468 for CVE-2018-5729", "url": "https://bugzilla.suse.com/1122468" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-5729" }, { "cve": "CVE-2021-36222", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2021-36222" } ], "notes": [ { "category": "general", "text": "ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2021-36222", "url": "https://www.suse.com/security/cve/CVE-2021-36222" }, { "category": "external", "summary": "SUSE Bug 1188571 for CVE-2021-36222", "url": "https://bugzilla.suse.com/1188571" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2021-36222" }, { "cve": "CVE-2021-37750", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2021-37750" } ], "notes": [ { "category": "general", "text": "The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2021-37750", "url": "https://www.suse.com/security/cve/CVE-2021-37750" }, { "category": "external", "summary": "SUSE Bug 1189929 for CVE-2021-37750", "url": "https://bugzilla.suse.com/1189929" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:krb5-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-client-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2.x86_64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.aarch64", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.ppc64le", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.s390x", "openSUSE Tumbleweed:krb5-server-1.19.2-2.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2021-37750" } ] }
gsd-2006-6144
Vulnerability from gsd
Modified
2023-12-13 01:19
Details
The "mechglue" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2006-6144", "description": "The \"mechglue\" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers.", "id": "GSD-2006-6144", "references": [ "https://www.suse.com/security/cve/CVE-2006-6144.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2006-6144" ], "details": "The \"mechglue\" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers.", "id": "GSD-2006-6144", "modified": "2023-12-13T01:19:53.727559Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-6144", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The \"mechglue\" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "kerberos-gssapi-code-execution(31417)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31417" }, { "name": "102772", "refsource": "SUNALERT", "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102772-1" }, { "name": "201294", "refsource": "SUNALERT", "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-201294-1" }, { "name": "TA07-009B", "refsource": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA07-009B.html" }, { "name": "23690", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23690" }, { "name": "SUSE-SA:2007:004", "refsource": "SUSE", "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html" }, { "name": "1017494", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1017494" }, { "name": "23706", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23706" }, { "name": "20070109 MITKRB5-SA-2006-003: kadmind (via GSS-API lib) frees uninitialized pointers", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/456409/100/0/threaded" }, { "name": "23903", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23903" }, { "name": "GLSA-200701-21", "refsource": "GENTOO", "url": "http://security.gentoo.org/glsa/glsa-200701-21.xml" }, { "name": "OpenPKG-SA-2007.006", "refsource": "OPENPKG", "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.006.html" }, { "name": "FEDORA-2007-033", "refsource": "FEDORA", "url": "http://fedoranews.org/cms/node/2375" }, { "name": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-003-mechglue.txt", "refsource": "CONFIRM", "url": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-003-mechglue.txt" }, { "name": "https://issues.rpath.com/browse/RPL-925", "refsource": "CONFIRM", "url": "https://issues.rpath.com/browse/RPL-925" }, { "name": "ADV-2007-0112", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/0112" }, { "name": "31280", "refsource": "OSVDB", "url": "http://osvdb.org/31280" }, { "name": "35151", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/35151" }, { "name": "21975", "refsource": "BID", "url": "http://www.securityfocus.com/bid/21975" }, { "name": "ADV-2007-0111", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/0111" }, { "name": "VU#831452", "refsource": "CERT-VN", "url": "http://www.kb.cert.org/vuls/id/831452" }, { "name": "23701", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23701" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "1.5.1", "versionStartIncluding": "1.5", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-6144" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "The \"mechglue\" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "NVD-CWE-noinfo" } ] } ] }, "references": { "reference_data": [ { "name": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-003-mechglue.txt", "refsource": "CONFIRM", "tags": [ "Patch", "Vendor Advisory" ], "url": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-003-mechglue.txt" }, { "name": "TA07-009B", "refsource": "CERT", "tags": [ "Third Party Advisory", "US Government Resource" ], "url": "http://www.us-cert.gov/cas/techalerts/TA07-009B.html" }, { "name": "VU#831452", "refsource": "CERT-VN", "tags": [ "Third Party Advisory", "US Government Resource" ], "url": "http://www.kb.cert.org/vuls/id/831452" }, { "name": "FEDORA-2007-033", "refsource": "FEDORA", "tags": [ "Broken Link" ], "url": "http://fedoranews.org/cms/node/2375" }, { "name": "OpenPKG-SA-2007.006", "refsource": "OPENPKG", "tags": [ "Third Party Advisory" ], "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.006.html" }, { "name": "102772", "refsource": "SUNALERT", "tags": [ "Broken Link" ], "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102772-1" }, { "name": "SUSE-SA:2007:004", "refsource": "SUSE", "tags": [ "Broken Link" ], "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html" }, { "name": "21975", "refsource": "BID", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/bid/21975" }, { "name": "23690", "refsource": "SECUNIA", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/23690" }, { "name": "23701", "refsource": "SECUNIA", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/23701" }, { "name": "23706", "refsource": "SECUNIA", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/23706" }, { "name": "1017494", "refsource": "SECTRACK", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://securitytracker.com/id?1017494" }, { "name": "https://issues.rpath.com/browse/RPL-925", "refsource": "CONFIRM", "tags": [ "Broken Link" ], "url": "https://issues.rpath.com/browse/RPL-925" }, { "name": "GLSA-200701-21", "refsource": "GENTOO", "tags": [ "Third Party Advisory" ], "url": "http://security.gentoo.org/glsa/glsa-200701-21.xml" }, { "name": "23903", "refsource": "SECUNIA", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/23903" }, { "name": "31280", "refsource": "OSVDB", "tags": [ "Broken Link" ], "url": "http://osvdb.org/31280" }, { "name": "201294", "refsource": "SUNALERT", "tags": [ "Broken Link" ], "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-201294-1" }, { "name": "35151", "refsource": "SECUNIA", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/35151" }, { "name": "ADV-2007-0112", "refsource": "VUPEN", "tags": [ "Third Party Advisory" ], "url": "http://www.vupen.com/english/advisories/2007/0112" }, { "name": "ADV-2007-0111", "refsource": "VUPEN", "tags": [ "Third Party Advisory" ], "url": "http://www.vupen.com/english/advisories/2007/0111" }, { "name": "kerberos-gssapi-code-execution(31417)", "refsource": "XF", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31417" }, { "name": "20070109 MITKRB5-SA-2006-003: kadmind (via GSS-API lib) frees uninitialized pointers", "refsource": "BUGTRAQ", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/archive/1/456409/100/0/threaded" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false } }, "lastModifiedDate": "2021-02-02T18:13Z", "publishedDate": "2006-12-31T05:00Z" } } }
ghsa-vm45-rfxq-cf44
Vulnerability from github
Published
2022-05-01 07:35
Modified
2022-05-01 07:35
VLAI Severity ?
Details
The "mechglue" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers.
{ "affected": [], "aliases": [ "CVE-2006-6144" ], "database_specific": { "cwe_ids": [], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2006-12-31T05:00:00Z", "severity": "MODERATE" }, "details": "The \"mechglue\" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers.", "id": "GHSA-vm45-rfxq-cf44", "modified": "2022-05-01T07:35:12Z", "published": "2022-05-01T07:35:12Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-6144" }, { "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31417" }, { "type": "WEB", "url": "https://issues.rpath.com/browse/RPL-925" }, { "type": "WEB", "url": "http://fedoranews.org/cms/node/2375" }, { "type": "WEB", "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html" }, { "type": "WEB", "url": "http://osvdb.org/31280" }, { "type": "WEB", "url": "http://secunia.com/advisories/23690" }, { "type": "WEB", "url": "http://secunia.com/advisories/23701" }, { "type": "WEB", "url": "http://secunia.com/advisories/23706" }, { "type": "WEB", "url": "http://secunia.com/advisories/23903" }, { "type": "WEB", "url": "http://secunia.com/advisories/35151" }, { "type": "WEB", "url": "http://security.gentoo.org/glsa/glsa-200701-21.xml" }, { "type": "WEB", "url": "http://securitytracker.com/id?1017494" }, { "type": "WEB", "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102772-1" }, { "type": "WEB", "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-201294-1" }, { "type": "WEB", "url": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-003-mechglue.txt" }, { "type": "WEB", "url": "http://www.kb.cert.org/vuls/id/831452" }, { "type": "WEB", "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.006.html" }, { "type": "WEB", "url": "http://www.securityfocus.com/archive/1/456409/100/0/threaded" }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/21975" }, { "type": "WEB", "url": "http://www.us-cert.gov/cas/techalerts/TA07-009B.html" }, { "type": "WEB", "url": "http://www.vupen.com/english/advisories/2007/0111" }, { "type": "WEB", "url": "http://www.vupen.com/english/advisories/2007/0112" } ], "schema_version": "1.4.0", "severity": [] }
fkie_cve-2006-6144
Vulnerability from fkie_nvd
Published
2006-12-31 05:00
Modified
2025-04-09 00:30
Severity ?
Summary
The "mechglue" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers.
References
Impacted products
Vendor | Product | Version | |
---|---|---|---|
mit | kerberos_5 | * |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*", "matchCriteriaId": "41C9B47F-522F-4966-AC17-967769F66712", "versionEndIncluding": "1.5.1", "versionStartIncluding": "1.5", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "The \"mechglue\" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers." }, { "lang": "es", "value": "La abstracci\u00f3n de interfaz \"mechglue\" de la biblioteca GSS-API para Kerberos 5 1.5 hasta 1.5.1, tal y como se usan en el demonio de administraci\u00f3n Kerberos (kadmind) y otros productos que utilizan esta biblioteca, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda) mediante vectores desconocidos que provoca que mechglue libere punteros sin inicializar." } ], "id": "CVE-2006-6144", "lastModified": "2025-04-09T00:30:58.490", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false } ] }, "published": "2006-12-31T05:00:00.000", "references": [ { "source": "cve@mitre.org", "tags": [ "Broken Link" ], "url": "http://fedoranews.org/cms/node/2375" }, { "source": "cve@mitre.org", "tags": [ "Broken Link" ], "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html" }, { "source": "cve@mitre.org", "tags": [ "Broken Link" ], "url": "http://osvdb.org/31280" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/23690" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/23701" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/23706" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/23903" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/35151" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "http://security.gentoo.org/glsa/glsa-200701-21.xml" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://securitytracker.com/id?1017494" }, { "source": "cve@mitre.org", "tags": [ "Broken Link" ], "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102772-1" }, { "source": "cve@mitre.org", "tags": [ "Broken Link" ], "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-201294-1" }, { "source": "cve@mitre.org", "tags": [ "Patch", "Vendor Advisory" ], "url": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-003-mechglue.txt" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory", "US Government Resource" ], "url": "http://www.kb.cert.org/vuls/id/831452" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.006.html" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/archive/1/456409/100/0/threaded" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/bid/21975" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory", "US Government Resource" ], "url": "http://www.us-cert.gov/cas/techalerts/TA07-009B.html" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "http://www.vupen.com/english/advisories/2007/0111" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "http://www.vupen.com/english/advisories/2007/0112" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31417" }, { "source": "cve@mitre.org", "tags": [ "Broken Link" ], "url": "https://issues.rpath.com/browse/RPL-925" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Broken Link" ], "url": "http://fedoranews.org/cms/node/2375" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Broken Link" ], "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Broken Link" ], "url": "http://osvdb.org/31280" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/23690" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/23701" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/23706" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/23903" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/35151" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "http://security.gentoo.org/glsa/glsa-200701-21.xml" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://securitytracker.com/id?1017494" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Broken Link" ], "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102772-1" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Broken Link" ], "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-201294-1" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Vendor Advisory" ], "url": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-003-mechglue.txt" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "US Government Resource" ], "url": "http://www.kb.cert.org/vuls/id/831452" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.006.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/archive/1/456409/100/0/threaded" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/bid/21975" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "US Government Resource" ], "url": "http://www.us-cert.gov/cas/techalerts/TA07-009B.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "http://www.vupen.com/english/advisories/2007/0111" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "http://www.vupen.com/english/advisories/2007/0112" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31417" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Broken Link" ], "url": "https://issues.rpath.com/browse/RPL-925" } ], "sourceIdentifier": "cve@mitre.org", "vendorComments": [ { "comment": "Not vulnerable. Red Hat Enterprise Linux 2.1, 3, and 4 ship with versions of Kerberos 5 prior to version 1.4 and are therefore not affected by these vulnerabilities.\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", "lastModified": "2007-03-14T00:00:00", "organization": "Red Hat" }, { "comment": "Not vulnerable. Mandriva 2007.0 and earlier ship with Kerberos 5 version 1.4.x and as a result are not vulnerable to these issues.\n", "lastModified": "2007-01-19T00:00:00", "organization": "Mandriva" } ], "vulnStatus": "Deferred", "weaknesses": [ { "description": [ { "lang": "en", "value": "NVD-CWE-noinfo" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…