CVE-2015-2696
Fixed in a distro release EPSS 5%
lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call.
Products: mit kerberos_5, opensuse leap, opensuse, suse linux_enterprise_desktop, suse linux_enterprise_server, suse linux_enterprise_software_development_kit, debian_linux, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | krb5 | 1.13.2+dfsg-3 |
| Debian 13 | krb5 | 1.13.2+dfsg-3 |
| Debian 14 | krb5 | 1.13.2+dfsg-3 |
| Debian 7 | krb5 | 1.10.1+dfsg-5+deb7u4 |
| Debian 8 | krb5 | 1.12.1+dfsg-19+deb8u1 |
| SUSE Linux Enterprise Desktop 12 | krb5 | 1.12.1-19.1 |
| SUSE Linux Enterprise Server 12 | krb5 | 1.12.1-19.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | krb5 | 1.12.1-19.1 |
| SUSE Linux Enterprise Software Development Kit 12 | krb5 | 1.12.1-19.1 |
| Ubuntu 14.04 LTS | krb5 | 1.12+dfsg-2ubuntu5.2 |
| openSUSE Tumbleweed | krb5 | 1.15-1.1 |