CVE-2015-2697
Fixed in a distro release EPSS 4%
The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.
Products: mit kerberos_5, oracle solaris, canonical ubuntu_linux, debian_linux, opensuse leap, opensuse, suse linux_enterprise_desktop, suse linux_enterprise_server, suse linux_enterprise_software_development_kit
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | krb5 | 1.13.2+dfsg-3 |
| Debian 13 | krb5 | 1.13.2+dfsg-3 |
| Debian 14 | krb5 | 1.13.2+dfsg-3 |
| Debian 6.0 | krb5 | 1.8.3+dfsg-4squeeze10 |
| Debian 7 | krb5 | 1.10.1+dfsg-5+deb7u6 |
| Debian 7 | krb5 | 1.10.1+dfsg-5+deb7u4 |
| Debian 8 | krb5 | 1.12.1+dfsg-19+deb8u1 |
| SUSE Linux Enterprise Desktop 12 | krb5 | 1.12.1-19.1 |
| SUSE Linux Enterprise Server 12 | krb5 | 1.12.1-19.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | krb5 | 1.12.1-19.1 |
| SUSE Linux Enterprise Software Development Kit 12 | krb5 | 1.12.1-19.1 |
| Ubuntu 14.04 LTS | krb5 | 1.12+dfsg-2ubuntu5.2 |
| openSUSE Tumbleweed | krb5 | 1.15-1.1 |