Total vulnerabilities in the database
The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.
| Software | From | Fixed in |
|---|---|---|
| mit / kerberos_5 | - | 1.14 |
| oracle / solaris | 11.3 | 11.3.x |
| canonical / ubuntu_linux | 15.10 | 15.10.x |
| canonical / ubuntu_linux | 15.04 | 15.04.x |
| canonical / ubuntu_linux | 14.04 | 14.04.x |
| canonical / ubuntu_linux | 12.04 | 12.04.x |
| debian / debian_linux | 8.0 | 8.0.x |
| debian / debian_linux | 7.0 | 7.0.x |
| debian / debian_linux | 9.0 | 9.0.x |
| opensuse / leap | 42.1 | 42.1.x |
| opensuse / opensuse | 13.1 | 13.1.x |
| opensuse / opensuse | 13.2 | 13.2.x |
| suse / linux_enterprise_server | 12 | 12.x |
| suse / linux_enterprise_software_development_kit | 12 | 12.x |
| suse / linux_enterprise_desktop | 12 | 12.x |