Vulnerabilities > MIT > Kerberos > 5.1.6.3
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-12-26 | CVE-2018-20217 | Reachable Assertion vulnerability in multiple products A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. | 5.3 |
| 2018-01-16 | CVE-2018-5710 | NULL Pointer Dereference vulnerability in MIT Kerberos An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. | 6.5 |
| 2018-01-16 | CVE-2018-5709 | Integer Overflow or Wraparound vulnerability in MIT Kerberos An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. | 7.5 |
| 2011-02-10 | CVE-2011-0282 | Denial Of Service vulnerability in MIT Kerberos KDC Principal Name LDAP Request NULL Pointer The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.6.x through 1.9, when an LDAP backend is used, allows remote attackers to cause a denial of service (NULL pointer dereference or buffer over-read, and daemon crash) via a crafted principal name. | 5.0 |
| 2011-02-10 | CVE-2011-0281 | Cryptographic Issues vulnerability in MIT Kerberos and Kerberos 5 The unparse implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.6.x through 1.9, when an LDAP backend is used, allows remote attackers to cause a denial of service (file descriptor exhaustion and daemon hang) via a principal name that triggers use of a backslash escape sequence, as demonstrated by a \n sequence. | 5.0 |
| 2010-01-13 | CVE-2009-4212 | Numeric Errors vulnerability in MIT Kerberos and Kerberos 5 Multiple integer underflows in the (1) AES and (2) RC4 decryption functionality in the crypto library in MIT Kerberos 5 (aka krb5) 1.3 through 1.6.3, and 1.7 before 1.7.1, allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by providing ciphertext with a length that is too short to be valid. | 10.0 |
| 2009-04-09 | CVE-2009-0847 | Numeric Errors vulnerability in MIT Kerberos 51.6.3 The asn1buf_imbed function in the ASN.1 decoder in MIT Kerberos 5 (aka krb5) 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service (application crash) via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmetic. | 4.3 |
| 2009-04-09 | CVE-2009-0844 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in MIT Kerberos and Kerberos 5 The get_input_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read. | 5.8 |
| 2009-03-27 | CVE-2009-0845 | Improper Input Validation vulnerability in MIT Kerberos and Kerberos 5 The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via invalid ContextFlags data in the reqFlags field in a negTokenInit token. | 5.0 |