CVE-2015-2697 PUBLISHED

The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.

EPSS 6.39% · 90.9th percentile

Risk Scores

EPSS Score
6.39%
90.9th percentile

Affected Products

VendorProductVersions
Ubuntu:14.04:LTSkrb50, 1.10.1+dfsg-6.1ubuntu1, 1.11.3+dfsg-3ubuntu2

Timeline

References

Open in Interactive Console →