GCVE-110-MAGEIA-2016-306

Advisory Published

Vulnetix · Advisory published September 16, 2016

The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request (CVE-2016-3120).

Download JSON Open in Console

Affected Products

Vendor	Product	Versions	Platforms
Mageia	krb5	0 (affected), 1.12.5-1.1.mga5 (unaffected)	—

References

Updated krb5 packages fix security vulnerability

advisory

Updated krb5 packages fix security vulnerability

issue

Updated krb5 packages fix security vulnerability

issue

Browse GCVE Records

72,664 records in the GCVE database · Updated July 15, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON