CVE-2007-1216: canonical ubuntu_linux Double Free
- 1 reference with an unsupported link type was hidden.
Vulnerability summary
CVE-2007-1216 is a high (CVSS 9.0) Double Free vulnerability in canonical ubuntu_linux. EPSS estimates a 9.88% chance of exploitation in the next 30 days, higher than 95.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 1Timeline
- 06-04-2007PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an "an invalid direction encoding".
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
9.88%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 9.88% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- krb5< 1.4.4-8
- debian_linuxEOL3.1 | 4.0
Canonical1 product
- ubuntu_linuxEOL5.10 | 6.06 | 6.10
Mit1 product
- kerberos_5< 1.6.1
3 vendors · 4 products
References
35 links- h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056923Vendor AdvisoryX Refsource HPBroken Link
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11135VDB EntrySignatureX Refsource OVALBroken LinkThird Party Advisory
- www.redhat.com/support/errata/RHSA-2007-0095.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
Show all 35 references
- www.us-cert.gov/cas/techalerts/TA07-093B.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
- www.securityfocus.com/archive/1/464814/30/7170/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
- www.us-cert.gov/cas/techalerts/TA07-109A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
- www.securityfocus.com/archive/1/464591/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
- lists.suse.com/archive/suse-security-announce/2007-Apr/0001.htmlVendor AdvisoryX Refsource SUSEBroken Link
- www.mandriva.com/security/advisories?name=MDKSA-2007:077Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
- lists.apple.com/archives/Security-announce/2007/Apr/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
- www.securityfocus.com/archive/1/464666/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry