CVE-2007-4000: fedoraproject fedora Access of Uninitialized Pointer
Vulnerability summary
CVE-2007-4000 is a high (CVSS 8.5) Access of Uninitialized Pointer vulnerability in fedoraproject fedora. EPSS estimates a 6.14% chance of exploitation in the next 30 days, higher than 93.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 05-09-2007PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
6.14%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 6.14% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- krb5< 1.6.dfsg.1-7
Fedoraproject1 product
- fedoraEOL7
Mit1 product
- kerberos_5≥ 1.5, ≤ 1.6.2
3 vendors · 3 products
References
23 links- www.gentoo.org/security/en/glsa/glsa-200709-01.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
- www.redhat.com/archives/fedora-package-announce/2007-September/msg00087.htmlVendor AdvisoryX Refsource FEDORAMailing List
Show all 23 references
- www.securityfocus.com/archive/1/478794/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9278VDB EntrySignatureX Refsource OVALBroken Link
- www.redhat.com/support/errata/RHSA-2007-0858.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
- www.mandriva.com/security/advisories?name=MDKSA-2007:174Vendor AdvisoryX Refsource MANDRIVABroken Link