CveMateVulnerability intelligence

CVE-2009-0846: apple mac_os_x Access of Uninitialized Pointer

Modified

AliasesRHSA-2009:0409RHSA-2009:0410DEBIAN-CVE-2009-0846

Published 09-04-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-0846 is a high (CVSS 10.0) Access of Uninitialized Pointer vulnerability in apple mac_os_x. EPSS estimates a 8.90% chance of exploitation in the next 30 days, higher than 95.2% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 10, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

8.90%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 1

DSA-1766-1 OPENSUSE-SU-2024:10004-1 RHSA-2009:0408

Timeline

09-04-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.

CVSS metrics

1 score · 1 source · 1 version

v2.010.0

EPSS trend

Probability

8.90%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

No change 0.00 pp

From 8.90% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-824Access of Uninitialized PointerThe product accesses or uses a pointer that has not been initialized.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat11 products

enterprise_linuxEOL4.0
enterprise_linux_desktop3.0 | 4.0
enterprise_linux_eus4.7
enterprise_linux_server2.0 | 3.0 | 4.0
enterprise_linux_workstation2.0 | 3.0 | 4.0

Show all 11

Apple1 product

mac_os_x< 10.5.7

Canonical1 product

ubuntu_linuxEOL6.06 | 7.10 | 8.04 | 8.10

Debian1 product

krb5< 1.6.dfsg.4~beta1-13

Fedoraproject1 product

fedoraEOL9 | 10

Mit1 product

kerberos_5< 1.6.4

6 vendors · 16 products

References

61 links

www.securityfocus.com/archive/1/504683/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047181.htmlX Refsource MISCBroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6301VDB EntrySignatureX Refsource OVALBroken Link
www.mandriva.com/security/advisories?name=MDVSA-2009:098Vendor AdvisoryX Refsource MANDRIVABroken Link
www.kb.cert.org/vuls/id/662091Third Party AdvisoryX Refsource CERT VNBroken LinkUS Government Resource
www.securityfocus.com/archive/1/502527/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
www.vupen.com/english/advisories/2009/0960VDB EntryX Refsource VUPENBroken Link
support.apple.com/kb/HT3549X Refsource CONFIRMThird Party Advisory
support.avaya.com/elmodocs2/security/ASA-2009-142.htmX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/35667Third Party AdvisoryX Refsource SECUNIABroken Link

Show all 61 references

www.redhat.com/support/errata/RHSA-2009-0408.htmlVendor AdvisoryX Refsource REDHATBroken Link
www.vmware.com/security/advisories/VMSA-2009-0008.htmlX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/34637Third Party AdvisoryX Refsource SECUNIABroken Link
marc.info?l=bugtraq&m=130497213107107&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
www.vupen.com/english/advisories/2009/2084VDB EntryX Refsource VUPENBroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10694VDB EntrySignatureX Refsource OVALBroken Link
secunia.com/advisories/34640Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/35074Third Party AdvisoryX Refsource SECUNIABroken Link
sunsolve.sun.com/search/document.do?assetkey=1-26-256728-1Vendor AdvisoryX Refsource SUNALERTBroken Link
security.gentoo.org/glsa/glsa-200904-09.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047180.htmlX Refsource MISCBroken Link
www.vupen.com/english/advisories/2009/0976VDB EntryX Refsource VUPENBroken Link
lists.apple.com/archives/security-announce/2009/May/msg00002.htmlVendor AdvisoryX Refsource APPLEMailing List
www.ubuntu.com/usn/usn-755-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/34630Third Party AdvisoryX Refsource SECUNIABroken Link
www-01.ibm.com/support/docview.wss?uid=swg21396120X Refsource CONFIRMBroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5483VDB EntrySignatureX Refsource OVALBroken Link
www.vupen.com/english/advisories/2009/1057VDB EntryX Refsource VUPENBroken Link
secunia.com/advisories/34617Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/34628Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/34734Third Party AdvisoryX Refsource SECUNIABroken Link
www.vupen.com/english/advisories/2009/2248VDB EntryX Refsource VUPENBroken Link
www.us-cert.gov/cas/techalerts/TA09-133A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
wiki.rpath.com/wiki/Advisories:rPSA-2009-0058X Refsource MISCBroken Link
secunia.com/advisories/34598Third Party AdvisoryX Refsource SECUNIABroken Link
rhn.redhat.com/errata/RHSA-2009-0409.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.vupen.com/english/advisories/2009/1297VDB EntryX Refsource VUPENBroken Link
secunia.com/advisories/34622Third Party AdvisoryX Refsource SECUNIABroken Link
www.securitytracker.com/id?1021994VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2009-April/msg00206.htmlVendor AdvisoryX Refsource FEDORAMailing List
www.redhat.com/archives/fedora-package-announce/2009-April/msg00205.htmlVendor AdvisoryX Refsource FEDORAMailing List
rhn.redhat.com/errata/RHSA-2009-0410.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
lists.vmware.com/pipermail/security-announce/2009/000059.htmlMailing ListX Refsource MLISTBroken Link
wiki.rpath.com/Advisories:rPSA-2009-0058X Refsource CONFIRMBroken Link
www.securityfocus.com/archive/1/502546/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-002.txtX Refsource CONFIRMPatchVendor AdvisoryARTICLE
secunia.com/advisories/34594Third Party AdvisoryX Refsource SECUNIABroken Link
www.vupen.com/english/advisories/2009/1106VDB EntryX Refsource VUPENBroken Link
marc.info?l=bugtraq&m=124896429301168&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
www.securityfocus.com/bid/34409VDB EntryX Refsource BIDBroken LinkThird Party Advisory
access.redhat.com/errata/RHSA-2009:0409Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=491036REPORT
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0409.jsonAdvisory
access.redhat.com/security/cve/CVE-2009-0846REPORT
www.cve.org/CVERecord?id=CVE-2009-0846Advisory
nvd.nist.gov/vuln/detail/CVE-2009-0846Advisory
access.redhat.com/errata/RHSA-2009:0410Advisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0410.jsonAdvisory
security-tracker.debian.org/tracker/CVE-2009-0846Advisory