CVE-2014-4344: debian debian_linux NULL Pointer Dereference
Vulnerability summary
CVE-2014-4344 is a high (CVSS 7.8) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 6.61% chance of exploitation in the next 30 days, higher than 93.8% of scored vulnerabilities.
Not severe (CVSS 7.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 2Timeline
- 14-08-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
6.61%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
No change 0.00 pp
From 6.61% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Redhat4 products
Debian2 products
- krb5< 1.12.1+dfsg-5
- debian_linuxEOL7.0
Mit1 product
- kerberos_51.10 | 1.10.1 | 1.10.2 | 1.10.3 | 1.10.4 | 1.1.1 | 1.11.1 | 1.11.2 | 1.11.3 | 1.11.4 | 1.11.5 | 1.12 | 1.12.1
Ubuntu1 product
- krb5< 1.12+dfsg-2ubuntu4.2
4 vendors · 8 products
References
23 links- github.com/krb5/krb5/commit/a7886f0ed1277c69142b14a2c6629175a6331edcX Refsource CONFIRMIssue TrackingPatchThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1121877X Refsource CONFIRM
- aix.software.ibm.com/aix/efixes/security/nas_advisory1.ascX Refsource CONFIRM
- support.f5.com/kb/en-us/solutions/public/15000/500/sol15561.htmlX Refsource CONFIRM
- lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.htmlVendor AdvisoryX Refsource FEDORA
Show all 23 references
- advisories.mageia.org/MGASA-2014-0345.htmlX Refsource CONFIRM