CVE-2014-5353: canonical ubuntu_linux NULL Pointer Dereference
Vulnerability summary
CVE-2014-5353 is a low (CVSS 3.5) NULL Pointer Dereference vulnerability in canonical ubuntu_linux. EPSS estimates a 4.97% chance of exploitation in the next 30 days, higher than 92.2% of scored vulnerabilities.
Not severe (CVSS 3.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 4Timeline
- 16-12-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
4.97%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.97% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, authentication (CVSS vector). Other conditions: not stated in public data.
Redhat6 products
- enterprise_linux_desktop6.0
- enterprise_linux_eus6.6 | 7.3 | 7.4 | 7.5 | 7.6 | 7.7
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus6.6 | 7.3 | 7.4 | 7.6 | 7.7
- enterprise_linux_server_tus6.6 | 7.3 | 7.6 | 7.7
Debian2 products
- krb5< 1.12.1+dfsg-16
- debian_linuxEOL7.0
Canonical1 product
- ubuntu_linuxEOL10.04 | 12.04 | 14.04 | 14.10
Fedoraproject1 product
- fedoraEOL22
Mageia1 product
- krb5< 1.11.4-1.3.mga4
Mit1 product
- kerberos_5< 1.13.1
Opensuse1 product
- opensuseEOL13.1 | 13.2
Oracle1 product
- solarisEOL10 | 11.2
Ubuntu1 product
- krb5< 1.12+dfsg-2ubuntu5.1
9 vendors · 15 products
References
19 links
lists.debian.org/debian-lts-announce/2018/01/msg00040.htmlMailing ListX Refsource MLISTThird Party Advisory- bugs.debian.org/cgi-bin/bugreport.cgi?bug=773226X Refsource CONFIRMIssue TrackingMailing ListThird Party AdvisoryREPORT
- lists.fedoraproject.org/pipermail/package-announce/2015-April/155828.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- www.mandriva.com/security/advisories?name=MDVSA-2015:009Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
- lists.opensuse.org/opensuse-updates/2015-03/msg00061.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.htmlX Refsource CONFIRMThird Party Advisory
- github.com/krb5/krb5/commit/d1f707024f1d0af6e54a18885322d70fa15ec4d3X Refsource CONFIRMPatchThird Party Advisory