CVE-2015-8630: mit kerberos_5
Vulnerability summary
CVE-2015-8630 is a high (CVSS 7.5) vulnerability in mit kerberos_5. EPSS estimates a 4.29% chance of exploitation in the next 30 days, higher than 91% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 13-02-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by specifying KADM5_POLICY with a NULL policy name.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
4.29%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.29% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Alpine1 product
- krb5< 1.14-r1
Debian1 product
- krb5< 1.13.2+dfsg-5
Mit1 product
- kerberos_51.12 | 1.12.1 | 1.12.2 | 1.12.3 | 1.12.4 | 1.12.5 | 1.13 | 1.13.1 | 1.13.2 | 1.13.3 | 1.14 | 1.14:alpha1 | 1.14:beta1 | 1.14:beta2
Ubuntu1 product
- krb5< 1.12+dfsg-2ubuntu5.4
4 vendors · 4 products
References
12 links
- krbdev.mit.edu/rt/Ticket/Display.html?id=8342X Refsource CONFIRM
- www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlX Refsource CONFIRM