DEBIAN-CVE-2014-4343
Advisory lineage Upstream: 1 Downstream: 2
Upstream
Downstream
Published: 14 Aug 2014, 05:01
Last modified:28 Apr 2026, 20:13
Vulnerability Summary
Overall Risk (default)
minimal
0/100 CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
14 Aug 2014, 05:01
Published
Vulnerability first disclosed
28 Apr 2026, 20:13
Last Modified
Vulnerability information updated
Description
Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.
Affected Systems
- debian•krb5
< 1.12.1+dfsg-5 | < 1.12.1+dfsg-5 | < 1.12.1+dfsg-5 | < 1.12.1+dfsg-5