CVE-2014-9423

The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x…

published February 19, 2015

CVSS
—
EPSS
4%
Percentile
90.1
In the wild
Unconfirmed
What it is

The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03890 · 90.1th percentile
Published
2015-02-19T11:00Z
EPSS history
Timeline
  • 19 FEB 11:00Z
    The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x…
    cvelistv5