CVE-2014-5352
Public on 2015-02-19
Modified on 2015-05-05
Description
A use-after-free flaw was found in the way the MIT Kerberos libgssapi_krb5 library processed valid context deletion tokens. An attacker able to make an application using the GSS-API library (libgssapi) call the gss_process_context_token() function could use this flaw to crash that application.
Severity
Medium
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 1 | krb5 | 2015-05-05 | ALAS-2015-518 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv2 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| NVD | CVSSv2 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |