Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2015-2695

Published: 8 November 2015

lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.

Priority

Medium

Status

Package Release Status
krb5
Launchpad, Ubuntu, Debian
upstream
Released (1.13.2+dfsg-3)
precise
Released (1.10+dfsg~beta1-2ubuntu0.7)
trusty
Released (1.12+dfsg-2ubuntu5.2)
vivid
Released (1.12.1+dfsg-18ubuntu0.1)
wily
Released (1.13.2+dfsg-2ubuntu0.1)
Patches:
upstream: https://github.com/krb5/krb5/commit/b51b33f2bc5d1497ddf5bd107f791c101695000d
upstream: https://github.com/krb5/krb5/commit/222b09f6e2f536354555f2a0dedfe29fc10c01d6 (regression fix)