krb5-1.19.2-2.2 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:10899 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z krb5-1.19.2-2.2 on GA media These are all security issues fixed in the krb5-1.19.2-2.2 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-10899 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:10899 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2006-6143/ SUSE CVE CVE-2006-6143 page https://www.suse.com/security/cve/CVE-2006-6144/ SUSE CVE CVE-2006-6144 page https://www.suse.com/security/cve/CVE-2007-0956/ SUSE CVE CVE-2007-0956 page https://www.suse.com/security/cve/CVE-2007-0957/ SUSE CVE CVE-2007-0957 page https://www.suse.com/security/cve/CVE-2007-1216/ SUSE CVE CVE-2007-1216 page https://www.suse.com/security/cve/CVE-2007-2442/ SUSE CVE CVE-2007-2442 page https://www.suse.com/security/cve/CVE-2007-2798/ SUSE CVE CVE-2007-2798 page https://www.suse.com/security/cve/CVE-2007-3999/ SUSE CVE CVE-2007-3999 page https://www.suse.com/security/cve/CVE-2007-4000/ SUSE CVE CVE-2007-4000 page https://www.suse.com/security/cve/CVE-2007-5894/ SUSE CVE CVE-2007-5894 page https://www.suse.com/security/cve/CVE-2007-5902/ SUSE CVE CVE-2007-5902 page https://www.suse.com/security/cve/CVE-2007-5971/ SUSE CVE CVE-2007-5971 page https://www.suse.com/security/cve/CVE-2007-5972/ SUSE CVE CVE-2007-5972 page https://www.suse.com/security/cve/CVE-2008-0062/ SUSE CVE CVE-2008-0062 page https://www.suse.com/security/cve/CVE-2008-0947/ SUSE CVE CVE-2008-0947 page https://www.suse.com/security/cve/CVE-2017-11368/ SUSE CVE CVE-2017-11368 page https://www.suse.com/security/cve/CVE-2017-11462/ SUSE CVE CVE-2017-11462 page https://www.suse.com/security/cve/CVE-2018-5729/ SUSE CVE CVE-2018-5729 page https://www.suse.com/security/cve/CVE-2021-36222/ SUSE CVE CVE-2021-36222 page https://www.suse.com/security/cve/CVE-2021-37750/ SUSE CVE CVE-2021-37750 page openSUSE Tumbleweed krb5-1.19.2-2.2 krb5-32bit-1.19.2-2.2 krb5-client-1.19.2-2.2 krb5-devel-1.19.2-2.2 krb5-devel-32bit-1.19.2-2.2 krb5-plugin-kdb-ldap-1.19.2-2.2 krb5-plugin-preauth-otp-1.19.2-2.2 krb5-plugin-preauth-pkinit-1.19.2-2.2 krb5-plugin-preauth-spake-1.19.2-2.2 krb5-server-1.19.2-2.2 krb5-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-32bit-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-client-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-devel-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-devel-32bit-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-plugin-kdb-ldap-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-plugin-preauth-otp-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-plugin-preauth-pkinit-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-plugin-preauth-spake-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-server-1.19.2-2.2 as a component of openSUSE Tumbleweed The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors. CVE-2006-6143 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2006-6143.html CVE-2006-6143 https://bugzilla.suse.com/225990 SUSE Bug 225990 https://bugzilla.suse.com/225992 SUSE Bug 225992 The "mechglue" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers. CVE-2006-6144 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2006-6144.html CVE-2006-6144 https://bugzilla.suse.com/225990 SUSE Bug 225990 https://bugzilla.suse.com/225992 SUSE Bug 225992 The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882. CVE-2007-0956 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-0956.html CVE-2007-0956 https://bugzilla.suse.com/247765 SUSE Bug 247765 https://bugzilla.suse.com/256319 SUSE Bug 256319 Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC), in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via crafted arguments, possibly involving certain format string specifiers. CVE-2007-0957 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-0957.html CVE-2007-0957 https://bugzilla.suse.com/253548 SUSE Bug 253548 https://bugzilla.suse.com/256319 SUSE Bug 256319 Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an "an invalid direction encoding". CVE-2007-1216 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-1216.html CVE-2007-1216 https://bugzilla.suse.com/252487 SUSE Bug 252487 https://bugzilla.suse.com/256319 SUSE Bug 256319 The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC credential, which causes kadmind to free an uninitialized pointer during cleanup. CVE-2007-2442 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-2442.html CVE-2007-2442 https://bugzilla.suse.com/271191 SUSE Bug 271191 https://bugzilla.suse.com/283681 SUSE Bug 283681 Stack-based buffer overflow in the rename_principal_2_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal. CVE-2007-2798 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-2798.html CVE-2007-2798 https://bugzilla.suse.com/278689 SUSE Bug 278689 https://bugzilla.suse.com/283681 SUSE Bug 283681 Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the RPCSEC_GSS RPC library (librpcsecgss) in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and some third-party applications that use krb5, allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long string in an RPC message. CVE-2007-3999 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-3999.html CVE-2007-3999 https://bugzilla.suse.com/302377 SUSE Bug 302377 https://bugzilla.suse.com/305261 SUSE Bug 305261 The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer. CVE-2007-4000 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-4000.html CVE-2007-4000 https://bugzilla.suse.com/302377 SUSE Bug 302377 https://bugzilla.suse.com/305261 SUSE Bug 305261 ** DISPUTED ** The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors. NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used. NOTE: the vendor disputes this issue, stating " The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code." CVE-2007-5894 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-5894.html CVE-2007-5894 https://bugzilla.suse.com/346745 SUSE Bug 346745 https://bugzilla.suse.com/346749 SUSE Bug 346749 Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request. CVE-2007-5902 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-5902.html CVE-2007-5902 https://bugzilla.suse.com/346747 SUSE Bug 346747 https://bugzilla.suse.com/346749 SUSE Bug 346749 Double free vulnerability in the gss_krb5int_make_seal_token_v3 function in lib/gssapi/krb5/k5sealv3.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors. CVE-2007-5971 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-5971.html CVE-2007-5971 https://bugzilla.suse.com/346748 SUSE Bug 346748 https://bugzilla.suse.com/346749 SUSE Bug 346749 Double free vulnerability in the krb5_def_store_mkey function in lib/kdb/kdb_default.c in MIT Kerberos 5 (krb5) 1.5 has unknown impact and remote authenticated attack vectors. NOTE: the free operations occur in code that stores the krb5kdc master key, and so the attacker must have privileges to store this key. CVE-2007-5972 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-5972.html CVE-2007-5972 https://bugzilla.suse.com/346749 SUSE Bug 346749 KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free. CVE-2008-0062 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2008-0062.html CVE-2008-0062 https://bugzilla.suse.com/361373 SUSE Bug 361373 Buffer overflow in the RPC library used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.4 through 1.6.3 allows remote attackers to execute arbitrary code by triggering a large number of open file descriptors. CVE-2008-0947 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2008-0947.html CVE-2008-0947 https://bugzilla.suse.com/363151 SUSE Bug 363151 In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests. CVE-2017-11368 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate 6.8 AV:N/AC:L/Au:S/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-11368.html CVE-2017-11368 https://bugzilla.suse.com/1049819 SUSE Bug 1049819 Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error. CVE-2017-11462 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-11462.html CVE-2017-11462 https://bugzilla.suse.com/1056995 SUSE Bug 1056995 https://bugzilla.suse.com/1122468 SUSE Bug 1122468 MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module. CVE-2018-5729 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-5729.html CVE-2018-5729 https://bugzilla.suse.com/1076211 SUSE Bug 1076211 https://bugzilla.suse.com/1083926 SUSE Bug 1083926 https://bugzilla.suse.com/1122468 SUSE Bug 1122468 ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation. CVE-2021-36222 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-36222.html CVE-2021-36222 https://bugzilla.suse.com/1188571 SUSE Bug 1188571 The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field. CVE-2021-37750 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-37750.html CVE-2021-37750 https://bugzilla.suse.com/1189929 SUSE Bug 1189929