VYPR
Unrated severityNVD Advisory· Published Aug 14, 2014· Updated May 6, 2026

CVE-2014-4343

CVE-2014-4343

Description

Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.

Affected products

18
  • Mit/Kerberos 513 versions
    cpe:2.3:a:mit:kerberos_5:1.10:*:*:*:*:*:*:*+ 12 more
    • cpe:2.3:a:mit:kerberos_5:1.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mit:kerberos_5:1.10.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mit:kerberos_5:1.10.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mit:kerberos_5:1.10.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mit:kerberos_5:1.10.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mit:kerberos_5:1.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mit:kerberos_5:1.11.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mit:kerberos_5:1.11.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mit:kerberos_5:1.11.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mit:kerberos_5:1.11.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mit:kerberos_5:1.11.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mit:kerberos_5:1.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mit:kerberos_5:1.12.1:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

18

News mentions

0

No linked articles in our index yet.