Description
The "mechglue" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | krb5 | 1.19.2-2.2 | openSUSE-SU-2024:10899-1 |
Advisories 1
- openSUSE-SU-2024:10899-1 krb5-1.19.2-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- kerberos-gssapi-code-execution(31417) vdb-entry
- 102772 vendor-advisory
- 201294 vendor-advisory
- TA07-009B third-party-advisory
- 23690 third-party-advisory
- SUSE-SA:2007:004 vendor-advisory
- 1017494 vdb-entry
- 23706 third-party-advisory
- 20070109 MITKRB5-SA-2006-003: kadmind (via GSS-API lib) frees uninitialized pointers mailing-list
- 23903 third-party-advisory
- GLSA-200701-21 vendor-advisory
- OpenPKG-SA-2007.006 vendor-advisory
- FEDORA-2007-033 vendor-advisory
- http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-003-mechglue.txt
- https://issues.rpath.com/browse/RPL-925
- ADV-2007-0112 vdb-entry
- 31280 vdb-entry
- 35151 third-party-advisory
- 21975 vdb-entry
- ADV-2007-0111 vdb-entry
- VU#831452 third-party-advisory
- 23701 third-party-advisory