CVE-2015-8629

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 (krb5) versions prior to 1.13.4 MIT Kerberos 5 (krb5) versions 1.14.x prior to 1.14.1

Description The issue allows remote authenticated users to obtain sensitive information or cause a denial of service due to an out-of-bounds read. This is caused by the xdr nullstring function in lib/kadm5/kadm rpc xdr.c in kadmind not verifying whether '0' characters exist as expected, allowing exploitation via a crafted string.

Recommendations For versions prior to 1.13.4, update to version 1.13.4 or later. For versions 1.14.x prior to 1.14.1, update to version 1.14.1 or later.