Gssapi vulnerabilities
We track 5 vulnerabilities in Gssapi products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on February 14, 2023.
Latest Gssapi vulnerabilities
- 7.5 High severity
gss-ntlmssp: Out-of-bounds Read
GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not checked properly for two of the elements which can
- 7.5 High severity
gss-ntlmssp: Missing Release of Memory after Effective Lifetime
GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, a memory leak can be triggered when parsing usernames which can trigger a denial-of-service. The domain portion of a username may be overridden
- 7.5 High severity
gss-ntlmssp: Release of Invalid Pointer or Reference
GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` b
- 8.2 High severity
gss-ntlmssp: Out-of-bounds Write
GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, memory corruption can be triggered when decoding UTF16 strings. The variable `outlen` was not initialized and could cause writing a zero to an
- 7.5 High severity
gss-ntlmssp: Out-of-bounds Read
GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorre