VIR Vulnerability Intelligence Relay

CVE-2014-5355

medium
Published 2015-02-20 · Modified 2026-05-06
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
5.0

Description

MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
OSVersionStatusFixed in
suse slesaffected
debian debianbookwormfixed1.12.1+dfsg-18
debian debianbullseyefixed1.12.1+dfsg-18
debian debianforkyfixed1.12.1+dfsg-18
debian debiansidfixed1.12.1+dfsg-18
debian debiantrixiefixed1.12.1+dfsg-18

Application impact
VendorProductVersionsFixed
mitkerberos_51.3
mitkerberos_51.1
mitkerberos_51.2
mitkerberos_51.2.1
mitkerberos_51.2.2
mitkerberos_51.2.3
mitkerberos_51.2.4
mitkerberos_51.2.5
mitkerberos_51.2.6
mitkerberos_51.2.7
mitkerberos_51.2.8
mitkerberos_51.3.1
mitkerberos_51.3.2
mitkerberos_51.3.3
mitkerberos_51.3.4
mitkerberos_51.3.5
mitkerberos_51.3.6
mitkerberos_51.4
mitkerberos_51.4.1
mitkerberos_51.4.2
mitkerberos_51.4.3
mitkerberos_51.4.4
mitkerberos_51.5
mitkerberos_51.5.1
mitkerberos_51.5.2
mitkerberos_51.5.3
mitkerberos_51.6
mitkerberos_51.6.1
mitkerberos_51.6.2
mitkerberos_51.7
mitkerberos_51.7.1
mitkerberos_51.8
mitkerberos_51.8.1
mitkerberos_51.8.2
mitkerberos_51.8.3
mitkerberos_51.8.4
mitkerberos_51.8.5
mitkerberos_51.8.6
mitkerberos_51.9
mitkerberos_51.9.1
mitkerberos_51.9.2
mitkerberos_51.9.3
mitkerberos_51.9.4
mitkerberos_51.10
mitkerberos_51.10.1
mitkerberos_51.10.2
mitkerberos_51.10.3
mitkerberos_51.10.4
mitkerberos_51.11
mitkerberos_51.11.1
mitkerberos_51.11.2
mitkerberos_51.11.3
mitkerberos_51.11.4
mitkerberos_51.11.5
mitkerberos_51.12
mitkerberos_51.12.1
mitkerberos_51.12.2
mitkerberos_51.13
mitkerberos_51.13.1

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.