CVE-2007-5939

2007-12-0615:46:00

Debian Security Bug Tracker

security-tracker.debian.org

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.02 Low

EPSS

Percentile

88.9%

JSON

The gss_userok function in appl/ftp/ftpd/gss_userok.c in Heimdal 0.7.2 does not allocate memory for the ticketfile pointer before calling free, which allows remote attackers to have an unknown impact via an invalid username. NOTE: the vulnerability was originally reported for ftpd.c, but this is incorrect.

OSVersionArchitecturePackageVersionFilename
Debian12allheimdal< 7.8.git20221117.28daf24+dfsg-2heimdal_7.8.git20221117.28daf24+dfsg-2_all.deb
Debian11allheimdal< 7.7.0+dfsg-2+deb11u3heimdal_7.7.0+dfsg-2+deb11u3_all.deb
Debian999allheimdal< 7.8.git20221117.28daf24+dfsg-5heimdal_7.8.git20221117.28daf24+dfsg-5_all.deb
Debian13allheimdal< 7.8.git20221117.28daf24+dfsg-5heimdal_7.8.git20221117.28daf24+dfsg-5_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	heimdal	< 7.8.git20221117.28daf24+dfsg-2	heimdal_7.8.git20221117.28daf24+dfsg-2_all.deb
Debian	11	all	heimdal	< 7.7.0+dfsg-2+deb11u3	heimdal_7.7.0+dfsg-2+deb11u3_all.deb
Debian	999	all	heimdal	< 7.8.git20221117.28daf24+dfsg-5	heimdal_7.8.git20221117.28daf24+dfsg-5_all.deb
Debian	13	all	heimdal	< 7.8.git20221117.28daf24+dfsg-5	heimdal_7.8.git20221117.28daf24+dfsg-5_all.deb