Multiples vulnerabilities have been found in krb5, the MIT
implementation of Kerberos:
- CVE-2014-5352
Incorrect memory management in the libgssapi_krb5 library might
result in denial of service or the execution of arbitrary code.
- CVE-2014-9421
Incorrect memory management in kadmind’s processing of XDR data
might result in denial of service or the execution of arbitrary code.
- CVE-2014-9422
Incorrect processing of two-component server principals might result
in impersonation attacks.
- CVE-2014-9423
An information leak in the libgssrpc library.
For Debian 6 Squeeze, these issues have been fixed in krb5 version 1.8.3+dfsg-4squeeze9