CVE-2023-25567

A flaw was found in GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication. It has an out-of-bounds read when decoding target information. The length of the av_pair is not checked properly for two of the elements, which can trigger an out-of-bounds read via the main gss_accept_sec_context entry point and could cause a denial of service if the memory is unmapped.