CVE-2007-5901
Use-after-free vulnerability in the gss_indicate_mechs function in lib/gssapi/mechglue...
Use-after-free vulnerability in the gss_indicate_mechs function in lib/gssapi/mechglue/g_initialize.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors. NOTE: this might be the result of a typo in the source code.
Exploit likelihood
What each source reports
NVD Score used
Use-after-free vulnerability in the gss_indicate_mechs function in lib/gssapi/mechglue/g_initialize.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors. NOTE: this might be the result of a typo in the source code.
- Record
CVE-2007-5901- CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
Use-after-free vulnerability in the gss_indicate_mechs function in lib/gssapi/mechglue/g_initialize.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors. NOTE: this might be the result of a typo in the source code.
- Record
CVE-2007-5901- Updated
- 2026-11-02
EUVDEUVD-2007-5871 No score
Use-after-free vulnerability in the gss_indicate_mechs function in lib/gssapi/mechglue/g_initialize.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors. NOTE: this might be the result of a typo in the source code.
- Record
EUVD-2007-5871- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qxh5-j4mp-pchg No score
Use-after-free vulnerability in the gss_indicate_mechs function in lib/gssapi/mechglue...
Use-after-free vulnerability in the gss_indicate_mechs function in lib/gssapi/mechglue/g_initialize.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors. NOTE: this might be the result of a typo in the source code.
- Record
GHSA-qxh5-j4mp-pchg- Updated
- 2026-11-02
OSV No score
Use-after-free vulnerability in the gss_indicate_mechs function in lib/gssapi/mechglue/g_initialize.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors. NOTE: this might be the result of a typo in the source code.
- Record
CVE-2007-5901- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-5901 No score
Use-after-free vulnerability in the gss_indicate_mechs function in lib/gssapi/mechglue/g_initialize.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors. NOTE: this might be the result of a typo in the source code.
- Record
DEBIAN-CVE-2007-5901- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
krb5Debian:12 |
before 1.6.dfsg.4~beta1-1 | 1.6.dfsg.4~beta1-1 |
krb5Debian:13 |
before 1.6.dfsg.4~beta1-1 | 1.6.dfsg.4~beta1-1 |
krb5Debian:14 |
before 1.6.dfsg.4~beta1-1 | 1.6.dfsg.4~beta1-1 |
krb5Red Hat:enterprise_linux:5::client_workstation From an advisory covering 5 CVEs |
before 0:1.6.1-17.el5_1.1 | 0:1.6.1-17.el5_1.1 |
krb5-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 5 CVEs |
before 0:1.6.1-17.el5_1.1 | 0:1.6.1-17.el5_1.1 |
krb5-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 5 CVEs |
before 0:1.6.1-17.el5_1.1 | 0:1.6.1-17.el5_1.1 |
krb5-serverRed Hat:enterprise_linux:5::client_workstation From an advisory covering 5 CVEs |
before 0:1.6.1-17.el5_1.1 | 0:1.6.1-17.el5_1.1 |
krb5Red Hat:enterprise_linux:5::client From an advisory covering 5 CVEs |
before 0:1.6.1-17.el5_1.1 | 0:1.6.1-17.el5_1.1 |
krb5-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 5 CVEs |
before 0:1.6.1-17.el5_1.1 | 0:1.6.1-17.el5_1.1 |
krb5-libsRed Hat:enterprise_linux:5::client From an advisory covering 5 CVEs |
before 0:1.6.1-17.el5_1.1 | 0:1.6.1-17.el5_1.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
krb5-workstationRed Hat:enterprise_linux:5::client From an advisory covering 5 CVEs |
before 0:1.6.1-17.el5_1.1 | 0:1.6.1-17.el5_1.1 |
krb5Red Hat:enterprise_linux:5::server From an advisory covering 5 CVEs |
before 0:1.6.1-17.el5_1.1 | 0:1.6.1-17.el5_1.1 |
krb5-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 5 CVEs |
before 0:1.6.1-17.el5_1.1 | 0:1.6.1-17.el5_1.1 |
krb5-develRed Hat:enterprise_linux:5::server From an advisory covering 5 CVEs |
before 0:1.6.1-17.el5_1.1 | 0:1.6.1-17.el5_1.1 |
krb5-libsRed Hat:enterprise_linux:5::server From an advisory covering 5 CVEs |
before 0:1.6.1-17.el5_1.1 | 0:1.6.1-17.el5_1.1 |
krb5-serverRed Hat:enterprise_linux:5::server From an advisory covering 5 CVEs |
before 0:1.6.1-17.el5_1.1 | 0:1.6.1-17.el5_1.1 |
krb5-workstationRed Hat:enterprise_linux:5::server From an advisory covering 5 CVEs |
before 0:1.6.1-17.el5_1.1 | 0:1.6.1-17.el5_1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-5901 is a medium vulnerability (CVSS 6.9) in Mit Kerberos 5, published December 6, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in krb5 1.6.dfsg.4~beta1-1.
References
mandriva.com/security/advisories?name=MDVSA-2008:069
secunia.com/advisories/29464
securityfocus.com/bid/26750
redhat.com/archives/fedora-package-announce/2008-March/msg00537.html
Show 44 moreShow less
seclists.org/fulldisclosure/2007/Dec/0321.html
vupen.com/english/advisories/2008/0924/references
bugs.gentoo.org/show_bug.cgi?id=199214
lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
docs.info.apple.com/article.html?artnum=307562
ubuntu.com/usn/usn-924-1
osvdb.org/43346
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11451
security.gentoo.org/glsa/glsa-200803-31.xml
issues.rpath.com/browse/RPL-2012
nvd.nist.gov/vuln/detail/CVE-2007-5901
github.com/advisories/GHSA-qxh5-j4mp-pchg
security-tracker.debian.org/tracker/CVE-2007-5901
access.redhat.com/errata/RHSA-2008:0164
bugzilla.redhat.com/show_bug.cgi?id=415321
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0164.json
cve.org/CVERecord?id=CVE-2007-5901