CVE-2007-5902
Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT...
Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request.
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request.
- Record
CVE-2007-5902- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request.
- Record
CVE-2007-5902- Updated
- 2026-11-02
EUVDEUVD-2007-5872 No score
Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request.
- Record
EUVD-2007-5872- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p6m7-52v7-q7mq No score
Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT...
Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request.
- Record
GHSA-p6m7-52v7-q7mq- Updated
- 2026-11-02
OSV No score
Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request.
- Record
CVE-2007-5902- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-5902 No score
Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request.
- Record
DEBIAN-CVE-2007-5902- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10899-1 No score
krb5-1.19.2-2.2 on GA media
These are all security issues fixed in the krb5-1.19.2-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10899-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
krb5Debian:12 |
before 1.6.dfsg.4~beta1-1 | 1.6.dfsg.4~beta1-1 |
krb5Debian:13 |
before 1.6.dfsg.4~beta1-1 | 1.6.dfsg.4~beta1-1 |
krb5Debian:14 |
before 1.6.dfsg.4~beta1-1 | 1.6.dfsg.4~beta1-1 |
krb5openSUSE:Tumbleweed From an advisory covering 20 CVEs |
before 1.19.2-2.2 | 1.19.2-2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-5902 is a high vulnerability (CVSS 10.0) in Mit Kerberos 5, published December 6, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.91%, the 93rd percentile. Fixed in krb5 1.6.dfsg.4~beta1-1.
References
secunia.com/advisories/39784
ubuntu.com/usn/USN-940-1
novell.com/linux/security/advisories/suse_security_summary_report.html
securityfocus.com/bid/26750
wiki.rpath.com/Advisories:rPSA-2008-0112
Show 34 moreShow less
seclists.org/fulldisclosure/2007/Dec/0321.html
vupen.com/english/advisories/2010/1192
bugs.gentoo.org/show_bug.cgi?id=199214
ubuntu.com/usn/usn-924-1
issues.rpath.com/browse/RPL-2012
osvdb.org/44748
nvd.nist.gov/vuln/detail/CVE-2007-5902
github.com/advisories/GHSA-p6m7-52v7-q7mq
security-tracker.debian.org/tracker/CVE-2007-5902
suse.com/security/cve/CVE-2006-6143