CVE-2009-0846
The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime...
10.0 HighFix available
The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.
Exploit likelihood
8.90%Up 0.7 points since Feb 4, 2022
What each source reports
NVD Score used
The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.
- Record
CVE-2009-0846- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-824
- Updated
- 2026-11-02
CVE List No score
The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.
- Record
CVE-2009-0846- Updated
- 2026-11-02
EUVDEUVD-2009-0843 No score
The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.
- Record
EUVD-2009-0843- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-777p-gw55-q56c No score
The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime...
The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.
- Record
GHSA-777p-gw55-q56c- Weakness
- CWE-20, CWE-824
- Updated
- 2026-11-02
OSV No score
The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.
- Record
CVE-2009-0846- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-0846 No score
The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.
- Record
DEBIAN-CVE-2009-0846- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10004-1 No score
krb5-1.15-1.1 on GA media
These are all security issues fixed in the krb5-1.15-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10004-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
krb5Debian:12 |
before 1.6.dfsg.4~beta1-13 | 1.6.dfsg.4~beta1-13 |
krb5Debian:13 |
before 1.6.dfsg.4~beta1-13 | 1.6.dfsg.4~beta1-13 |
krb5Debian:14 |
before 1.6.dfsg.4~beta1-13 | 1.6.dfsg.4~beta1-13 |
krb5Debian:4.0 From an advisory covering 4 CVEs |
before 1.4.4-7etch7, plus listed versions 1.4.4-7etch11.4.4-7etch21.4.4-7etch31.4.4-7etch41.4.4-7etch51.4.4-7etch6 |
1.4.4-7etch7 |
krb5Debian:5.0 From an advisory covering 4 CVEs |
before 1.6.dfsg.4~beta1-5lenny1, plus listed versions 1.6.dfsg.4~beta1-5 |
1.6.dfsg.4~beta1-5lenny1 |
krb5Red Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:1.6.1-31.el5_3.3 | 0:1.6.1-31.el5_3.3 |
krb5-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:1.6.1-31.el5_3.3 | 0:1.6.1-31.el5_3.3 |
krb5-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:1.6.1-31.el5_3.3 | 0:1.6.1-31.el5_3.3 |
krb5-serverRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:1.6.1-31.el5_3.3 | 0:1.6.1-31.el5_3.3 |
krb5Red Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:1.6.1-31.el5_3.3 | 0:1.6.1-31.el5_3.3 |
Show 78 moreShow less
| Package | Affected | Fixed |
|---|---|---|
krb5-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:1.6.1-31.el5_3.3 | 0:1.6.1-31.el5_3.3 |
krb5-libsRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:1.6.1-31.el5_3.3 | 0:1.6.1-31.el5_3.3 |
krb5-workstationRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:1.6.1-31.el5_3.3 | 0:1.6.1-31.el5_3.3 |
krb5Red Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:1.6.1-31.el5_3.3 | 0:1.6.1-31.el5_3.3 |
krb5-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:1.6.1-31.el5_3.3 | 0:1.6.1-31.el5_3.3 |
krb5-develRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:1.6.1-31.el5_3.3 | 0:1.6.1-31.el5_3.3 |
krb5-libsRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:1.6.1-31.el5_3.3 | 0:1.6.1-31.el5_3.3 |
krb5-serverRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:1.6.1-31.el5_3.3 | 0:1.6.1-31.el5_3.3 |
krb5-workstationRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:1.6.1-31.el5_3.3 | 0:1.6.1-31.el5_3.3 |
krb5Red Hat:enterprise_linux:4::as |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-debuginfoRed Hat:enterprise_linux:4::as |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-develRed Hat:enterprise_linux:4::as |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-libsRed Hat:enterprise_linux:4::as |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-serverRed Hat:enterprise_linux:4::as |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-workstationRed Hat:enterprise_linux:4::as |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5Red Hat:enterprise_linux:4::desktop |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-develRed Hat:enterprise_linux:4::desktop |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-libsRed Hat:enterprise_linux:4::desktop |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-serverRed Hat:enterprise_linux:4::desktop |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-workstationRed Hat:enterprise_linux:4::desktop |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5Red Hat:enterprise_linux:4::es |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-debuginfoRed Hat:enterprise_linux:4::es |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-develRed Hat:enterprise_linux:4::es |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-libsRed Hat:enterprise_linux:4::es |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-serverRed Hat:enterprise_linux:4::es |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-workstationRed Hat:enterprise_linux:4::es |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5Red Hat:enterprise_linux:4::ws |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-develRed Hat:enterprise_linux:4::ws |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-libsRed Hat:enterprise_linux:4::ws |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-serverRed Hat:enterprise_linux:4::ws |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5-workstationRed Hat:enterprise_linux:4::ws |
before 0:1.3.4-60.el4_7.2 | 0:1.3.4-60.el4_7.2 |
krb5Red Hat:enterprise_linux:2.1::as |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-develRed Hat:enterprise_linux:2.1::as |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-libsRed Hat:enterprise_linux:2.1::as |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-serverRed Hat:enterprise_linux:2.1::as |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-workstationRed Hat:enterprise_linux:2.1::as |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5Red Hat:enterprise_linux:2.1::aw |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-develRed Hat:enterprise_linux:2.1::aw |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-libsRed Hat:enterprise_linux:2.1::aw |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-serverRed Hat:enterprise_linux:2.1::aw |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-workstationRed Hat:enterprise_linux:2.1::aw |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5Red Hat:enterprise_linux:2.1::es |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-develRed Hat:enterprise_linux:2.1::es |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-libsRed Hat:enterprise_linux:2.1::es |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-serverRed Hat:enterprise_linux:2.1::es |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-workstationRed Hat:enterprise_linux:2.1::es |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5Red Hat:enterprise_linux:2.1::ws |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-develRed Hat:enterprise_linux:2.1::ws |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-libsRed Hat:enterprise_linux:2.1::ws |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-serverRed Hat:enterprise_linux:2.1::ws |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5-workstationRed Hat:enterprise_linux:2.1::ws |
before 0:1.2.2-49 | 0:1.2.2-49 |
krb5Red Hat:enterprise_linux:3::as |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-debuginfoRed Hat:enterprise_linux:3::as |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-develRed Hat:enterprise_linux:3::as |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-libsRed Hat:enterprise_linux:3::as |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-serverRed Hat:enterprise_linux:3::as |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-workstationRed Hat:enterprise_linux:3::as |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5Red Hat:enterprise_linux:3::desktop |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-develRed Hat:enterprise_linux:3::desktop |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-libsRed Hat:enterprise_linux:3::desktop |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-serverRed Hat:enterprise_linux:3::desktop |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-workstationRed Hat:enterprise_linux:3::desktop |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5Red Hat:enterprise_linux:3::es |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-debuginfoRed Hat:enterprise_linux:3::es |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-develRed Hat:enterprise_linux:3::es |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-libsRed Hat:enterprise_linux:3::es |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-serverRed Hat:enterprise_linux:3::es |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-workstationRed Hat:enterprise_linux:3::es |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5Red Hat:enterprise_linux:3::ws |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-develRed Hat:enterprise_linux:3::ws |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-libsRed Hat:enterprise_linux:3::ws |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-serverRed Hat:enterprise_linux:3::ws |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5-workstationRed Hat:enterprise_linux:3::ws |
before 0:1.2.7-70 | 0:1.2.7-70 |
krb5openSUSE:Tumbleweed From an advisory covering 54 CVEs |
before 1.15-1.1 | 1.15-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0846 is a high vulnerability (CVSS 10.0) in Mit Kerberos 5, published April 9, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.90%, the 95th percentile. Fixed in krb5 1.6.dfsg.4~beta1-13.
References
securityfocus.com/archive/1/504683/100/0/threaded
support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5047181.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6301
mandriva.com/security/advisories?name=MDVSA-2009:098
kb.cert.org/vuls/id/662091
Show 120 moreShow less
vupen.com/english/advisories/2009/0960
support.apple.com/kb/HT3549
support.avaya.com/elmodocs2/security/ASA-2009-142.htm
secunia.com/advisories/35667
redhat.com/support/errata/RHSA-2009-0408.html
vmware.com/security/advisories/VMSA-2009-0008.html
marc.info?l=bugtraq&m=130497213107107&w=2
sunsolve.sun.com/search/document.do?assetkey=1-26-256728-1
security.gentoo.org/glsa/glsa-200904-09.xml
lists.apple.com/archives/security-announce/2009/May/msg00002.html
ubuntu.com/usn/usn-755-1
www-01.ibm.com/support/docview.wss?uid=swg21396120
us-cert.gov/cas/techalerts/TA09-133A.html
wiki.rpath.com/wiki/Advisories:rPSA-2009-0058
rhn.redhat.com/errata/RHSA-2009-0409.html
securitytracker.com/id?1021994
lists.vmware.com/pipermail/security-announce/2009/000059.html
web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-002.txt
nvd.nist.gov/vuln/detail/CVE-2009-0846
github.com/advisories/GHSA-777p-gw55-q56c
security-tracker.debian.org/tracker/CVE-2009-0846
access.redhat.com/errata/RHSA-2009:0408
bugzilla.redhat.com/show_bug.cgi?id=490634
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0408.json
cve.org/CVERecord?id=CVE-2009-0844
suse.com/security/cve/CVE-2002-2443