{"id":"CVE-2017-11462","aliases":["DEBIAN-CVE-2017-11462","EUVD-2017-3083","GHSA-rr2f-jhmq-594w","MGASA-2017-0420","SUSE-SU-2017:2659-1","SUSE-SU-2018:0859-1","UBUNTU-CVE-2017-11462","openSUSE-SU-2024:10899-1"],"status":"published","title":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified...","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05481,"percentile":0.92818,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2017-09-13T16:00:00Z","modified":"2026-10-24T14:05:36Z","fixes":[{"ecosystem":"Debian:12","package":"krb5","fixed_in":["1.15.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"krb5","fixed_in":["1.15.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"krb5","fixed_in":["1.15.2-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"krb5","fixed_in":["1.12.5-40.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"krb5","fixed_in":["1.12.5-40.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"krb5","fixed_in":["1.12.5-40.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"krb5","fixed_in":["1.12.5-40.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"krb5","fixed_in":["1.12.5-40.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"krb5","fixed_in":["1.12.5-40.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"krb5","fixed_in":["1.12.5-40.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"krb5","fixed_in":["1.12.5-40.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"krb5","fixed_in":["1.12.5-40.13.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"krb5","fixed_in":["1.12+dfsg-2ubuntu5.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"krb5","fixed_in":["1.13.2+dfsg-5ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-1.3.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.1-2.2.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-133.49.113.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-133.49.113.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-133.49.113.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12+dfsg-2ubuntu5.4"}]}],"versions":["1.10.1+dfsg-6.1ubuntu1","1.11.3+dfsg-3ubuntu2","1.12+dfsg-2ubuntu1","1.12+dfsg-2ubuntu2","1.12+dfsg-2ubuntu3","1.12+dfsg-2ubuntu4","1.12+dfsg-2ubuntu4.2","1.12+dfsg-2ubuntu5","1.12+dfsg-2ubuntu5.1","1.12+dfsg-2ubuntu5.2","1.12+dfsg-2ubuntu5.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.1"}]}],"versions":["1.13.2+dfsg-2","1.13.2+dfsg-3","1.13.2+dfsg-4","1.13.2+dfsg-5","1.13.2+dfsg-5ubuntu1","1.13.2+dfsg-5ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-2.2"}]}],"bundled":20}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mit","product":"kerberos_5"}],"references":[{"url":"https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1488873","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","VDB Entry","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11462"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED"},{"url":"https://github.com/advisories/GHSA-rr2f-jhmq-594w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-11462","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0420.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21628","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2XIPFDWKYB3HQKSWLVJ6AAPFEG6BEPE3/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-11/msg00039.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172659-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1032680","tags":["report"]},{"url":"https://bugzilla.suse.com/1054028","tags":["report"]},{"url":"https://bugzilla.suse.com/1056995","tags":["report"]},{"url":"https://bugzilla.suse.com/903543","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11462","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180859-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1083926","tags":["report"]},{"url":"https://bugzilla.suse.com/1083927","tags":["report"]},{"url":"https://bugzilla.suse.com/970696","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5730","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-11462","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11462","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-0956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-0957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-37750","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.","status":"published","published":"2017-09-13T16:00:00Z","modified":"2024-08-05T18:12:39.893Z","updated_at":"2026-11-02T14:33:19.848632Z"}],"euvd":[{"id":"EUVD-2017-3083","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.","status":"published","published":"2017-09-13T16:00:00Z","modified":"2024-08-05T18:12:39Z","updated_at":"2026-11-03T02:23:23.645757Z"}],"ghsa":[{"id":"GHSA-rr2f-jhmq-594w","title":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified...","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.","status":"published","published":"2022-05-13T01:28:48Z","modified":"2025-04-20T03:45:59Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T15:01:52.186588Z"}],"nvd":[{"id":"CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.","status":"published","published":"2017-09-13T16:29:00.43Z","modified":"2026-06-17T01:01:51Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:03:58.85945Z"}],"osv":[{"id":"CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.","status":"published","published":"2017-09-13T16:29:00.43Z","modified":"2026-10-24T14:05:36.261901653Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.","status":"published","published":"2017-09-13T16:29:00.43Z","modified":"2026-09-01T20:03:41.148415129Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"UBUNTU-CVE-2017-11462","description":"Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.","status":"published","published":"2017-09-13T16:29:00Z","modified":"2026-04-22T11:10:55.772608Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"MGASA-2017-0420","title":"Updated krb5 packages fix security vulnerabilities","description":"An authentication bypass flaw was found in the way krb5's certauth\ninterface handled the validation of client certificates. A remote\nattacker able to communicate with the KDC could potentially use this\nflaw to impersonate arbitrary principals under rare and erroneous\ncircumstances (CVE-2017-7562).\nNote that this issue only affects Mageia 6.\n\nRFC 2744 permits a GSS-API implementation to delete an existing security\ncontext on a second or subsequent call to gss_init_sec_context() or\ngss_accept_sec_context() if the call results in an error.  This API\nbehavior has been found to be dangerous, leading to the possibility of\nmemory errors in some callers.  For safety, GSS-API implementations\nshould instead preserve existing security contexts on error until the\ncaller deletes them (CVE-2017-11462).\n\nA buffer overflow vulnerability was found in get_matching_data()\nfunction when both the CA cert and the user cert have a long subject\naffecting krb5 that includes certauth plugin. Attack requires a\nvalidated certificate with a long subject and issuer, and a\n\"pkinit_cert_match\" string attribute on some principal in the database.\nA remote code execution exploit might also require that the attacker\ngets to choose the contents of the issuer in the validated cert\n(CVE-2017-15088).\n","status":"published","published":"2017-11-20T21:18:02Z","modified":"2026-04-16T06:23:47.043309473Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10899-1","title":"krb5-1.19.2-2.2 on GA media","description":"These are all security issues fixed in the krb5-1.19.2-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:20:44.135635Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2017:2659-1","title":"Security update for krb5","description":"This update for krb5 fixes several issues.\n\nThis security issue was fixed:\n\n- CVE-2017-11462: Prevent automatic security context deletion to prevent\n  double-free (bsc#1056995)\n\nThese non-security issues were fixed:\n\n- Set 'rdns' and 'dns_canonicalize_hostname' to false in krb5.conf\n  in order to improve client security in handling service principle\n  names. (bsc#1054028)\n- Prevent kadmind.service startup failure caused by absence of\n  LDAP service. (bsc#903543)\n- Remove main package's dependency on systemd (bsc#1032680)\n","status":"published","published":"2017-10-09T05:53:00Z","modified":"2026-02-04T03:20:19.937298Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2018:0859-1","title":"Security update for krb5","description":"\nThis update for krb5 fixes several issues.\n\nThis security issue was fixed:\n\n- CVE-2017-11462: Prevent automatic security context deletion to prevent double-free (bsc#1056995).\n- CVE-2018-5729: Null pointer dereference in kadmind or DN container check bypass by supplying special crafted data (bsc#1083926).\n- CVE-2018-5730: DN container check bypass by supplying special crafted data (bsc#1083927).\n\n\nThis non-security issue was fixed:\n\n- Avoid indefinite polling in KDC communication. (bsc#970696)\n","status":"published","published":"2018-04-03T07:47:57Z","modified":"2026-02-04T02:36:42.80354Z","updated_at":"2026-11-02T15:53:44.594517Z"}]}}