{"id":"CVE-2022-44640","aliases":["ALPINE-CVE-2022-44640","AZL-44388","BELL-CVE-2022-44640","DEBIAN-CVE-2022-44640","DLA-3206-1","DSA-5287-1","EUVD-2022-47576","GHSA-88pm-hfmq-7vv4","MGASA-2022-0468","OESA-2022-2153","UBUNTU-CVE-2022-44640","USN-5800-1","openSUSE-SU-2023:0019-1","openSUSE-SU-2023:0020-1","openSUSE-SU-2024:12580-1","openSUSE-SU-2024:12587-1"],"status":"published","title":"CVE-2022-44640 affecting package samba for versions less than 4.18.3-1","description":"Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02349,"percentile":0.83803,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2022-11-22T00:00:00Z","modified":"2026-11-03T08:01:36Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"heimdal","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"samba","fixed_in":["4.18.3-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"heimdal","fixed_in":["7.8.git20221115.a6cf945+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"heimdal","fixed_in":["7.8.git20221115.a6cf945+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"heimdal","fixed_in":["7.8.git20221115.a6cf945+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"samba","fixed_in":["2:4.17.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"samba","fixed_in":["2:4.17.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"samba","fixed_in":["2:4.17.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"samba","fixed_in":["4.11.12-23.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"samba","fixed_in":["4.11.12-22.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"samba","fixed_in":["4.15.3-16.oe2203"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"heimdal","fixed_in":["1.6~git20131207+dfsg-1ubuntu1.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"heimdal","fixed_in":["1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"heimdal","fixed_in":["7.5.0+dfsg-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"heimdal","fixed_in":["7.7.0+dfsg-1ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.3-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.git20221115.a6cf945+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.git20221115.a6cf945+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.git20221115.a6cf945+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.17.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.17.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.17.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-3+deb10u1"}]}],"versions":["7.5.0+dfsg-3"],"bundled":7},{"source":"osv","ecosystem":"Debian:11","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.0+dfsg-2+deb11u2"}]}],"versions":["7.7.0+dfsg-2","7.7.0+dfsg-2+deb11u1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:8","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-1.2.mga8"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.12-23.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.12-22.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.3-16.oe2203"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6~git20131207+dfsg-1ubuntu1.2+esm3"}]}],"versions":["1.6~git20120403+dfsg1-3ubuntu0.1","1.6~git20120403+dfsg1-3ubuntu0.2","1.6~git20131207+dfsg-1ubuntu1","1.6~git20131207+dfsg-1ubuntu1.1","1.6~git20131207+dfsg-1ubuntu1.2","1.6~git20131207+dfsg-1ubuntu1.2+esm1","1.6~git20131207+dfsg-1ubuntu1.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm3"}]}],"versions":["1.6~rc2+dfsg-10ubuntu1","1.7~git20150920+dfsg-4ubuntu1","1.7~git20150920+dfsg-4ubuntu1.16.04.1","1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1","1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-1ubuntu0.3"}]}],"versions":["7.4.0.dfsg.1-2","7.5.0+dfsg-1","7.5.0+dfsg-1ubuntu0.1","7.5.0+dfsg-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.0+dfsg-1ubuntu1.3"}]}],"versions":["7.5.0+dfsg-3build1","7.7.0+dfsg-1","7.7.0+dfsg-1ubuntu1","7.7.0+dfsg-1ubuntu1.1","7.7.0+dfsg-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.7.0+dfsg-2ubuntu2","7.7.0+dfsg-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.8.git20221117.28daf24+dfsg-3ubuntu1","7.8.git20221117.28daf24+dfsg-3ubuntu2","7.8.git20221117.28daf24+dfsg-3ubuntu3","7.8.git20221117.28daf24+dfsg-3ubuntu4","7.8.git20221117.28daf24+dfsg-4ubuntu1","7.8.git20221117.28daf24+dfsg-5ubuntu2","7.8.git20221117.28daf24+dfsg-5ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.8.git20221117.28daf24+dfsg-9ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.8.git20221117.28daf24+dfsg-11ubuntu1","7.8.git20221117.28daf24+dfsg-12ubuntu1","7.8.git20240113.1b4565a+dfsg-1ubuntu1","7.8.git20240113.1b4565a+dfsg-1ubuntu2","7.8.git20240113.1b4565a+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.8.git20221117.28daf24+dfsg-9ubuntu1","7.8.git20221117.28daf24+dfsg-10ubuntu1","7.8.git20221117.28daf24+dfsg-11ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6~git20131207+dfsg-1ubuntu1.2+esm3"}]}],"versions":["1.6~git20120403+dfsg1-3ubuntu0.1","1.6~git20120403+dfsg1-3ubuntu0.2","1.6~git20131207+dfsg-1ubuntu1","1.6~git20131207+dfsg-1ubuntu1.1","1.6~git20131207+dfsg-1ubuntu1.2","1.6~git20131207+dfsg-1ubuntu1.2+esm1","1.6~git20131207+dfsg-1ubuntu1.2+esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm3"}]}],"versions":["1.6~rc2+dfsg-10ubuntu1","1.7~git20150920+dfsg-4ubuntu1","1.7~git20150920+dfsg-4ubuntu1.16.04.1","1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1","1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-1ubuntu0.3"}]}],"versions":["7.4.0.dfsg.1-2","7.5.0+dfsg-1","7.5.0+dfsg-1ubuntu0.1","7.5.0+dfsg-1ubuntu0.2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.0+dfsg-1ubuntu1.3"}]}],"versions":["7.5.0+dfsg-3build1","7.7.0+dfsg-1","7.7.0+dfsg-1ubuntu1","7.7.0+dfsg-1ubuntu1.1","7.7.0+dfsg-1ubuntu1.2"],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"libheimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.0-bp154.2.4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libheimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.0-bp154.2.4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"libheimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.0-bp153.2.4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libheimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.8.0-bp153.2.4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.4+git.300.305b22bfce-1.1"}]}],"bundled":4}],"products":[{"vendor":"heimdal_project","product":"heimdal"},{"vendor":"samba","product":"samba"}],"references":[{"url":"https://github.com/heimdal/heimdal/security/advisories/GHSA-88pm-hfmq-7vv4","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20230216-0008/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202310-06","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-44640","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44640","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-44640","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/44xxx/CVE-2022-44640.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-44640","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0468.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31172","tags":["report"]},{"url":"https://www.debian.org/security/2022/dsa-5286","tags":["web"]},{"url":"https://www.debian.org/security/2022/dsa-5287","tags":["web"]},{"url":"https://www.debian.org/lts/security/2022/dla-3206","tags":["web"]},{"url":"https://github.com/heimdal/heimdal/security/advisories/GHSA-q77c-9qvp-qfw4","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/AYXWFESBZJMBNACFDHWWH7KETGKUXDPO/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2153","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-44640","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5800-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-44640","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-44758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3437","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-42898","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WO45C5LQHPOWEJHKWCXPWLI54XMTTYQP/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44640","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VCW7YX6RG5EAFBRU3SLTXKN5NWVODXTH/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38023","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-44640","description":"Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).","status":"published","published":"2022-12-25T00:00:00Z","modified":"2025-04-15T13:20:13.623Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:34:30.176321Z"}],"euvd":[{"id":"EUVD-2022-47576","description":"Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).","status":"published","published":"2022-12-25T00:00:00Z","modified":"2025-04-15T13:20:13Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:31.065409Z"}],"nvd":[{"id":"CVE-2022-44640","description":"Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).","status":"published","published":"2022-12-25T05:15:11.103Z","modified":"2026-06-17T05:08:40.09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:07:34.388163Z"}],"osv":[{"id":"ALPINE-CVE-2022-44640","description":"Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).","status":"published","published":"2022-12-25T05:15:11.103Z","modified":"2026-11-03T07:18:33.768945186Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"AZL-44388","title":"CVE-2022-44640 affecting package samba for versions less than 4.18.3-1","description":"Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).","status":"published","published":"2022-12-25T05:15:11Z","modified":"2026-04-21T04:33:43.73033Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"BELL-CVE-2022-44640","title":"CVE-2022-44640 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:55.380237Z","modified":"2026-01-26T09:48:49.91331Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-44640","description":"Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).","status":"published","published":"2022-12-25T00:00:00Z","modified":"2026-10-28T10:35:59.444741202Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"DEBIAN-CVE-2022-44640","description":"Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).","status":"published","published":"2022-12-25T05:15:11.103Z","modified":"2026-11-03T08:01:36.441437415Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"OESA-2022-2153","title":"samba security update","description":"\r\n\r\nSecurity Fix(es):\r\n\r\n\n[Invalid free in ASN.1 codec](CVE-2022-44640)","status":"published","published":"2022-12-24T11:05:28Z","modified":"2026-08-18T01:17:28.198970532Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2022-44640","description":"Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).","status":"published","published":"2022-12-25T05:15:00Z","modified":"2026-10-17T12:56:22.858389347Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"DLA-3206-1","title":"heimdal - security update","status":"published","published":"2022-11-26T00:00:00Z","modified":"2026-03-09T01:19:51.266692Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5287-1","title":"heimdal - security update","status":"published","published":"2022-11-22T00:00:00Z","modified":"2026-03-09T02:11:16.81337Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0468","title":"Updated heimdal packages fix security vulnerability","description":"Isaac Boukris reported that the Heimdal KDC before 7.7.1 does not apply\ndelegation_not_allowed (aka not-delegated) user attributes for S4U2Self.\nInstead the forwardable flag is set even if the impersonated client has\nthe not-delegated flag set. (CVE-2019-14870)\n\nJoseph Sutton discovered that the Heimdal KDC before 7.7.1 does not check\nfor missing sname in TGS-REQ (Ticket Granting Server Request)\nbefore dereferencing. An authenticated user could use this flaw to\ncrash the KDC. (CVE-2021-3671)\n\nIt was discovered that Heimdal is prone to a NULL dereference in acceptors\nwhen the initial SPNEGO token has no acceptable mechanisms, which may\nresult in denial of service for a server application that uses the Simple\nand Protected GSSAPI Negotiation Mechanism (SPNEGO). (CVE-2021-44758)\n\nEvgeny Legerov reported that the DES and Triple-DES decryption routines in\nthe Heimdal GSSAPI library before 7.7.1 were prone to buffer overflow on\nmalloc() allocated memory when presented with a maliciously small packet.\nIn addition, the Triple-DES and RC4 (arcfour) decryption routine were\nprone to non-constant time leaks, which could potentially yield to a leak\nof secret key material when using these ciphers. (CVE-2022-3437)\n\nIt was discovered that Heimdal's PKI certificate validation library before\n7.7.1 can under some circumstances perform an out-of-bounds memory access\nwhen normalizing Unicode, which may result in denial of service. (CVE-2022-41916)\n\nGreg Hudson discovered an integer multiplication overflow in the Privilege\nAttribute Certificate (PAC) parsing routine, which may result in denial of\nservice for Heimdal KDCs and possibly Heimdal servers (e.g., via GSS-API)\non 32-bit systems. (CVE-2022-42898)\n\nDouglas Bagnall and the Heimdal maintainers independently discovered that\nHeimdal's ASN.1 compiler before 7.7.1 generates code that allows specially\ncrafted DER encodings of CHOICEs to invoke the wrong free() function on the\ndecoded structure upon decode error, which may result in remote code\nexecution in the Heimdal KDC and possibly the Kerberos client, the X.509\nlibrary, and other components as well. (CVE-2022-44640)\n","status":"published","published":"2022-12-17T18:48:08Z","modified":"2026-04-16T04:43:39.031315614Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2023:0019-1","title":"Security update for libheimdal","description":"This update for libheimdal fixes the following issues:\n\nUpdate to version 7.8.0\n\n- CVE-2022-42898 PAC parse integer overflows\n- CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour\n- CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array\n- CVE-2021-44758 A null pointer de-reference DoS in SPNEGO acceptors\n- CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ\n- CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec\n- CVE-2019-14870: Validate client attributes in protocol-transition\n","status":"published","published":"2023-01-16T08:42:44Z","modified":"2026-02-04T03:44:03.250796Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2023:0020-1","title":"Security update for libheimdal","description":"This update for libheimdal fixes the following issues:\n\nUpdate to version 7.8.0\n\n- CVE-2022-42898 PAC parse integer overflows\n- CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour\n- CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array\n- CVE-2021-44758 A null pointer de-reference DoS in SPNEGO acceptors\n- CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ\n- CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec\n- CVE-2019-14870: Validate client attributes in protocol-transition\n","status":"published","published":"2023-01-16T08:42:52Z","modified":"2026-02-04T02:58:44.117973Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12580-1","title":"libasn1-8-7.8.0-1.1 on GA media","description":"These are all security issues fixed in the libasn1-8-7.8.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:22:39.768947Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12587-1","title":"ctdb-4.17.4+git.300.305b22bfce-1.1 on GA media","description":"These are all security issues fixed in the ctdb-4.17.4+git.300.305b22bfce-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:06:08.94948Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"USN-5800-1","title":"heimdal vulnerabilities","description":"It was discovered that Heimdal incorrectly handled certain SPNEGO tokens. A\nremote attacker could possibly use this issue to cause a denial of service.\n(CVE-2021-44758)\n\nEvgeny Legerov discovered that Heimdal incorrectly handled memory when\nperforming certain DES decryption operations. A remote attacker could use\nthis issue to cause a denial of service, or possibly execute arbitrary\ncode. (CVE-2022-3437)\n\nGreg Hudson discovered that Kerberos PAC implementation used in Heimdal\nincorrectly handled certain parsing operations. A remote attacker could use\nthis issue to cause a denial of service, or possibly execute arbitrary\ncode. (CVE-2022-42898)\n\nIt was discovered that Heimdal's KDC did not properly handle certain error\nconditions. A remote attacker could use this issue to cause a denial of\nservice, or possibly execute arbitrary code. (CVE-2022-44640)\n","status":"published","published":"2023-01-12T17:12:53Z","modified":"2026-06-29T13:50:45.183826938Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}