{"id":"CVE-2023-25563","aliases":["ALSA-2023:3097","AZL-43480","AZL-44733","DEBIAN-CVE-2023-25563","EUVD-2023-29515","GHSA-jjjx-5qf7-9mgf","MGASA-2023-0108","RHSA-2023:3097","ROOT-OS-UBUNTU-2204-CVE-2023-25563","UBUNTU-CVE-2023-25563","USN-7588-1","openSUSE-SU-2023:0048-1","openSUSE-SU-2024:12701-1"],"status":"published","title":"GSS-NTLMSSP vulnerable to multiple out-of-bounds reads when decoding NTLM fields","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to 65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version 1.2.0 contains a patch for the out-of-bounds reads.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01091,"percentile":0.65689,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2023-02-14T17:35:08Z","modified":"2026-10-29T11:02:14Z","fixes":[{"ecosystem":"Azure Linux:3","package":"gssntlmssp","fixed_in":["1.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gss-ntlmssp","fixed_in":["1.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gss-ntlmssp","fixed_in":["1.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gss-ntlmssp","fixed_in":["1.2.0-1"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:22.04","package":"rootio-gss-ntlmssp","fixed_in":["0.7.0-4build4.root.io.4","0.7.0-4build4.root.io.3","0.7.0-4build4.aikido.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gss-ntlmssp","fixed_in":["0.7.0-3~ubuntu0.16.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gss-ntlmssp","fixed_in":["0.7.0-4ubuntu0.18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gss-ntlmssp","fixed_in":["0.7.0-4ubuntu0.20.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gss-ntlmssp","fixed_in":["0.7.0-4ubuntu0.22.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:2","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.9.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1.mga8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gssntlmssp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gssntlmssp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"rootio-gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-4build4.root.io.4"},{"fixed":"0.7.0-4build4.root.io.3"},{"fixed":"0.7.0-4build4.aikido.5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-3~ubuntu0.16.04.1+esm1"}]}],"versions":["0.6.0-1","0.7.0-3~ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-4ubuntu0.18.04.1~esm1"}]}],"versions":["0.7.0-3","0.7.0-4","0.7.0-4build1","0.7.0-4build3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-4ubuntu0.20.04.1~esm1"}]}],"versions":["0.7.0-4build3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-4ubuntu0.22.04.1~esm1"}]}],"versions":["0.7.0-4build3","0.7.0-4build4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-3~ubuntu0.16.04.1+esm1"}]}],"versions":["0.6.0-1","0.7.0-3~ubuntu0.16.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-4ubuntu0.18.04.1~esm1"}]}],"versions":["0.7.0-3","0.7.0-4","0.7.0-4build1","0.7.0-4build3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-4ubuntu0.20.04.1~esm1"}]}],"versions":["0.7.0-4build3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-4ubuntu0.22.04.1~esm1"}]}],"versions":["0.7.0-4build3","0.7.0-4build4"],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-bp154.2.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-bp154.2.3.1"}]}],"bundled":5}],"products":[{"vendor":"gss-ntlmssp_project","product":"gss-ntlmssp"},{"vendor":"gssapi","product":"gss-ntlmssp"}],"references":[{"url":"https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-jjjx-5qf7-9mgf","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","article","report"]},{"url":"https://github.com/gssapi/gss-ntlmssp/commit/97c62c6167299028d80765080e74d91dfc99efbd","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/gssapi/gss-ntlmssp/releases/tag/v1.2.0","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3097","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25563","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25564","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25565","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25566","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25567","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172019","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172020","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172021","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172022","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172023","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-3097.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25563","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25563.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-25563","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0108.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31574","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WXCOTOTL4ZIZB65QEGM65YZZILOED4A3/","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172023","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3097.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25563","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25564","tags":["advisory"]},{"url":"https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-r85x-q5px-9xfq","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25565","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25565","tags":["advisory"]},{"url":"https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-7q7f-wqcg-mvfg","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25566","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25566","tags":["advisory"]},{"url":"https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-mfm4-6g58-jw74","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25567","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25567","tags":["advisory"]},{"url":"https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-24pf-6prf-24ch","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2023-25563","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7588-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-25564","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-25565","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-25567","tags":["report"]},{"url":"https://bugzilla.suse.com/1208278","tags":["report"]},{"url":"https://bugzilla.suse.com/1208279","tags":["report"]},{"url":"https://bugzilla.suse.com/1208280","tags":["report"]},{"url":"https://bugzilla.suse.com/1208281","tags":["report"]},{"url":"https://bugzilla.suse.com/1208282","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25567","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-25563","title":"GSS-NTLMSSP vulnerable to multiple out-of-bounds reads when decoding NTLM fields","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to 65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version 1.2.0 contains a patch for the out-of-bounds reads.","status":"published","published":"2023-02-14T17:35:08.172Z","modified":"2025-03-10T21:12:07.826Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:35:19.559321Z"}],"euvd":[{"id":"EUVD-2023-29515","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to 65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version 1.2.0 contains a patch for the out-of-bounds reads.","status":"published","published":"2023-02-14T17:35:08Z","modified":"2025-03-10T21:12:07Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:53:09.197707Z"}],"nvd":[{"id":"CVE-2023-25563","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to 65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version 1.2.0 contains a patch for the out-of-bounds reads.","status":"published","published":"2023-02-14T18:15:13.077Z","modified":"2026-06-17T05:41:29.953Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:46.811196Z"}],"osv":[{"id":"AZL-43480","title":"CVE-2023-25563 affecting package gssntlmssp 0.9.0-2","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to 65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version 1.2.0 contains a patch for the out-of-bounds reads.","status":"published","published":"2023-02-14T18:15:13Z","modified":"2026-04-21T04:31:01.221113Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44733","title":"CVE-2023-25563 affecting package gssntlmssp for versions less than 1.3.1-1","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to 65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version 1.2.0 contains a patch for the out-of-bounds reads.","status":"published","published":"2023-02-14T18:15:13Z","modified":"2026-04-21T04:55:12.166064Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"CVE-2023-25563","title":"GSS-NTLMSSP vulnerable to multiple out-of-bounds reads when decoding NTLM fields","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to 65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version 1.2.0 contains a patch for the out-of-bounds reads.","status":"published","published":"2023-02-14T17:35:08.172Z","modified":"2026-10-28T10:38:24.4884182Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"DEBIAN-CVE-2023-25563","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to 65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version 1.2.0 contains a patch for the out-of-bounds reads.","status":"published","published":"2023-02-14T18:15:13.077Z","modified":"2026-10-26T18:02:11.023268088Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"RHSA-2023:3097","title":"Red Hat Security Advisory: gssntlmssp security update","status":"published","published":"2024-09-16T11:43:16Z","modified":"2025-11-22T12:50:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"UBUNTU-CVE-2023-25563","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to 65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version 1.2.0 contains a patch for the out-of-bounds reads.","status":"published","published":"2023-02-14T18:15:00Z","modified":"2026-04-22T14:03:48.567906Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"ALSA-2023:3097","title":"Moderate: gssntlmssp security update","description":"The gssntlmssp is a GSSAPI NTLM mechanism that allows to perform NTLM authentication in GSSAPI programs.\n\nSecurity Fix(es):\n\n* gssntlmssp: multiple out-of-bounds read when decoding NTLM fields (CVE-2023-25563)\n* gssntlmssp: memory corruption when decoding UTF16 strings (CVE-2023-25564)\n* gssntlmssp: incorrect free when decoding target information (CVE-2023-25565)\n* gssntlmssp: memory leak when parsing usernames (CVE-2023-25566)\n* gssntlmssp: out-of-bounds read when decoding target information (CVE-2023-25567)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-05-16T00:00:00Z","modified":"2026-10-29T11:02:14.324239473Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"MGASA-2023-0108","title":"Updated gssntlmssp packages fix security vulnerability","description":"Multiple out-of-bounds read when decoding NTLM fields. (CVE-2023-25563)\nMemory corruption when decoding UTF16 strings. (CVE-2023-25564)\nIncorrect free when decoding target information. (CVE-2023-25565)\nMemory leak when parsing usernames. (CVE-2023-25566)\nOut-of-bounds read when decoding target information. (CVE-2023-25567)\n","status":"published","published":"2023-03-24T05:55:49Z","modified":"2026-04-16T04:42:19.226238144Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2023:0048-1","title":"Security update for gssntlmssp","description":"This update for gssntlmssp fixes the following issues:\n\nUpdate to version 1.2.0\n\n* Implement gss_set_cred_option.\n* Allow to gss_wrap even if NEGOTIATE_SEAL is not negotiated.\n* Move HMAC code to OpenSSL EVP API.\n* Fix crash bug when acceptor credentials are NULL.\n* Translations update from Fedora Weblate.\n\nFix security issues:\n\n* CVE-2023-25563 (boo#1208278): multiple out-of-bounds read when decoding NTLM fields.\n* CVE-2023-25564 (boo#1208279): memory corruption when decoding UTF16 strings.\n* CVE-2023-25565 (boo#1208280): incorrect free when decoding target information.\n* CVE-2023-25566 (boo#1208281): memory leak when parsing usernames.\n* CVE-2023-25567 (boo#1208282): out-of-bounds read when decoding target information.\n\nUpdate to version 1.1\n\n* various build fixes and better compatibility when a MIC is\n  requested.\n\nUpdate to version 1.0\n\n* Fix test_gssapi_rfc5587.\n* Actually run tests with make check.\n* Add two tests around NTLMSSP_NEGOTIATE_LMKEY.\n* Refine LM compatibility level logic.\n* Refactor the gssntlm_required_security function.\n* Implement reading LM/NT hashes.\n* Add test for smpasswd-like user files.\n* Return confidentiality status.\n* Fix segfault in sign/seal functions.\n* Fix dummy signature generation.\n* Use UCS16LE instead of UCS-2LE.\n* Provide a zero lm key if the password is too long.\n* Completely omit CBs AV pairs when no CB provided.\n* Change license to the more permissive ISC.\n* Do not require cached users with winbind.\n* Add ability to pass keyfile via cred store.\n* Remove unused parts of Makefile.am.\n* Move attribute names to allocated strings.\n* Adjust serialization for name attributes.\n* Fix crash in acquiring credentials.\n* Fix fallback to external_creds interface.\n* Introduce parse_user_name() function.\n* Add test for parse_user_name.\n* Change how we assemble user names in ASC.\n* Use thread local storage for winbind context.\n* Make per thread winbind context optional.\n* Fixed memleak of usr_cred.\n* Support get_sids request via name attributes.\n* Fixed memory leaks found by valgrind.\n- Update to version 0.9\n* add support for getting session key.\n* Add gss_inquire_attrs_for_mech().\n* Return actual data for RFC5587 API.\n* Add new Windows version flags.\n* Add Key exchange also when wanting integrity only.\n* Drop support for GSS_C_MA_NOT_DFLT_MECH.\n","status":"published","published":"2023-02-18T15:01:17Z","modified":"2026-02-04T03:20:11.101373Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12701-1","title":"gssntlmssp-1.2.0-1.1 on GA media","description":"These are all security issues fixed in the gssntlmssp-1.2.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:54:16.986462Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"ROOT-OS-UBUNTU-2204-CVE-2023-25563","title":"CVE-2023-25563 in rootio-gss-ntlmssp - Patched by Root","description":"Root has patched CVE-2023-25563 in the rootio-gss-ntlmssp package for Root:Ubuntu:22.04. Multiple fixed versions available.","status":"published","published":"2026-07-27T19:45:04Z","modified":"2026-07-28T19:42:10.058325209Z","updated_at":"2026-11-02T15:53:33.943322Z"},{"id":"USN-7588-1","title":"gss-ntlmssp vulnerabilities","description":"Phil Turnbull discovered that GSS NTLMSSP may perform out-of-bounds reads \nwhen decoding NTLM fields and target information. An attacker could \npossibly use this issue to cause GSS NTLMSSP to crash, resulting in \na denial of service. (CVE-2023-25563, CVE-2023-25567)\n\nPhil Turnbull discovered that GSS NTLMSSP did not properly initialize\nmemory when decoding UTF16 strings. An attacker could possibly use \nthis issue to trigger an out-of-bounds write, resulting in a crash.\n(CVE-2023-25564)\n\nPhil Turnbull discovered that GSS NTLMSSP did not properly handle memory\ncleanup. An attacker could possibly use this issue to cause an assertion\nfailure, resulting in a denial of service. (CVE-2023-25565)","status":"published","published":"2025-06-23T09:59:40Z","modified":"2026-06-25T13:32:30.467135132Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}