{"id":"CVE-2023-25565","aliases":["ALSA-2023:3097","AZL-43606","AZL-45279","DEBIAN-CVE-2023-25565","EUVD-2023-29517","GHSA-7q7f-wqcg-mvfg","MGASA-2023-0108","OESA-2023-1116","RHSA-2023:3097","ROOT-OS-UBUNTU-2204-CVE-2023-25565","UBUNTU-CVE-2023-25565","USN-7588-1","openSUSE-SU-2023:0048-1","openSUSE-SU-2024:12701-1"],"status":"published","title":"GSS-NTLMSSP vulnerable to incorrect free when decoding target information","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01103,"percentile":0.65968,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-590","CWE-763"],"published":"2023-02-14T17:35:41Z","modified":"2026-10-29T11:02:14Z","fixes":[{"ecosystem":"Azure Linux:3","package":"gssntlmssp","fixed_in":["1.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gss-ntlmssp","fixed_in":["1.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gss-ntlmssp","fixed_in":["1.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gss-ntlmssp","fixed_in":["1.2.0-1"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:22.04","package":"rootio-gss-ntlmssp","fixed_in":["0.7.0-4build4.root.io.4","0.7.0-4build4.root.io.1","0.7.0-4build4.root.io.2","0.7.0-4build4.root.io.3","0.7.0-4build4.aikido.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gss-ntlmssp","fixed_in":["0.7.0-3~ubuntu0.16.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gss-ntlmssp","fixed_in":["0.7.0-4ubuntu0.18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gss-ntlmssp","fixed_in":["0.7.0-4ubuntu0.20.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gss-ntlmssp","fixed_in":["0.7.0-4ubuntu0.22.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:2","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.9.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1.mga8"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-9.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-9.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-10.oe2203sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-10.oe2203sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gssntlmssp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gssntlmssp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"rootio-gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-4build4.root.io.4"},{"fixed":"0.7.0-4build4.root.io.1"},{"fixed":"0.7.0-4build4.root.io.2"},{"fixed":"0.7.0-4build4.root.io.3"},{"fixed":"0.7.0-4build4.aikido.5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-3~ubuntu0.16.04.1+esm1"}]}],"versions":["0.6.0-1","0.7.0-3~ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-4ubuntu0.18.04.1~esm1"}]}],"versions":["0.7.0-3","0.7.0-4","0.7.0-4build1","0.7.0-4build3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-4ubuntu0.20.04.1~esm1"}]}],"versions":["0.7.0-4build3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-4ubuntu0.22.04.1~esm1"}]}],"versions":["0.7.0-4build3","0.7.0-4build4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-3~ubuntu0.16.04.1+esm1"}]}],"versions":["0.6.0-1","0.7.0-3~ubuntu0.16.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-4ubuntu0.18.04.1~esm1"}]}],"versions":["0.7.0-3","0.7.0-4","0.7.0-4build1","0.7.0-4build3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-4ubuntu0.20.04.1~esm1"}]}],"versions":["0.7.0-4build3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gss-ntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-4ubuntu0.22.04.1~esm1"}]}],"versions":["0.7.0-4build3","0.7.0-4build4"],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-bp154.2.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"gssntlmssp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-bp154.2.3.1"}]}],"bundled":5}],"products":[{"vendor":"gss-ntlmssp_project","product":"gss-ntlmssp"},{"vendor":"gssapi","product":"gss-ntlmssp"}],"references":[{"url":"https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-7q7f-wqcg-mvfg","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","article","report"]},{"url":"https://github.com/gssapi/gss-ntlmssp/commit/c16100f60907a2de92bcb676f303b81facee0f64","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/gssapi/gss-ntlmssp/releases/tag/v1.2.0","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3097","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25563","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25564","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25565","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25566","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25567","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172019","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172020","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172021","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172022","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172023","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-3097.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25565","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25565.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-25565","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0108.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31574","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WXCOTOTL4ZIZB65QEGM65YZZILOED4A3/","tags":["web","advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25567","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172023","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3097.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25563","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25563","tags":["advisory"]},{"url":"https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-jjjx-5qf7-9mgf","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25564","tags":["advisory"]},{"url":"https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-r85x-q5px-9xfq","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25565","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25566","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25566","tags":["advisory"]},{"url":"https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-mfm4-6g58-jw74","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25567","tags":["advisory"]},{"url":"https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-24pf-6prf-24ch","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2023-25565","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7588-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-25563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-25564","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-25567","tags":["report"]},{"url":"https://bugzilla.suse.com/1208278","tags":["report"]},{"url":"https://bugzilla.suse.com/1208279","tags":["report"]},{"url":"https://bugzilla.suse.com/1208280","tags":["report"]},{"url":"https://bugzilla.suse.com/1208281","tags":["report"]},{"url":"https://bugzilla.suse.com/1208282","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25567","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-25565","title":"GSS-NTLMSSP vulnerable to incorrect free when decoding target information","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.","status":"published","published":"2023-02-14T17:35:41.222Z","modified":"2025-03-10T21:11:55.214Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-590"],"updated_at":"2026-11-02T14:35:19.559321Z"}],"euvd":[{"id":"EUVD-2023-29517","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.","status":"published","published":"2023-02-14T17:35:41Z","modified":"2025-03-10T21:11:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:09.197707Z"}],"nvd":[{"id":"CVE-2023-25565","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.","status":"published","published":"2023-02-14T18:15:13.263Z","modified":"2026-06-17T05:41:30.213Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-590","CWE-763"],"updated_at":"2026-11-02T14:07:46.811196Z"}],"osv":[{"id":"AZL-43606","title":"CVE-2023-25565 affecting package gssntlmssp 0.9.0-2","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.","status":"published","published":"2023-02-14T18:15:13Z","modified":"2026-04-21T04:31:04.200862Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-45279","title":"CVE-2023-25565 affecting package gssntlmssp for versions less than 1.3.1-1","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.","status":"published","published":"2023-02-14T18:15:13Z","modified":"2026-04-21T04:50:41.554291Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"CVE-2023-25565","title":"GSS-NTLMSSP vulnerable to incorrect free when decoding target information","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.","status":"published","published":"2023-02-14T17:35:41.222Z","modified":"2026-10-28T10:31:53.82718388Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-590"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"DEBIAN-CVE-2023-25565","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.","status":"published","published":"2023-02-14T18:15:13.263Z","modified":"2026-10-26T18:00:37.506535704Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"OESA-2023-1116","title":"gssntlmssp security update","description":"Implementing the GSSAPI mechanism of NTLMSSP.\r\n\r\nSecurity Fix(es):\r\n\r\nGSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, memory corruption can be triggered when decoding UTF16 strings. The variable `outlen` was not initialized and could cause writing a zero to an arbitrary place in memory if `ntlm_str_convert()` were to fail, which would leave `outlen` uninitialized. This can lead to a denial of service if the write hits unmapped memory or randomly corrupts a byte in the application memory space. This vulnerability can trigger an out-of-bounds write, leading to memory corruption. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This issue is fixed in version 1.2.0.(CVE-2023-25564)\r\n\r\nGSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.(CVE-2023-25565)\r\n\r\nGSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read can be triggered via the main `gss_accept_sec_context` entry point and could cause a denial-of-service if the memory is unmapped. The issue is fixed in version 1.2.0.(CVE-2023-25567)","status":"published","published":"2023-02-24T11:05:35Z","modified":"2026-08-18T01:17:31.614100669Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2023:3097","title":"Red Hat Security Advisory: gssntlmssp security update","status":"published","published":"2024-09-16T11:43:16Z","modified":"2025-11-22T12:50:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"UBUNTU-CVE-2023-25565","description":"GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.","status":"published","published":"2023-02-14T18:15:00Z","modified":"2026-04-22T14:03:03.162277Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"ALSA-2023:3097","title":"Moderate: gssntlmssp security update","description":"The gssntlmssp is a GSSAPI NTLM mechanism that allows to perform NTLM authentication in GSSAPI programs.\n\nSecurity Fix(es):\n\n* gssntlmssp: multiple out-of-bounds read when decoding NTLM fields (CVE-2023-25563)\n* gssntlmssp: memory corruption when decoding UTF16 strings (CVE-2023-25564)\n* gssntlmssp: incorrect free when decoding target information (CVE-2023-25565)\n* gssntlmssp: memory leak when parsing usernames (CVE-2023-25566)\n* gssntlmssp: out-of-bounds read when decoding target information (CVE-2023-25567)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-05-16T00:00:00Z","modified":"2026-10-29T11:02:14.324239473Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"MGASA-2023-0108","title":"Updated gssntlmssp packages fix security vulnerability","description":"Multiple out-of-bounds read when decoding NTLM fields. (CVE-2023-25563)\nMemory corruption when decoding UTF16 strings. (CVE-2023-25564)\nIncorrect free when decoding target information. (CVE-2023-25565)\nMemory leak when parsing usernames. (CVE-2023-25566)\nOut-of-bounds read when decoding target information. (CVE-2023-25567)\n","status":"published","published":"2023-03-24T05:55:49Z","modified":"2026-04-16T04:42:19.226238144Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2023:0048-1","title":"Security update for gssntlmssp","description":"This update for gssntlmssp fixes the following issues:\n\nUpdate to version 1.2.0\n\n* Implement gss_set_cred_option.\n* Allow to gss_wrap even if NEGOTIATE_SEAL is not negotiated.\n* Move HMAC code to OpenSSL EVP API.\n* Fix crash bug when acceptor credentials are NULL.\n* Translations update from Fedora Weblate.\n\nFix security issues:\n\n* CVE-2023-25563 (boo#1208278): multiple out-of-bounds read when decoding NTLM fields.\n* CVE-2023-25564 (boo#1208279): memory corruption when decoding UTF16 strings.\n* CVE-2023-25565 (boo#1208280): incorrect free when decoding target information.\n* CVE-2023-25566 (boo#1208281): memory leak when parsing usernames.\n* CVE-2023-25567 (boo#1208282): out-of-bounds read when decoding target information.\n\nUpdate to version 1.1\n\n* various build fixes and better compatibility when a MIC is\n  requested.\n\nUpdate to version 1.0\n\n* Fix test_gssapi_rfc5587.\n* Actually run tests with make check.\n* Add two tests around NTLMSSP_NEGOTIATE_LMKEY.\n* Refine LM compatibility level logic.\n* Refactor the gssntlm_required_security function.\n* Implement reading LM/NT hashes.\n* Add test for smpasswd-like user files.\n* Return confidentiality status.\n* Fix segfault in sign/seal functions.\n* Fix dummy signature generation.\n* Use UCS16LE instead of UCS-2LE.\n* Provide a zero lm key if the password is too long.\n* Completely omit CBs AV pairs when no CB provided.\n* Change license to the more permissive ISC.\n* Do not require cached users with winbind.\n* Add ability to pass keyfile via cred store.\n* Remove unused parts of Makefile.am.\n* Move attribute names to allocated strings.\n* Adjust serialization for name attributes.\n* Fix crash in acquiring credentials.\n* Fix fallback to external_creds interface.\n* Introduce parse_user_name() function.\n* Add test for parse_user_name.\n* Change how we assemble user names in ASC.\n* Use thread local storage for winbind context.\n* Make per thread winbind context optional.\n* Fixed memleak of usr_cred.\n* Support get_sids request via name attributes.\n* Fixed memory leaks found by valgrind.\n- Update to version 0.9\n* add support for getting session key.\n* Add gss_inquire_attrs_for_mech().\n* Return actual data for RFC5587 API.\n* Add new Windows version flags.\n* Add Key exchange also when wanting integrity only.\n* Drop support for GSS_C_MA_NOT_DFLT_MECH.\n","status":"published","published":"2023-02-18T15:01:17Z","modified":"2026-02-04T03:20:11.101373Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12701-1","title":"gssntlmssp-1.2.0-1.1 on GA media","description":"These are all security issues fixed in the gssntlmssp-1.2.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:54:16.986462Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"ROOT-OS-UBUNTU-2204-CVE-2023-25565","title":"CVE-2023-25565 in rootio-gss-ntlmssp - Patched by Root","description":"Root has patched CVE-2023-25565 in the rootio-gss-ntlmssp package for Root:Ubuntu:22.04. Multiple fixed versions available.","status":"published","published":"2026-07-27T19:45:04Z","modified":"2026-07-28T19:38:51.700339465Z","updated_at":"2026-11-02T15:53:33.943322Z"},{"id":"USN-7588-1","title":"gss-ntlmssp vulnerabilities","description":"Phil Turnbull discovered that GSS NTLMSSP may perform out-of-bounds reads \nwhen decoding NTLM fields and target information. An attacker could \npossibly use this issue to cause GSS NTLMSSP to crash, resulting in \na denial of service. (CVE-2023-25563, CVE-2023-25567)\n\nPhil Turnbull discovered that GSS NTLMSSP did not properly initialize\nmemory when decoding UTF16 strings. An attacker could possibly use \nthis issue to trigger an out-of-bounds write, resulting in a crash.\n(CVE-2023-25564)\n\nPhil Turnbull discovered that GSS NTLMSSP did not properly handle memory\ncleanup. An attacker could possibly use this issue to cause an assertion\nfailure, resulting in a denial of service. (CVE-2023-25565)","status":"published","published":"2025-06-23T09:59:40Z","modified":"2026-06-25T13:32:30.467135132Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}