CVE-2009-0844
EPSS 3.4%krb5 - several vulnerabilities
Published: 4/9/2009Modified: 4/28/2026
Also known as:DEBIAN-CVE-2009-0844
Description
The get_input_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read.
Affected packages (2)
- Debian/krb5from 0, < 1.6.dfsg.4~beta1-13
- Debian/krb5from 0, < 1.4.4-7etch7