CVE-2022-3437
A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple...
Original description
The description as published by the source.
A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2022-3437 heimdal Fixed in: 7.7.1-r0
- Debian DEBIAN-CVE-2022-3437 heimdal Fixed in: 7.7.0+dfsg-2+deb11u2
References
- advisory github.com
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory security.gentoo.org
- advisory security.netapp.com
- report bugzilla.redhat.com
- web access.redhat.com
- web samba.org
- web openwall.com
- web lists.debian.org