| Package | krb5 |
|---|---|
| Version | 1.12.1+dfsg-19+deb8u10 (jessie), 1.15-1+deb9u7 (stretch), 1.17-3+deb10u8 (buster) |
| Related CVEs | CVE-2025-24528 |
MIT krb5 a popular implementation of kerberos 5 authentication protocol was affected by a vulnerability.
An authenticated attacker can cause kadmind to write beyond the end of the mapped region for the iprop log file, likely causing a process crash.
For Debian 10 buster, these problems have been fixed in version 1.17-3+deb10u8.
For Debian 8 jessie, these problems have been fixed in version 1.12.1+dfsg-19+deb8u10.
For Debian 9 stretch, these problems have been fixed in version 1.15-1+deb9u7.
We recommend that you upgrade your krb5 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.