Withdrawn by the publisher.

Affected: CleanStart: heimdal

Security vulnerability affects the heimdal package. A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal.

A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.

A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.

This issue affects Apache HTTP Server 2.4.54 and earlier. A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability. A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability. An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create…

Affected: openEuler:20.03-LTS-SP1: samba, openEuler:20.03-LTS-SP3: samba, openEuler:22.03-LTS: samba

Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fix(es): The DES (for Samba 4.11 and earlier) and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. Affects - All versions of Samba since Samba 4.0 compiled with Heimdal Kerberos. Samba 4.15.11, 4.16.6 and 4.17.2 have been issued as security releases to correct the defect https://www.samba.org/samba/security/CVE-2022-3437.html(CVE-2022-3437)

Security update for libheimdal

Affected: Ubuntu:Pro:14.04:LTS: heimdal, Ubuntu:Pro:14.04:LTS: samba, Ubuntu:Pro:16.04:LTS: heimdal, Ubuntu:Pro:16.04:LTS: samba, Ubuntu:18.04:LTS: heimdal, Ubuntu:Pro:18.04:LTS: samba, Ubuntu:20.04:LTS: heimdal, Ubuntu:20.04:LTS: samba, Ubuntu:22.04:LTS: heimdal, Ubuntu:22.04:LTS: samba

A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Samba ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen oder Sicherheitsvorkehrungen zu umgehen.