CVE-2014-5355
Status: ModifiedMedium (5)—
MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c.
CVSS
- Version: 2.0
- Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
- Base score: 5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 4.59%
- Percentile among all scored CVEs: 91
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- NVD-CWE-Other
References
- http://krbdev.mit.edu/rt/Ticket/Display.html?id=8050
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html
- http://rhn.redhat.com/errata/RHSA-2015-0794.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:069
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/74042
- http://www.ubuntu.com/usn/USN-2810-1
- https://github.com/krb5/krb5/commit/102bb6ebf20f9174130c85c3b052ae104e5073ec
- https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html
- http://krbdev.mit.edu/rt/Ticket/Display.html?id=8050
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html
- http://rhn.redhat.com/errata/RHSA-2015-0794.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:069
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/74042
- http://www.ubuntu.com/usn/USN-2810-1
- https://github.com/krb5/krb5/commit/102bb6ebf20f9174130c85c3b052ae104e5073ec
- https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html
Raw JSON (NVD)
Show
{
"id": "CVE-2014-5355",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2015-02-20T11:59:00.060",
"references": [
{
"url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=8050",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html",
"source": "cve@mitre.org"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html",
"source": "cve@mitre.org"
},
{
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069",
"source": "cve@mitre.org"
},
{
"url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html",
"source": "cve@mitre.org"
},
{
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/74042",
"source": "cve@mitre.org"
},
{
"url": "http://www.ubuntu.com/usn/USN-2810-1",
"source": "cve@mitre.org"
},
{
"url": "https://github.com/krb5/krb5/commit/102bb6ebf20f9174130c85c3b052ae104e5073ec",
"source": "cve@mitre.org"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html",
"source": "cve@mitre.org"
},
{
"url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=8050",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2015-0794.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:069",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/74042",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.ubuntu.com/usn/USN-2810-1",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/krb5/krb5/commit/102bb6ebf20f9174130c85c3b052ae104e5073ec",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c."
},
{
"lang": "es",
"value": "MIT Kerberos 5 (también conocido como krb5) hasta 1.13.1 espera incorrectamente que un campo de datos krb5_read_message se representa como una cadena que termine con un caracter '\\0', lo que permite a atacantes remotos (1) causar una denegación de servicio (referencia a puntero nulo) a través de una cadena de versión de cero bytes o (2) causar una denegación de servicio (lectura fuera de rango) mediante la omisión del caracter '\\0', relacionado con appl/user_user/server.c y lib/krb5/krb/recvauth.c."
}
],
"lastModified": "2026-06-17T00:11:26.073",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A37987D-22F9-47AC-A07A-380F7E509BFE"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BE8C0C82-749E-4837-88F8-FB56A753B094"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8AD672FA-918D-48CB-BC03-4E412AF0DCCC"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D0B363A4-BB7A-48A2-AE6B-BD2DDD46E7CB"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "74EF42A5-EC47-4475-81D6-FD1E9C2B8A3C"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30F2CBEF-6FA1-4E07-8163-6AFEDC93FCE5"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D133CB0D-8A54-4DAA-9FE8-0B367544DE65"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B2C23BD-1995-4F09-B444-87DDDE21817E"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.2.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EEF118BE-6351-4768-A3F0-DFE0065273D9"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.2.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2574FC48-C80A-427A-AD12-42676D125D62"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7F01A83F-3BD1-4DED-979A-B4B6B23039FD"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.3:alpha1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B1422F8-CC87-46EA-8649-A12D6E47335D"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACEB5A36-8F72-417A-AC92-149612EC7BCB"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B8704B5-F37B-4C61-A924-3774A29BFEB3"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F953CEBA-BAC0-48DF-A3D0-1FABCC9963E2"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.3.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED81A044-8A7B-4EEF-A4B3-EA49D76FAAED"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.3.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30AA5727-BD83-45CF-B308-BA5F8A577B9D"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.3.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0E088E64-6FBD-4148-8F78-506364B7BB1E"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "52F0EECF-7787-442B-9888-D22F7D36C3DE"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF344AED-BE00-4A9B-A9DE-C6FB0BEE4617"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "567406CA-58D8-453E-B36E-6D1D2EFC8EB6"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7830E03F-A813-4E35-893E-BF27395CEFB3"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.4.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7764411E-C056-4696-822E-235F2620FAC4"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4DD315AE-868B-4061-BF01-CDBF59B02499"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B639DD5F-71C7-4D9B-BA5C-51CAF64140B6"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B904DCE-D59F-45C7-A814-DE42CF02792D"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.5.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9957FE9E-1E89-4C27-852C-44F866A1834E"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C382DAA-68D2-4DD9-BE29-8EEB0BAF1A7A"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "73BB258E-51CF-4D12-836B-BCEA587A3F5F"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.6.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F81DE01C-BA3B-40B4-BD85-17692F0AF8A8"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DFB1190E-BE7A-4C6B-862D-D5747C64E980"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.7.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4B09C090-B842-43C7-B8A6-DBF63D80FEC3"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36823B2B-5C72-4FF3-9301-FB263EB8CE09"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.8.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "59AFA33E-FEBC-45F5-9EC6-8AA363163FB5"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "04D83332-B2FD-4E86-A76C-C3F1CD3B3A31"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.8.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "758A0011-20ED-414A-9DF3-50A161DF8BC2"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.8.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7768AED0-AE4C-4D4E-8D5D-5B618AB82966"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.8.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "534104C5-966E-4740-A354-4F6C210FF25B"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.8.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78AF5659-C0E3-49C4-9CA7-FC3917C8AC49"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "86738633-C081-4440-9F75-A775D6DF2228"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.9.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C7BCFFEE-EA7A-4F26-97AA-31128A179745"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.9.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "91A2D7F5-EBDE-4000-AC78-8DD6472E685A"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.9.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8E92BFA5-723E-4843-A8D8-BC1D32F34569"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.9.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "34C27198-9B55-42FB-AA21-D8B4EB60D926"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC504264-A9E9-4433-B7AA-6D5015A93FF3"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.10.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77FA352F-520C-4C05-AD52-FC8586DB16B1"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.10.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9FFB18F7-CB08-4AE4-9DEC-55D047819A0A"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.10.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "637E858A-7C16-490C-99A8-F46440E5F504"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.10.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "22840B84-2EA4-4E96-A8D8-154AAEADB806"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2D554BDC-CD7D-4572-B1E8-5F627F2C5916"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.11.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "65BCD38A-33AD-4FD7-AF5B-8470B24C4139"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.11.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E11F9209-799A-428B-9513-DBD0F19C7BF4"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.11.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1DA40FAA-B858-4282-8438-247E99FBB002"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.11.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "65795542-D886-46C4-8ECB-4630078DF66A"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.11.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D0A4C436-C3D7-469E-8895-8EEC9569EE86"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "79A9FAE9-7219-4D6A-9E94-FFE20223537D"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.12.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA68BC90-FCFC-4C9B-8574-9029DB2358E9"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.12.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9D0A28CB-173D-4676-B083-E3718213B840"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "169D00BD-344F-453C-BE7C-9DF0740080BB"
},
{
"criteria": "cpe:2.3:a:mit:kerberos_5:1.13.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "765B3248-A524-4A79-858C-E787C1C1599E"
}
],
"operator": "OR"
}
]
}
],
"evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/476.html\">CWE-476: NULL Pointer Dereference</a>",
"sourceIdentifier": "cve@mitre.org"
}