« Back to list

CVE-2017-11462

Status: ModifiedCritical (9.8)—

Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (2)

Fedoraproject — FedoraMIT — Kerberos 5

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2017-11462",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-09-13T16:29:00.430",
  "references": [
    {
      "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1488873",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1488873",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-415"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de doble liberación (double free) en MIT Kerberos 5 (también conocido como krb5) que permite que atacantes provoquen un impacto no especificado mediante vectores que causen borrados automáticos de contextos de seguridad por error."
    }
  ],
  "lastModified": "2026-06-17T01:01:51.000",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E30B176-1FE5-4C53-8B79-2E6D87DF05B3"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.14:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC81822F-DC8C-4889-AD53-33216B66A109"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.14:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1B23EE0-35EB-46FC-8620-AC0059498D9B"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.14:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70831CB8-695D-45E8-A829-2E888823E8A5"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.14.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E650B5A3-99CA-491B-A1FB-259EF548D92E"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.14.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "091F3C51-980E-482F-9882-0A555A8F74BC"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.14.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A00BDDDC-3D5D-4D63-A8D8-63BF2F4C7329"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.14.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42505BC2-12A0-43E9-8561-80270D7CA74D"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF0496EF-F0F9-4A5D-92F4-E50C5F3DCA12"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79EEC80F-9E4F-4A6D-BB8D-6AB7764AD8E3"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.15.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB427FE4-CC39-43EE-A27B-69C5B18056FA"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.15.1:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14A2F0C0-91E0-4DD9-851E-67CE8A5EAE0B"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.15.1:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1770120-B3B2-4B5A-9785-162399A47989"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "772E9557-A371-4664-AE2D-4135AAEB89AA"
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:26:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E4D8269-B407-4C24-AAB0-02F885C7D752"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}