Arch Linux update for lib32-krb5

1) Double free error

EUVDB-ID: #VU8900

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-11462

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The weakness exists due to double free during the automatic deletion of security contexts on error by the GSS-API. A remote attacker can delete an existing security context on a second or subsequent call to gss_init_sec_context() or gss_accept_sec_context(), trigger memory corruption and cause denial of service or execute arbitrary code.

Mitigation

Update the affected package lib32-krb5 to version 1.15.2-1.

Vulnerable software versions

Arch Linux: All versions

CPE2.3

• cpe:2.3:o:arch_linux:arch_linux:*:*:*:*:*:*:*:

External links

http://security.archlinux.org/advisory/ASA-201710-9

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.