Skip to content
Noroxi

heimdal project records

13 published records for vendor heimdal project. 0 of them have been exploited in the wild (listed in CISA KEV) and 1 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 7.7%
Pre-auth RCE
3
With a fix record
100%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 17
  2. 19
  3. 22
  4. 23

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

13 records
  • CVE-2011-4862
    69This week

    Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and

    CriticalCVSS 10.0WeaponizedEPSS 95%

    mit · krb5-applDec 24, 2011

  • CVE-2004-0434
    41Plan

    k5admind (kadmind) for Heimdal allows remote attackers to execute arbitrary code via a Kerberos 4 compatibility administration request whose

    CriticalCVSS 9.8No exploitEPSS 7%

    heimdal project · heimdalJul 7, 2004

  • CVE-2022-44640
    40Plan

    Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distrib

    CriticalCVSS 9.8No exploitEPSS 2%

    heimdal project · heimdalDec 25, 2022

  • CVE-2022-42898
    37Monitor

    PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution

    HighCVSS 8.8No exploitEPSS 6%

    mit · kerberos 5Dec 25, 2022

  • CVE-2017-11103
    34Monitor

    Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in

    HighCVSS 8.1No exploitEPSS 5%

    heimdal project · heimdalJul 13, 2017

  • CVE-2017-17439
    31Monitor

    In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fie

    HighCVSS 7.5No exploitEPSS 3%

    debian · debian linuxDec 6, 2017

  • CVE-2018-16860
    31Monitor

    A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up t

    HighCVSS 7.5No exploitEPSS 2%

    samba · sambaJul 31, 2019

  • CVE-2017-6594
    31Monitor

    The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging

    HighCVSS 7.5No exploitEPSS 1%

    heimdal project · heimdalAug 28, 2017

  • CVE-2019-12098
    30Monitor

    In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack.

    HighCVSS 7.4No exploitEPSS 1%

    heimdal project · heimdalMay 15, 2019

  • CVE-2021-44758
    30Monitor

    Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID and

    HighCVSS 7.5No exploitEPSS 1%

    heimdal project · heimdalDec 26, 2022

  • CVE-2022-41916
    30Monitor

    Read one byte past a buffer when normalizing Unicode

    HighCVSS 7.5No exploitEPSS 1%

    heimdal project · heimdalNov 15, 2022

  • CVE-2022-3116
    30Monitor

    The Heimdal Software Kerberos 5 implementation is vulnerable to a null pointer dereferance.

    HighCVSS 7.5No exploitEPSS 0%

    heimdal project · heimdalMar 27, 2023

  • CVE-2022-45142
    30Monitor

    The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to t

    HighCVSS 7.5No exploitEPSS 0%

    heimdal project · heimdalMar 6, 2023