ELSA-2009-0408

ELSA-2009-0408 - krb5 security update

Type:	SECURITY
Severity:	IMPORTANT
Release Date:	2009-04-07

Description

[1.6.1-31.el5_3.3]
- update to revised patch for CVE-2009-0844/CVE-2009-0845

[1.6.1-31.el5_3.2]
- add fix for potential buffer read overrun in the SPNEGO GSSAPI mechanism
(#490635, CVE-2009-0844)
- add fix for NULL pointer dereference when handling certain error cases
in the SPNEGO GSSAPI mechanism (#490635, CVE-2009-0845)
- add fix for attempt to free uninitialized pointer in the ASN.1 decoder
(#490635, CVE-2009-0846)
- add fix for bug in length validation in the ASN.1 decoder (CVE-2009-0847)

[1.6.1-31.el5_3.1]
- add backport of svn patch to fix a bug in how the gssapi library
handles certain error cases in gss_accept_sec_context (CVE-2009-0845,

Related CVEs

CVE-2009-0844

CVE-2009-0845

CVE-2009-0846

Updated Packages

Release/Architecture	Filename	MD5sum	Superseded By Advisory
Oracle Linux 5 (i386)	krb5-1.6.1-31.el5_3.3.src.rpm	9bb9aa1eff7523196d631da5249baeaf	ELSA-2014-1255
	krb5-devel-1.6.1-31.el5_3.3.i386.rpm	aca4a1270b0ddebcb3b037d35ef0818d	ELSA-2014-1255
	krb5-libs-1.6.1-31.el5_3.3.i386.rpm	362f543320168a39fdd7fad70e64dfb6	ELSA-2014-1255
	krb5-server-1.6.1-31.el5_3.3.i386.rpm	1f30173941be05baa67dec5ed392cb9f	ELSA-2014-1255
	krb5-workstation-1.6.1-31.el5_3.3.i386.rpm	acb6b1906a960da0c59084e309dc81cc	ELSA-2014-1255
Oracle Linux 5 (x86_64)	krb5-1.6.1-31.el5_3.3.src.rpm	9bb9aa1eff7523196d631da5249baeaf	ELSA-2014-1255
	krb5-devel-1.6.1-31.el5_3.3.i386.rpm	aca4a1270b0ddebcb3b037d35ef0818d	ELSA-2014-1255
	krb5-devel-1.6.1-31.el5_3.3.x86_64.rpm	201ed15edf5961efd6d1de502ddfb103	ELSA-2014-1255
	krb5-libs-1.6.1-31.el5_3.3.i386.rpm	362f543320168a39fdd7fad70e64dfb6	ELSA-2014-1255
	krb5-libs-1.6.1-31.el5_3.3.x86_64.rpm	0907e148cb024515deea07b3e7aa9fb5	ELSA-2014-1255
	krb5-server-1.6.1-31.el5_3.3.x86_64.rpm	489703a418b4158994e4dc11393646bc	ELSA-2014-1255
	krb5-workstation-1.6.1-31.el5_3.3.x86_64.rpm	c476cc4c6f8b4df02c25db669caf48bf	ELSA-2014-1255

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team