Oracle Errata System Oracle Linux 5.11 2024-09-21T18:58:50 Oracle Linux 5 [1.6.1-17.el5_1.1] - add preliminary patch to fix use of uninitialized pointer / double-free in KDC (CVE-2008-0062,CVE-2008-0063) (#432620, #432621) - add backported patch to fix use-after-free in libgssapi_krb5 (CVE-2007-5901) (#415321) - add backported patch to fix double-free in libgssapi_krb5 (CVE-2007-5971) (#415351) - add preliminary patch to fix incorrect handling of high-numbered descriptors in the RPC library (CVE-2008-0947) (#433596) - fix storage of delegated krb5 credentials when they've been wrapped up in spnego (#436460) - return a delegated credential handle even if the application didn't pass a location to store the flags which would be used to indicate that credentials were delegated (#436465) - add patch to fall back to TCP kpasswd servers for kdc-unreachable, can't-resolve-server, and response-too-big errors (#436467) - use the right sequence numbers when generating password-set/change requests for kpasswd servers after the first one (#436468) - backport from 1.6.3 to initialize a library-allocated get_init_creds_opt structure the same way we would one which was allocated by the calling application, to restore kinit's traditional behavior of doing a password change right when it detects an expired password (#436470) CRITICAL Copyright 2008 Oracle, Inc. CVE-2007-5901 CVE-2007-5971 CVE-2008-0062 CVE-2008-0063 CVE-2008-0947