CVE-2022-44640

NameCVE-2022-44640
DescriptionHeimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3206-1, DSA-5287-1
Debian Bugs1024187

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
heimdal (PTS)buster7.5.0+dfsg-3vulnerable
buster (security)7.5.0+dfsg-3+deb10u2fixed
bullseye (security), bullseye7.7.0+dfsg-2+deb11u3fixed
bookworm7.8.git20221117.28daf24+dfsg-2fixed
sid, trixie7.8.git20221117.28daf24+dfsg-5fixed
samba (PTS)buster2:4.9.5+dfsg-5+deb10u3vulnerable
buster (security)2:4.9.5+dfsg-5+deb10u5vulnerable
bullseye2:4.13.13+dfsg-1~deb11u5vulnerable
bullseye (security)2:4.13.13+dfsg-1~deb11u6vulnerable
bookworm, bookworm (security)2:4.17.12+dfsg-0+deb12u1fixed
sid, trixie2:4.20.1+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
heimdalsourcebuster7.5.0+dfsg-3+deb10u1DLA-3206-1
heimdalsourcebullseye7.7.0+dfsg-2+deb11u2DSA-5287-1
heimdalsource(unstable)7.8.git20221115.a6cf945+dfsg-11024187
sambasource(unstable)2:4.17.4+dfsg-1

Notes

[bullseye] - samba <ignored> (Domain controller functionality is EOLed, see DSA DSA-5477-1)
[buster] - samba <ignored> (Domain controller functionality is EOLed, see DSA-5015-1)
https://github.com/heimdal/heimdal/security/advisories/GHSA-88pm-hfmq-7vv4
https://github.com/heimdal/heimdal/commit/ea5ec8f174920cb80ce2b168b49195378420449e (heimdal-7.7.1)
https://bugzilla.samba.org/show_bug.cgi?id=14929

Search for package or bug name: Reporting problems