Update Info

openSUSE-2023-20


Security update for libheimdal


Type: security
Severity: important
Issued: 2023-01-16
Description:
This update for libheimdal fixes the following issues:

Update to version 7.8.0

- CVE-2022-42898 PAC parse integer overflows
- CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour
- CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array
- CVE-2021-44758 A null pointer de-reference DoS in SPNEGO acceptors
- CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ
- CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec
- CVE-2019-14870: Validate client attributes in protocol-transition


              

Packages


  • libheimdal-7.8.0-bp153.2.4.1