CVE-2017-11462

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-09-13 · updated 2026-06-17
Weakness: CWE-415

Description

Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.

Affected products

Fedoraproject Fedora: 25, 26
MIT Kerberos 5: 1.14, 1.14-alpha1, 1.14-beta1, 1.14-beta2, 1.14.1, 1.14.2 (+7)

References

http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598
https://bugzilla.redhat.com/show_bug.cgi?id=1488873
https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/
http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598
https://bugzilla.redhat.com/show_bug.cgi?id=1488873
https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/

Get alerted when CVE-2017-11462 or the next vulnerability affects your stack