ALSA-2023:3097

Dashboard / Vulnerabilities / ALSA-2023:3097

ALSA-2023:3097

Summary: Moderate: gssntlmssp security update

Details: The gssntlmssp is a GSSAPI NTLM mechanism that allows to perform NTLM authentication in GSSAPI programs. Security Fix(es): * gssntlmssp: multiple out-of-bounds read when decoding NTLM fields (CVE-2023-25563) * gssntlmssp: memory corruption when decoding UTF16 strings (CVE-2023-25564) * gssntlmssp: incorrect free when decoding target information (CVE-2023-25565) * gssntlmssp: memory leak when parsing usernames (CVE-2023-25566) * gssntlmssp: out-of-bounds read when decoding target information (CVE-2023-25567) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References: https://access.redhat.com/errata/RHSA-2023:3097, https://access.redhat.com/security/cve/CVE-2023-25563, https://access.redhat.com/security/cve/CVE-2023-25564, https://access.redhat.com/security/cve/CVE-2023-25565, https://access.redhat.com/security/cve/CVE-2023-25566, https://access.redhat.com/security/cve/CVE-2023-25567, https://bugzilla.redhat.com/2172019, https://bugzilla.redhat.com/2172020, https://bugzilla.redhat.com/2172021, https://bugzilla.redhat.com/2172022, https://bugzilla.redhat.com/2172023, https://errata.almalinux.org/8/ALSA-2023-3097.html