USN-7588-1

Dashboard / Vulnerabilities / USN-7588-1

USN-7588-1

Summary: gss-ntlmssp vulnerabilities

Details: Phil Turnbull discovered that GSS NTLMSSP may perform out-of-bounds reads when decoding NTLM fields and target information. An attacker could possibly use this issue to cause GSS NTLMSSP to crash, resulting in a denial of service. (CVE-2023-25563, CVE-2023-25567) Phil Turnbull discovered that GSS NTLMSSP did not properly initialize memory when decoding UTF16 strings. An attacker could possibly use this issue to trigger an out-of-bounds write, resulting in a crash. (CVE-2023-25564) Phil Turnbull discovered that GSS NTLMSSP did not properly handle memory cleanup. An attacker could possibly use this issue to cause an assertion failure, resulting in a denial of service. (CVE-2023-25565)

References: https://ubuntu.com/security/notices/USN-7588-1, https://ubuntu.com/security/CVE-2023-25563, https://ubuntu.com/security/CVE-2023-25564, https://ubuntu.com/security/CVE-2023-25565, https://ubuntu.com/security/CVE-2023-25567