critical
openSUSE-SU-2023:0020-1
Security update for libheimdal
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
No source gives a CVSS score.
Trivy's own label is CRITICAL. Rated critical by SUSE.
Description
This update for libheimdal fixes the following issues: Update to version 7.8.0 - CVE-2022-42898 PAC parse integer overflows - CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour - CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array - CVE-2021-44758 A null pointer de-reference DoS in SPNEGO acceptors - CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ - CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec - CVE-2019-14870: Validate client attributes in protocol-transition
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| openSUSE Leap 15.3 | libasn1-8, libgssapi3, libhcrypto4 and 15 more | 7.8.0-bp153.2.4.1 |
Show all 18 entries from 1 source
| Source | Package | Fixed in |
|---|---|---|
| openSUSE Leap 15.3 | libasn1-8 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libgssapi3 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libhcrypto4 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libhdb9 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libheimbase1 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libheimdal-devel | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libheimedit0 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libheimntlm0 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libhx509-5 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libkadm5clnt7 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libkadm5srv8 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libkafs0 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libkdc2 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libkrb5-26 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libotp0 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libroken18 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libsl0 | 7.8.0-bp153.2.4.1 |
| openSUSE Leap 15.3 | libwind0 | 7.8.0-bp153.2.4.1 |
References
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VCW7YX6RG5EAFBRU3SLTXKN5NWVODXTH/
- https://www.suse.com/security/cve/CVE-2019-14870/
- https://www.suse.com/security/cve/CVE-2021-3671/
- https://www.suse.com/security/cve/CVE-2021-44758/
- https://www.suse.com/security/cve/CVE-2022-3437/
- https://www.suse.com/security/cve/CVE-2022-41916/
- https://www.suse.com/security/cve/CVE-2022-42898/
- https://www.suse.com/security/cve/CVE-2022-44640/