CVE catalog

CVE-2017-17439

heimdal: CVE-2017-17439

Severity: Medium
Published: Dec 6, 2017, 3:29:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 3.43% · Oct 22, 2026

In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	heimdal	sid	`7.8.git20240113.1b4565a+dfsg-2`	fixed
Debian	heimdal	forky	`7.8.git20240113.1b4565a+dfsg-2`	fixed
Debian	heimdal	trixie	`7.8.git20221117.28daf24+dfsg-9+deb13u1`	fixed
Debian	heimdal	bookworm	`7.8.git20221117.28daf24+dfsg-2`	fixed
Alpine	heimdal	3.10	`7.4.0-r2`	fixed
Alpine	heimdal	3.11	`7.4.0-r2`	fixed
Alpine	heimdal	3.12	`7.4.0-r2`	fixed
Alpine	heimdal	3.13	`7.4.0-r2`	fixed
Alpine	heimdal	3.14	`7.4.0-r2`	fixed
Alpine	heimdal	3.15	`7.4.0-r2`	fixed
Alpine	heimdal	3.16	`7.4.0-r2`	fixed
Alpine	heimdal	3.17	`7.4.0-r2`	fixed
Alpine	heimdal	3.18	`7.4.0-r2`	fixed
Alpine	heimdal	3.19	`7.4.0-r2`	fixed
Alpine	heimdal	3.20	`7.4.0-r2`	fixed
Alpine	heimdal	3.21	`7.4.0-r2`	fixed
Alpine	heimdal	3.22	`7.4.0-r2`	fixed
Alpine	heimdal	3.23	`7.4.0-r2`	fixed
Alpine	heimdal	3.24	`7.4.0-r2`	fixed
Alpine	heimdal	3.6	`7.1.0-r2`	fixed
Alpine	heimdal	3.7	`7.4.0-r2`	fixed
Alpine	heimdal	3.8	`7.4.0-r2`	fixed
Alpine	heimdal	3.9	`7.4.0-r2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	heimdal	source	sid	`7.5.0+dfsg-1`	not yet assigned	Not reported	[878144]
Debian	heimdal	source	forky	`7.5.0+dfsg-1`	not yet assigned	Not reported	[878144]
Debian	heimdal	source	trixie	`7.5.0+dfsg-1`	not yet assigned	Not reported	[878144]
Debian	heimdal	source	bookworm	`7.5.0+dfsg-1`	not yet assigned	Not reported	[878144]
Alpine	heimdal	apk	3.10	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.11	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.12	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.13	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.14	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.15	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.16	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.17	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.18	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.19	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.20	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.21	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.22	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.23	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.24	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.6	`7.1.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.7	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.8	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported
Alpine	heimdal	apk	3.9	`7.4.0-r2`	Not reported	ALPINE-CVE-2017-17439	Not reported

[Debian bug #878144]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[heimdal-clients]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[heimdal-dev]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[heimdal-docs]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · all · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · all · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[heimdal-kcm]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[heimdal-kdc]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[heimdal-multidev]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[heimdal-servers]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[libasn1-8-heimdal]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[libgssapi3-heimdal]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[libhcrypto5-heimdal]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[libhdb9-heimdal]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[libheimbase1-heimdal]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[libheimntlm0-heimdal]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[libhx509-5-heimdal]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[libkadm5clnt7-heimdal]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[libkadm5srv8-heimdal]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[libkafs0-heimdal]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[libkdc2-heimdal]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[libkrb5-26-heimdal]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
[libotp0-heimdal]Fixed
Source package: [heimdal]
Details (2)
- 7.8.git20221117.28daf24+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12
- 7.8.git20221117.28daf24+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 7.5.0+dfsg-1
  dsa · heimdal · debian · bookworm; dsa · heimdal · debian · 12

Next results

Observed: Oct 23, 2026, 5:27:55 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]