CVE-2015-2696
krb5: IAKERB context aliasing flaw
Severity
ModerateRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · September 14, 2015
Updated · November 21, 2025
Description
A type-confusion flaw was discovered in MIT Kerberos, where it incorrectly deals with IAKERB context handles. If an application calls gss_inquire_context() on a partially-established IAKERB context, an unauthenticated remote attacker could possibly exploit the flaw to crash the application (denial of service) by sending it a specially crafted IAKERB packet.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 4.3AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')