CVE-2023-25567

A flaw was found in GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication. It has an out-of-bounds read when decoding target information. The length of the av_pair is not checked properly for two of the elements, which can trigger an out-of-bounds read via the main gss_accept_sec_context entry point and could cause a denial of service if the memory is unmapped.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.