Fedora has issued an advisory on November 8: https://lists.fedoraproject.org/pipermail/package-announce/2015-November/171079.html This issue is a regression from the CVE-2015-2696 fix (Bug 17078). Patched packages uploaded for Mageia 5 and Cauldron. Advisory: ======================== Updated krb5 packages fix security vulnerabilities: In any MIT krb5 release with the patches for CVE-2015-2696 applied, an application which calls gss_export_sec_context() may experience memory corruption if the context was established using the IAKERB mechanism. Historically, some vulnerabilities of this nature can be translated into remote code execution, though the necessary exploits must be tailored to the individual application and are usually quite complicated (CVE-2015-2698). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2698 http://advisories.mageia.org/MGASA-2015-0436.html https://lists.fedoraproject.org/pipermail/package-announce/2015-November/171079.html ======================== Updated packages in core/updates_testing: ======================== krb5-1.12.2-8.2.mga5 libkrb53-devel-1.12.2-8.2.mga5 libkrb53-1.12.2-8.2.mga5 krb5-server-1.12.2-8.2.mga5 krb5-server-ldap-1.12.2-8.2.mga5 krb5-workstation-1.12.2-8.2.mga5 krb5-pkinit-openssl-1.12.2-8.2.mga5 from krb5-1.12.2-8.2.mga5.src.rpm Reproducible: Steps to Reproduce:
Testing procedure: https://wiki.mageia.org/en/QA_procedure:Krb5
Whiteboard: (none) => has_procedure
MGA5-32 on AcerD620 Xfce No installation issues, but leaves a question: the previous version of krb5 was installed, but selecting the new version of krb does not draw in the new version of the other package. I aselected those myself, but a user not very awake could end up with krb5-8.2 and libkrb53-8.2 Is that safe and/or friendly???? Completed the test procedure as per Comment 1, OK for me. just one remark: if you're lazy as I was, and just hit <Enter> on defining the passwords, and then do the same on calling kinit, I got: Password incorrect while getting initial credentials I reran the setup, this time with real passwords and then all was OK
CC: (none) => herman.viaeneWhiteboard: has_procedure => has_procedure MGA5-32-OK
Validating.
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Advisory uploaded.
Whiteboard: has_procedure MGA5-32-OK => has_procedure advisory MGA5-32-OK
An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0446.html
Status: NEW => RESOLVEDResolution: (none) => FIXED