CVE-2022-42898

HighCVSS 8.8/10Last modified Oct 14, 2026

Description

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

No affected versions have been published.

Timeline

Published
Dec 25, 2022
Last modified
Oct 14, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-428997.8Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds read and stack overflow issues when opening crafteCVE-2022-42908.8The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the 'ctl_sanitize_title' function in versions up to, anCVE-2022-429007.8Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds read issues when opening crafted FBX files. ExploiCVE-2022-429017.8Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds and stack overflow issues when opening crafted XMTCVE-2022-429028.8In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improCVE-2022-429033.3Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list.CVE-2022-429047.2Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.CVE-2022-429059.1In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 client or network attaCVE-2022-429067.8powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository confCVE-2022-429085.4WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user intoCVE-2022-429095.4WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codeCVE-2022-429110.0The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an