CVE ID:	CVE-2014-9423
Description:	The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field.
Test IDs:	1.3.6.1.4.1.25623.1.1.1.2.2015.146   1.3.6.1.4.1.25623.1.0.123164   1.3.6.1.4.1.25623.1.1.4.2015.0257.1   1.3.6.1.4.1.25623.1.0.703153   1.3.6.1.4.1.25623.1.0.850837
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2014-9423 BugTraq ID: 72503 http://www.securityfocus.com/bid/72503 Debian Security Information: DSA-3153 (Google Search) http://www.debian.org/security/2015/dsa-3153 http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:069 RedHat Security Advisories: RHSA-2015:0439 http://rhn.redhat.com/errata/RHSA-2015-0439.html SuSE Security Announcement: SUSE-SU-2015:0257 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html SuSE Security Announcement: SUSE-SU-2015:0290 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html SuSE Security Announcement: openSUSE-SU-2015:0255 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html http://www.ubuntu.com/usn/USN-2498-1