CVE-2022-44640: Double Free
Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this security issue in Heimdal and Samba?
The vulnerability ID is CVE-2022-44640.
What is the severity level of CVE-2022-44640?
The severity level of CVE-2022-44640 is critical, with a severity value of 9.8.
How does CVE-2022-44640 allow remote attackers to execute arbitrary code?
CVE-2022-44640 allows remote attackers to execute arbitrary code due to an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).
Which versions of Heimdal are affected by CVE-2022-44640?
Versions up to and excluding 7.7.1 of Heimdal are affected by CVE-2022-44640.
Which versions of Samba are affected by CVE-2022-44640?
Versions from 4.15.0 up to and excluding 4.15.3, versions from 4.16.0 up to and excluding 4.16.8, and versions from 4.17.0 up to and excluding 4.17.4 of Samba are affected by CVE-2022-44640.
How can I fix the CVE-2022-44640 vulnerability in Heimdal?
To fix the CVE-2022-44640 vulnerability in Heimdal, update to version 7.7.1 or later.
How can I fix the CVE-2022-44640 vulnerability in Samba?
To fix the CVE-2022-44640 vulnerability in Samba, update to a version later than 4.17.4.
Where can I find more information about CVE-2022-44640?
More information about CVE-2022-44640 can be found at the following references: [GitHub Security Advisory](https://github.com/heimdal/heimdal/security/advisories/GHSA-88pm-hfmq-7vv4), [GitHub Commit](https://github.com/heimdal/heimdal/commit/ea5ec8f174920cb80ce2b168b49195378420449e), [Samba Bugzilla](https://bugzilla.samba.org/show_bug.cgi?id=14929).