Description of problem:

The Diatheke CGI allows arbitrary command execution in the context of the webserver, e.g. www-data by simply abusing the range parameter.

For example, &range=yes will consume tons of resources on the affected webserver. Escalation of privleges and command shells are left as an exercise to the reader.

From Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466449

The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."