Multiple vulnerabilities has been discovered and corrected in krb5: The pkinit_check_kdc_pkid function in plugins/preauth/pkinit/pkinit_crypto_openssl.c in the PKINIT implementation in the Key Distribution Center in MIT Kerberos 5 before 1.10.4 and 1.11.x before 1.11.1 does not properly handle errors during extraction of fields from an X.509 certificate, which allows remote attackers to cause a denial of service via a malformed KRB5_PADATA_PK_AS_REQ AS-REQ request . The prep_reprocess_req function in do_tgs_req.c in the Key Distribution Center in MIT Kerberos 5 before 1.10.5 does not properly perform service-principal realm referral, which allows remote authenticated users to cause a denial of service via a crafted TGS-REQ request . The updated packages have been patched to correct these issues.