CVE-2015-1545
Fixed in a distro release EPSS 11%
The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.
Products: openldap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | openldap | 2.4.40-4 |
| Debian 13 | openldap | 2.4.40-4 |
| Debian 14 | openldap | 2.4.40-4 |
| Debian 6.0 | openldap | 2.4.23-7.3+deb6u1 |
| Debian 7 | openldap | 2.4.31-2 |
| SUSE Linux Enterprise Desktop 12 | openldap2-client | 2.4.39-16.1 |
| SUSE Linux Enterprise Module for Legacy 12 | openldap2 | 2.4.39-16.1 |
| SUSE Linux Enterprise Server 12 | openldap2 | 2.4.39-16.1 |
| SUSE Linux Enterprise Server 12 | openldap2-client | 2.4.39-16.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | openldap2 | 2.4.39-16.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | openldap2-client | 2.4.39-16.1 |
| SUSE Linux Enterprise Software Development Kit 12 | openldap2 | 2.4.39-16.1 |
| SUSE Linux Enterprise Software Development Kit 12 | openldap2-client | 2.4.39-16.1 |
| Ubuntu 14.04 LTS | openldap | 2.4.31-1+nmu2ubuntu8.1 |