CVE-2015-6908
Fixed in a distro release EPSS 19%
The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd.
Products: openldap, apple mac_os_x
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | openldap | 2.4.42+dfsg-2 |
| Debian 13 | openldap | 2.4.42+dfsg-2 |
| Debian 14 | openldap | 2.4.42+dfsg-2 |
| Debian 6.0 | openldap | 2.4.23-7.3+deb6u2 |
| Debian 7 | openldap | 2.4.31-2+deb7u1 |
| Debian 8 | openldap | 2.4.40+dfsg-1+deb8u1 |
| Red Hat Enterprise Linux 5 | compat-openldap | 0:2.3.43_2.2.29-29.el5_11 |
| Red Hat Enterprise Linux 5 | openldap | 0:2.3.43-29.el5_11 |
| Red Hat Enterprise Linux 5 | openldap-clients | 0:2.3.43-29.el5_11 |
| Red Hat Enterprise Linux 5 | openldap-debuginfo | 0:2.3.43-29.el5_11 |
| Red Hat Enterprise Linux 5 | openldap-devel | 0:2.3.43-29.el5_11 |
| Red Hat Enterprise Linux 5 | openldap-servers | 0:2.3.43-29.el5_11 |
| Red Hat Enterprise Linux 5 | openldap-servers-overlays | 0:2.3.43-29.el5_11 |
| Red Hat Enterprise Linux 5 | openldap-servers-sql | 0:2.3.43-29.el5_11 |
| Red Hat Enterprise Linux 6 | openldap | 0:2.4.40-6.el6_7 |
| Red Hat Enterprise Linux 6 | openldap-clients | 0:2.4.40-6.el6_7 |
| Red Hat Enterprise Linux 6 | openldap-debuginfo | 0:2.4.40-6.el6_7 |
| Red Hat Enterprise Linux 6 | openldap-devel | 0:2.4.40-6.el6_7 |
| Red Hat Enterprise Linux 6 | openldap-servers | 0:2.4.40-6.el6_7 |
| Red Hat Enterprise Linux 6 | openldap-servers-sql | 0:2.4.40-6.el6_7 |
| Red Hat Enterprise Linux 7 | openldap | 0:2.4.39-7.el7_1 |
| Red Hat Enterprise Linux 7 | openldap | 0:2.4.39-7.ael7b_1 |
| Red Hat Enterprise Linux 7 | openldap-clients | 0:2.4.39-7.el7_1 |
| Red Hat Enterprise Linux 7 | openldap-clients | 0:2.4.39-7.ael7b_1 |
| Red Hat Enterprise Linux 7 | openldap-debuginfo | 0:2.4.39-7.el7_1 |
| Red Hat Enterprise Linux 7 | openldap-debuginfo | 0:2.4.39-7.ael7b_1 |
| Red Hat Enterprise Linux 7 | openldap-devel | 0:2.4.39-7.el7_1 |
| Red Hat Enterprise Linux 7 | openldap-devel | 0:2.4.39-7.ael7b_1 |
| Red Hat Enterprise Linux 7 | openldap-servers | 0:2.4.39-7.el7_1 |
| Red Hat Enterprise Linux 7 | openldap-servers | 0:2.4.39-7.ael7b_1 |
| Red Hat Enterprise Linux 7 | openldap-servers-sql | 0:2.4.39-7.ael7b_1 |
| Red Hat Enterprise Linux 7 | openldap-servers-sql | 0:2.4.39-7.el7_1 |
| SUSE Linux Enterprise Desktop 11 SP3 | openldap2-client | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Desktop 11 SP4 | openldap2-client | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Desktop 12 | openldap2-client | 2.4.41-18.13.1 |
| SUSE Linux Enterprise Desktop 12 SP1 | openldap2-client | 2.4.41-18.13.1 |
| SUSE Linux Enterprise Module for Legacy 12 | openldap2 | 2.4.41-18.13.4 |
| SUSE Linux Enterprise Server 11 SP3 | openldap2 | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Server 11 SP3 | openldap2-client | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | openldap2 | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | openldap2-client | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Server 11 SP4 | openldap2 | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Server 11 SP4 | openldap2-client | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Server 11-SECURITY | openldap2-client-openssl1 | 2.4.26-0.62.3 |
| SUSE Linux Enterprise Server 12 | openldap2 | 2.4.41-18.13.4 |
| SUSE Linux Enterprise Server 12 | openldap2-client | 2.4.41-18.13.1 |
| SUSE Linux Enterprise Server 12 SP1 | openldap2 | 2.4.41-18.13.4 |
| SUSE Linux Enterprise Server 12 SP1 | openldap2-client | 2.4.41-18.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP3 | openldap2 | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP3 | openldap2-client | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | openldap2 | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | openldap2-client | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 | openldap2 | 2.4.41-18.13.4 |
| SUSE Linux Enterprise Server for SAP Applications 12 | openldap2-client | 2.4.41-18.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | openldap2 | 2.4.41-18.13.4 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | openldap2-client | 2.4.41-18.13.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP3 | openldap2 | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Software Development Kit 11 SP3 | openldap2-client | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | openldap2 | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | openldap2-client | 2.4.26-0.62.2 |
| SUSE Linux Enterprise Software Development Kit 12 | openldap2 | 2.4.41-18.13.4 |
| SUSE Linux Enterprise Software Development Kit 12 | openldap2-client | 2.4.41-18.13.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | openldap2 | 2.4.41-18.13.4 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | openldap2-client | 2.4.41-18.13.1 |
| SUSE Studio Onsite 1.3 | openldap2-client | 2.4.26-0.17.23.1 |
| Ubuntu 14.04 LTS | openldap | 2.4.31-1+nmu2ubuntu8.2 |
| openSUSE Tumbleweed | openldap2 | 1.2-22.1 |