CVE-2017-17740
Fixed in a distro release EPSS 7%
contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.
Products: openldap, opensuse leap, oracle blockchain_platform, mcafee policy_auditor
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | openldap | 2.4.46-r0 |
| Alpine 3.11 | openldap | 2.4.46-r0 |
| Alpine 3.12 | openldap | 2.4.46-r0 |
| Alpine 3.13 | openldap | 2.4.46-r0 |
| Alpine 3.14 | openldap | 2.4.46-r0 |
| Alpine 3.15 | openldap | 2.4.46-r0 |
| Alpine 3.16 | openldap | 2.4.46-r0 |
| Alpine 3.17 | openldap | 2.4.46-r0 |
| Alpine 3.18 | openldap | 2.4.46-r0 |
| Alpine 3.19 | openldap | 2.4.46-r0 |
| Alpine 3.20 | openldap | 2.4.46-r0 |
| Alpine 3.21 | openldap | 2.4.46-r0 |
| Alpine 3.22 | openldap | 2.4.46-r0 |
| Alpine 3.23 | openldap | 2.4.46-r0 |
| Alpine 3.24 | openldap | 2.4.46-r0 |
| Alpine 3.7 | openldap | 2.4.46-r0 |
| Alpine 3.8 | openldap | 2.4.46-r0 |
| Alpine 3.9 | openldap | 2.4.46-r0 |
| Debian 12 | openldap | no fix |
| Debian 13 | openldap | no fix |
| Debian 14 | openldap | no fix |
| SUSE Linux Enterprise Desktop 12 SP3 | openldap2 | 2.4.41-18.43.1 |
| SUSE Linux Enterprise Desktop 12 SP4 | openldap2 | 2.4.41-18.43.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | openldap2 | 2.4.46-9.19.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | openldap2 | 2.4.46-9.19.2 |
| SUSE Linux Enterprise Module for Development Tools 15 | openldap2 | 2.4.46-9.19.2 |
| SUSE Linux Enterprise Module for Development Tools 15 SP1 | openldap2 | 2.4.46-9.19.2 |
| SUSE Linux Enterprise Module for Legacy 12 | openldap2 | 2.4.41-18.24.9.7 |
| SUSE Linux Enterprise Module for Legacy 15 | openldap2 | 2.4.46-9.19.2 |
| SUSE Linux Enterprise Module for Legacy 15 SP1 | openldap2 | 2.4.46-9.19.2 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | openldap2 | 2.4.41-18.24.9.7 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | openldap2-client | 2.4.41-18.24.9.1 |
| SUSE Linux Enterprise Server 12 SP3 | openldap2 | 2.4.41-18.43.1 |
| SUSE Linux Enterprise Server 12 SP4 | openldap2 | 2.4.41-18.43.1 |
| SUSE Linux Enterprise Server 12-LTSS | openldap2 | 2.4.41-18.24.9.7 |
| SUSE Linux Enterprise Server 12-LTSS | openldap2-client | 2.4.41-18.24.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | openldap2 | 2.4.41-18.24.9.7 |
| SUSE Linux Enterprise Server for SAP Applications 12 | openldap2-client | 2.4.41-18.24.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | openldap2 | 2.4.41-18.24.9.7 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | openldap2-client | 2.4.41-18.24.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | openldap2 | 2.4.41-18.24.9.7 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | openldap2 | 2.4.41-18.24.9.7 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | openldap2 | 2.4.41-18.43.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | openldap2 | 2.4.41-18.24.9.7 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | openldap2 | 2.4.41-18.43.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | openldap2 | 2.4.41-18.43.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | openldap2 | 2.4.41-18.43.1 |
| openSUSE Leap 15.0 | openldap2 | 2.4.46-lp150.13.1 |
| openSUSE Leap 15.1 | openldap2 | 2.4.46-lp151.10.3.1 |