CVE-2015-6908
NoneCVSS
—
EPSS
18.8%
Published
Sep 11, 2015
CISA due date
—
The record
The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | openldap | 0 | 2.4.42+dfsg-2 |
| Debian:12 | openldap | 0 | 2.4.42+dfsg-2 |
| Debian:13 | openldap | 0 | 2.4.42+dfsg-2 |
| Debian:6.0 | openldap | 0 | 2.4.23-7.3+deb6u2 |
| Debian:7 | openldap | 0 | 2.4.31-2+deb7u1 |
| Debian:8 | openldap | 0 | 2.4.40+dfsg-1+deb8u1 |
| Mageia:4 | openldap | 0 | 2.4.38-1.5.mga4 |
| Mageia:5 | openldap | 0 | 2.4.40-3.1.mga5 |
| Red Hat:enterprise_linux:5::client | compat-openldap | 0 | 0:2.3.43_2.2.29-29.el5_11 |
| Red Hat:enterprise_linux:5::client | openldap | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::client | openldap-clients | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::client | openldap-debuginfo | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::client | openldap-devel | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::client | openldap-servers | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::client | openldap-servers-overlays | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::client | openldap-servers-sql | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::client_workstation | compat-openldap | 0 | 0:2.3.43_2.2.29-29.el5_11 |
| Red Hat:enterprise_linux:5::client_workstation | openldap | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::client_workstation | openldap-clients | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::client_workstation | openldap-debuginfo | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::client_workstation | openldap-devel | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::client_workstation | openldap-servers | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::client_workstation | openldap-servers-overlays | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::client_workstation | openldap-servers-sql | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::server | compat-openldap | 0 | 0:2.3.43_2.2.29-29.el5_11 |
| Red Hat:enterprise_linux:5::server | openldap | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::server | openldap-clients | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::server | openldap-debuginfo | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::server | openldap-devel | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::server | openldap-servers | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::server | openldap-servers-overlays | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:5::server | openldap-servers-sql | 0 | 0:2.3.43-29.el5_11 |
| Red Hat:enterprise_linux:6::client | openldap | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::client | openldap-clients | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::client | openldap-debuginfo | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::client | openldap-devel | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::client | openldap-servers | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::client | openldap-servers-sql | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::computenode | openldap | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::computenode | openldap-clients | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::computenode | openldap-debuginfo | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::computenode | openldap-devel | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::computenode | openldap-servers | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::computenode | openldap-servers-sql | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::server | openldap | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::server | openldap-clients | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::server | openldap-debuginfo | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::server | openldap-devel | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::server | openldap-servers | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::server | openldap-servers-sql | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::workstation | openldap | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::workstation | openldap-clients | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::workstation | openldap-debuginfo | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::workstation | openldap-devel | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::workstation | openldap-servers | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:6::workstation | openldap-servers-sql | 0 | 0:2.4.40-6.el6_7 |
| Red Hat:enterprise_linux:7::client | openldap | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::client | openldap-clients | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::client | openldap-debuginfo | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::client | openldap-devel | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::client | openldap-servers | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::client | openldap-servers-sql | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::computenode | openldap | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::computenode | openldap-clients | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::computenode | openldap-debuginfo | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::computenode | openldap-devel | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::computenode | openldap-servers | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::computenode | openldap-servers-sql | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::server | openldap | 0 | 0:2.4.39-7.ael7b_1 |
| Red Hat:enterprise_linux:7::server | openldap-clients | 0 | 0:2.4.39-7.ael7b_1 |
| Red Hat:enterprise_linux:7::server | openldap-debuginfo | 0 | 0:2.4.39-7.ael7b_1 |
| Red Hat:enterprise_linux:7::server | openldap-devel | 0 | 0:2.4.39-7.ael7b_1 |
| Red Hat:enterprise_linux:7::server | openldap-servers | 0 | 0:2.4.39-7.ael7b_1 |
| Red Hat:enterprise_linux:7::server | openldap-servers-sql | 0 | 0:2.4.39-7.ael7b_1 |
| Red Hat:enterprise_linux:7::workstation | openldap | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::workstation | openldap-clients | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::workstation | openldap-debuginfo | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::workstation | openldap-devel | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::workstation | openldap-servers | 0 | 0:2.4.39-7.el7_1 |
| Red Hat:enterprise_linux:7::workstation | openldap-servers-sql | 0 | 0:2.4.39-7.el7_1 |
| SUSE:Linux Enterprise Desktop 11 SP3 | openldap2-client | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Desktop 11 SP4 | openldap2-client | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Desktop 12 | openldap2-client | 0 | 2.4.41-18.13.1 |
| SUSE:Linux Enterprise Desktop 12 SP1 | openldap2-client | 0 | 2.4.41-18.13.1 |
| SUSE:Linux Enterprise Module for Legacy 12 | openldap2 | 0 | 2.4.41-18.13.4 |
| SUSE:Linux Enterprise Server 11 SP3 | openldap2 | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Server 11 SP3 | openldap2-client | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Server 11 SP3-TERADATA | openldap2 | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Server 11 SP3-TERADATA | openldap2-client | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Server 11 SP4 | openldap2 | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Server 11 SP4 | openldap2-client | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Server 11-SECURITY | openldap2-client-openssl1 | 0 | 2.4.26-0.62.3 |
| SUSE:Linux Enterprise Server 12 | openldap2 | 0 | 2.4.41-18.13.4 |
| SUSE:Linux Enterprise Server 12 | openldap2-client | 0 | 2.4.41-18.13.1 |
| SUSE:Linux Enterprise Server 12 SP1 | openldap2 | 0 | 2.4.41-18.13.4 |
| SUSE:Linux Enterprise Server 12 SP1 | openldap2-client | 0 | 2.4.41-18.13.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP3 | openldap2 | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP3 | openldap2-client | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | openldap2 | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | openldap2-client | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Server for SAP Applications 12 | openldap2 | 0 | 2.4.41-18.13.4 |
| SUSE:Linux Enterprise Server for SAP Applications 12 | openldap2-client | 0 | 2.4.41-18.13.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | openldap2 | 0 | 2.4.41-18.13.4 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | openldap2-client | 0 | 2.4.41-18.13.1 |
| SUSE:Linux Enterprise Software Development Kit 11 SP3 | openldap2 | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Software Development Kit 11 SP3 | openldap2-client | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Software Development Kit 11 SP4 | openldap2 | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Software Development Kit 11 SP4 | openldap2-client | 0 | 2.4.26-0.62.2 |
| SUSE:Linux Enterprise Software Development Kit 12 | openldap2 | 0 | 2.4.41-18.13.4 |
| SUSE:Linux Enterprise Software Development Kit 12 | openldap2-client | 0 | 2.4.41-18.13.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | openldap2 | 0 | 2.4.41-18.13.4 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | openldap2-client | 0 | 2.4.41-18.13.1 |
| SUSE:Studio Onsite 1.3 | openldap2-client | 0 | 2.4.26-0.17.23.1 |
| Ubuntu:14.04:LTS | openldap | 0 | 2.4.31-1+nmu2ubuntu8.2 |
| openSUSE:Tumbleweed | openldap2 | 0 | 1.2-22.1 |
Related vulnerabilities
- CVE-2023-2953 A vulnerability was found in openldap. Also affects openldap
- CVE-2017-9287 servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free… Also affects openldap
- CVE-2014-9713 The default slapd configuration in the Debian openldap package 2.4.23-3 through… Also affects openldap
- CVE-2015-1545 The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through… Also affects openldap
- CVE-2013-4449 The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count… Also affects openldap
- CVE-2012-1164 slapd in OpenLDAP before 2.4.30 allows remote attackers to cause a denial of service… Also affects openldap
- CVE-2011-1081 modrdn.c in slapd in OpenLDAP 2.4.x before 2.4.24 allows remote attackers to cause a… Also affects openldap
- CVE-2010-0211 The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return… Also affects openldap