Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:0931-1

Опубликовано: 11 апр. 2019
Источник: suse-cvrf

Описание

Security update for openldap2

This update for openldap2 fixes the following issues:

Security issues fixed:

  • CVE-2017-9287: A double free vulnerability in the mdb backend during search with page size 0 was fixed (bsc#1041764).
  • CVE-2017-17740: Fixed a denial of service (slapd crash) via a member MODDN operation that could have been triggered when both the nops module and the memberof overlay are enabled (bsc#1073313).

Non-security issues fixed:

  • Fix a regression in handling of non-blocking connections (bsc#1031702)
  • Fix an uninitialised variable that causes startup failure (bsc#1037396)
  • Fix libldap leaks socket descriptors issue (bsc#1065083)

Список пакетов

SUSE Linux Enterprise Module for Legacy 12
compat-libldap-2_3-0-2.3.37-18.24.9.7
SUSE Linux Enterprise Server 12 SP1-LTSS
libldap-2_4-2-2.4.41-18.24.9.1
libldap-2_4-2-32bit-2.4.41-18.24.9.1
openldap2-2.4.41-18.24.9.7
openldap2-back-meta-2.4.41-18.24.9.7
openldap2-client-2.4.41-18.24.9.1
SUSE Linux Enterprise Server 12-LTSS
libldap-2_4-2-2.4.41-18.24.9.1
libldap-2_4-2-32bit-2.4.41-18.24.9.1
openldap2-2.4.41-18.24.9.7
openldap2-back-meta-2.4.41-18.24.9.7
openldap2-client-2.4.41-18.24.9.1
SUSE Linux Enterprise Server for SAP Applications 12
compat-libldap-2_3-0-2.3.37-18.24.9.7
libldap-2_4-2-2.4.41-18.24.9.1
libldap-2_4-2-32bit-2.4.41-18.24.9.1
openldap2-2.4.41-18.24.9.7
openldap2-back-meta-2.4.41-18.24.9.7
openldap2-client-2.4.41-18.24.9.1
SUSE Linux Enterprise Server for SAP Applications 12 SP1
compat-libldap-2_3-0-2.3.37-18.24.9.7
libldap-2_4-2-2.4.41-18.24.9.1
libldap-2_4-2-32bit-2.4.41-18.24.9.1
openldap2-2.4.41-18.24.9.7
openldap2-back-meta-2.4.41-18.24.9.7
openldap2-client-2.4.41-18.24.9.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2
compat-libldap-2_3-0-2.3.37-18.24.9.7
SUSE Linux Enterprise Server for SAP Applications 12 SP3
compat-libldap-2_3-0-2.3.37-18.24.9.7
SUSE Linux Enterprise Server for SAP Applications 12 SP4
compat-libldap-2_3-0-2.3.37-18.24.9.7

Ссылки

Описание

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.

Затронутые продукты
SUSE Linux Enterprise Module for Legacy 12:compat-libldap-2_3-0-2.3.37-18.24.9.7
SUSE Linux Enterprise Server 12 SP1-LTSS:libldap-2_4-2-2.4.41-18.24.9.1
SUSE Linux Enterprise Server 12 SP1-LTSS:libldap-2_4-2-32bit-2.4.41-18.24.9.1
SUSE Linux Enterprise Server 12 SP1-LTSS:openldap2-2.4.41-18.24.9.7
Ссылки

Описание

servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged Results control with a page size of 0.

Затронутые продукты
SUSE Linux Enterprise Module for Legacy 12:compat-libldap-2_3-0-2.3.37-18.24.9.7
SUSE Linux Enterprise Server 12 SP1-LTSS:libldap-2_4-2-2.4.41-18.24.9.1
SUSE Linux Enterprise Server 12 SP1-LTSS:libldap-2_4-2-32bit-2.4.41-18.24.9.1
SUSE Linux Enterprise Server 12 SP1-LTSS:openldap2-2.4.41-18.24.9.7
Ссылки
Уязвимость SUSE-SU-2019:0931-1