bugtraq - [ MDVSA-2015:073 ] openldap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1YbXnc-00024D-FX@titan.mandriva.com>
Date: Fri, 27 Mar 2015 18:12:00 +0100
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2015:073 ] openldap

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:073
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : openldap
 Date    : March 27, 2015
 Affected: Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been discovered and corrected in openldap:
 
 The deref_parseCtrl function in servers/slapd/overlays/deref.c in
 OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a
 denial of service (NULL pointer dereference and crash) via an empty
 attribute list in a deref control in a search request (CVE-2015-1545).
 
 Double free vulnerability in the get_vrFilter function in
 servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to
 cause a denial of service (crash) via a crafted search query with a
 matched values control (CVE-2015-1546).
 
 The updated packages provides a solution for these security issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1545
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1546
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 2/X86_64:
 8cf3267fdb2dd7fe3e3d45560bdb21d0  mbs2/x86_64/lib64ldap2.4_2-2.4.40-1.mbs2.x86_64.rpm
 865d9a982ce84212ac326c3c1e765bd7  mbs2/x86_64/lib64ldap2.4_2-devel-2.4.40-1.mbs2.x86_64.rpm
 5257553f4101f109f611fb4a1169e032  mbs2/x86_64/lib64ldap2.4_2-static-devel-2.4.40-1.mbs2.x86_64.rpm
 559e20b8fb73db0a2596ae53debb1171  mbs2/x86_64/openldap-2.4.40-1.mbs2.x86_64.rpm
 d768c2cfd50d48df2c6d50cba2804f22  mbs2/x86_64/openldap-back_bdb-2.4.40-1.mbs2.x86_64.rpm
 ca1be9bfd5f8494412dacd1704446a3d  mbs2/x86_64/openldap-back_mdb-2.4.40-1.mbs2.x86_64.rpm
 10616f8ee850c96f6f31a56c04b2f5c8  mbs2/x86_64/openldap-back_sql-2.4.40-1.mbs2.x86_64.rpm
 abe8987076d7c071cf0556717824f968  mbs2/x86_64/openldap-clients-2.4.40-1.mbs2.x86_64.rpm
 167cde52384ff479dbf66c9c3b9c1875  mbs2/x86_64/openldap-doc-2.4.40-1.mbs2.x86_64.rpm
 7bb0cde0c37e82616d7e1c2f51339ea9  mbs2/x86_64/openldap-servers-2.4.40-1.mbs2.x86_64.rpm
 fa9deaf6135eb3443dfa4ea2d5906d03  mbs2/x86_64/openldap-servers-devel-2.4.40-1.mbs2.x86_64.rpm
 712530d38d7091f1feab1b0f214d8440  mbs2/x86_64/openldap-testprogs-2.4.40-1.mbs2.x86_64.rpm
 e2a1576a5731e854ac0395c65014b8ea  mbs2/x86_64/openldap-tests-2.4.40-1.mbs2.x86_64.rpm 
 38e739f91027490ef87474d6053b663f  mbs2/SRPMS/openldap-2.4.40-1.mbs2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVFYFxmqjQ0CJFipgRApm0AJ4xcpT1u7CPnC7I7aiJTISBkiS08ACghGEn
vp6R7J2vex/HG9fkmQLo5EI=
=FTac
-----END PGP SIGNATURE-----