OpenLDAP before 2.3.39 allows remote attackers to cause a denial of service (slapd crash) via an LDAP request with a malformed objectClasses attribute. NOTE: this has been reported as a double free, but the reports are inconsistent.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Openldap | — | Apply OS X security update 2009-006 | Dec 16, 2011 | Oct 30, 2007 |
| Freebsd | — | Upgrade openldap-server | Dec 10, 2025 | Oct 30, 2007 |
| Gentoo Linux | — | Upgrade net-nds/openldap. | Oct 30, 2017 | Oct 30, 2007 |
| Oracle_linux | — | Upgrade openldap-servers-sqlUpgrade openldap-clientsUpgrade compat-openldapUpgrade openldap-serversUpgrade openldap-develUpgrade openldap | Oct 16, 2024 | Oct 30, 2007 |
| Suse | — | Upgrade openldap2Upgrade openldap2-devel-32bitUpgrade suse-releaseUpgrade openldap2-back-perlUpgrade openldap2-back-metaUpgrade openldap2-develUpgrade openldap2-devel-64bit | Feb 17, 2015 | Oct 30, 2007 |
| Ubuntu | — | Upgrade slapd | Nov 8, 2024 | Oct 30, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub