CVE-2015-1545

The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 98%
Affected Products (NVD)
VendorProductVersion
openldapopenldap
2.4.13
openldapopenldap
2.4.14
openldapopenldap
2.4.15
openldapopenldap
2.4.16
openldapopenldap
2.4.17
openldapopenldap
2.4.18
openldapopenldap
2.4.19
openldapopenldap
2.4.20
openldapopenldap
2.4.21
openldapopenldap
2.4.22
openldapopenldap
2.4.23
openldapopenldap
2.4.24
openldapopenldap
2.4.25
openldapopenldap
2.4.26
openldapopenldap
2.4.27
openldapopenldap
2.4.28
openldapopenldap
2.4.29
openldapopenldap
2.4.30
openldapopenldap
2.4.31
openldapopenldap
2.4.32
openldapopenldap
2.4.33
openldapopenldap
2.4.34
openldapopenldap
2.4.35
openldapopenldap
2.4.36
openldapopenldap
2.4.37
openldapopenldap
2.4.38
openldapopenldap
2.4.39
openldapopenldap
2.4.40
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
openldap
bookworm
2.5.13+dfsg-5
fixed
bullseye
2.4.57+dfsg-3+deb11u1
fixed
bullseye (security)
2.4.57+dfsg-3+deb11u1
fixed
sid
2.5.18+dfsg-3
fixed
squeeze
no-dsa
trixie
2.5.18+dfsg-3
fixed
wheezy
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
openldap
lucid
ignored
precise
Fixed 2.4.28-1.1ubuntu4.5
released
trusty
Fixed 2.4.31-1+nmu2ubuntu8.1
released
utopic
Fixed 2.4.31-1+nmu2ubuntu11.1
released
vivid
Fixed 2.4.31-1+nmu2ubuntu12.1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libldap-2_4-2
suse enterprise desktop 15
2.4.46-7.10
fixed
suse enterprise desktop 15 SP1
2.4.46-9.3.1
fixed
suse enterprise desktop 15 SP2
2.4.46-9.28.2
fixed
suse enterprise desktop 15 SP3
2.4.46-9.51.1
fixed
suse enterprise desktop 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise desktop 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise desktop 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise desktop 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise sap 15
2.4.46-7.10
fixed
suse enterprise sap 15 SP1
2.4.46-9.3.1
fixed
suse enterprise sap 15 SP2
2.4.46-9.28.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.51.1
fixed
suse enterprise sap 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise sap 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise sap 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise sap 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise server 15
2.4.46-7.10
fixed
suse enterprise server 15 SP1
2.4.46-9.3.1
fixed
suse enterprise server 15 SP2
2.4.46-9.28.2
fixed
suse enterprise server 15 SP3
2.4.46-9.51.1
fixed
suse enterprise server 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise server 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise server 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise server 15 SP7
2.4.46-150600.23.21
fixed
libldap-2_4-2-32bit
suse enterprise desktop 15
2.4.46-7.10
fixed
suse enterprise desktop 15 SP1
2.4.46-9.3.1
fixed
suse enterprise desktop 15 SP2
2.4.46-9.28.2
fixed
suse enterprise desktop 15 SP3
2.4.46-9.51.1
fixed
suse enterprise desktop 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise desktop 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise desktop 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise desktop 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise sap 15
2.4.46-7.10
fixed
suse enterprise sap 15 SP1
2.4.46-9.3.1
fixed
suse enterprise sap 15 SP2
2.4.46-9.28.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.51.1
fixed
suse enterprise sap 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise sap 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise sap 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise sap 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise server 15
2.4.46-7.10
fixed
suse enterprise server 15 SP1
2.4.46-9.3.1
fixed
suse enterprise server 15 SP2
2.4.46-9.28.2
fixed
suse enterprise server 15 SP3
2.4.46-9.51.1
fixed
suse enterprise server 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise server 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise server 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise server 15 SP7
2.4.46-150600.23.21
fixed
libldap-data
suse enterprise desktop 15 SP2
2.4.46-9.28.2
fixed
suse enterprise desktop 15 SP3
2.4.46-9.51.1
fixed
suse enterprise desktop 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise desktop 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise desktop 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise desktop 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise sap 15 SP2
2.4.46-9.28.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.51.1
fixed
suse enterprise sap 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise sap 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise sap 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise sap 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise server 15 SP2
2.4.46-9.28.2
fixed
suse enterprise server 15 SP3
2.4.46-9.51.1
fixed
suse enterprise server 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise server 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise server 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise server 15 SP7
2.4.46-150600.23.21
fixed
openldap2
suse enterprise desktop 15 SP2
2.4.46-9.28.2
fixed
suse enterprise sap 15
2.4.46-7.10
fixed
suse enterprise sap 15 SP1
2.4.46-9.3.1
fixed
suse enterprise sap 15 SP2
2.4.46-9.28.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.51.1
fixed
suse enterprise server 15
2.4.46-7.10
fixed
suse enterprise server 15 SP1
2.4.46-9.3.1
fixed
suse enterprise server 15 SP2
2.4.46-9.28.2
fixed
suse enterprise server 15 SP3
2.4.46-9.51.1
fixed
openldap2-back-meta
suse enterprise sap 15
2.4.46-7.10
fixed
suse enterprise sap 15 SP1
2.4.46-9.3.1
fixed
suse enterprise sap 15 SP2
2.4.46-9.28.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.51.1
fixed
suse enterprise server 15
2.4.46-7.10
fixed
suse enterprise server 15 SP1
2.4.46-9.3.1
fixed
suse enterprise server 15 SP2
2.4.46-9.28.2
fixed
suse enterprise server 15 SP3
2.4.46-9.51.1
fixed
openldap2-back-perl
suse enterprise sap 15
2.4.46-7.10
fixed
suse enterprise sap 15 SP1
2.4.46-9.3.1
fixed
suse enterprise sap 15 SP2
2.4.46-9.28.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.51.1
fixed
suse enterprise server 15
2.4.46-7.10
fixed
suse enterprise server 15 SP1
2.4.46-9.3.1
fixed
suse enterprise server 15 SP2
2.4.46-9.28.2
fixed
suse enterprise server 15 SP3
2.4.46-9.51.1
fixed
openldap2-client
suse enterprise desktop 15
2.4.46-7.10
fixed
suse enterprise desktop 15 SP1
2.4.46-9.3.1
fixed
suse enterprise desktop 15 SP2
2.4.46-9.28.2
fixed
suse enterprise desktop 15 SP3
2.4.46-9.51.1
fixed
suse enterprise desktop 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise desktop 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise desktop 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise desktop 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise sap 15
2.4.46-7.10
fixed
suse enterprise sap 15 SP1
2.4.46-9.3.1
fixed
suse enterprise sap 15 SP2
2.4.46-9.28.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.51.1
fixed
suse enterprise sap 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise sap 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise sap 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise sap 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise server 15
2.4.46-7.10
fixed
suse enterprise server 15 SP1
2.4.46-9.3.1
fixed
suse enterprise server 15 SP2
2.4.46-9.28.2
fixed
suse enterprise server 15 SP3
2.4.46-9.51.1
fixed
suse enterprise server 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise server 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise server 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise server 15 SP7
2.4.46-150600.23.21
fixed
openldap2-devel
suse enterprise desktop 15
2.4.46-7.10
fixed
suse enterprise desktop 15 SP1
2.4.46-9.3.1
fixed
suse enterprise desktop 15 SP2
2.4.46-9.28.2
fixed
suse enterprise desktop 15 SP3
2.4.46-9.51.1
fixed
suse enterprise desktop 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise desktop 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise desktop 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise desktop 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise sap 15
2.4.46-7.10
fixed
suse enterprise sap 15 SP1
2.4.46-9.3.1
fixed
suse enterprise sap 15 SP2
2.4.46-9.28.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.51.1
fixed
suse enterprise sap 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise sap 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise sap 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise sap 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise server 15
2.4.46-7.10
fixed
suse enterprise server 15 SP1
2.4.46-9.3.1
fixed
suse enterprise server 15 SP2
2.4.46-9.28.2
fixed
suse enterprise server 15 SP3
2.4.46-9.51.1
fixed
suse enterprise server 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise server 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise server 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise server 15 SP7
2.4.46-150600.23.21
fixed
openldap2-devel-static
suse enterprise desktop 15
2.4.46-7.10
fixed
suse enterprise desktop 15 SP1
2.4.46-9.3.1
fixed
suse enterprise desktop 15 SP2
2.4.46-9.28.2
fixed
suse enterprise desktop 15 SP3
2.4.46-9.51.1
fixed
suse enterprise desktop 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise desktop 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise desktop 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise desktop 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise sap 15
2.4.46-7.10
fixed
suse enterprise sap 15 SP1
2.4.46-9.3.1
fixed
suse enterprise sap 15 SP2
2.4.46-9.28.2
fixed
suse enterprise sap 15 SP3
2.4.46-9.51.1
fixed
suse enterprise sap 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise sap 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise sap 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise sap 15 SP7
2.4.46-150600.23.21
fixed
suse enterprise server 15
2.4.46-7.10
fixed
suse enterprise server 15 SP1
2.4.46-9.3.1
fixed
suse enterprise server 15 SP2
2.4.46-9.28.2
fixed
suse enterprise server 15 SP3
2.4.46-9.51.1
fixed
suse enterprise server 15 SP4
2.4.46-150200.14.5.1
fixed
suse enterprise server 15 SP5
2.4.46-150200.14.11.2
fixed
suse enterprise server 15 SP6
2.4.46-150600.23.21
fixed
suse enterprise server 15 SP7
2.4.46-150600.23.21
fixed
openldap2-ppolicy-check-password
suse enterprise desktop 15 SP2
1.2-9.28.2
fixed
suse enterprise sap 15 SP2
1.2-9.28.2
fixed
suse enterprise sap 15 SP3
1.2-9.51.1
fixed
suse enterprise server 15 SP2
1.2-9.28.2
fixed
suse enterprise server 15 SP3
1.2-9.51.1
fixed
References
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
http://lists.opensuse.org/opensuse-updates/2015-07/msg00069.html
http://seclists.org/fulldisclosure/2019/Dec/26
http://secunia.com/advisories/62787
http://www.debian.org/security/2015/dsa-3209
http://www.mandriva.com/security/advisories?name=MDVSA-2015:073
http://www.mandriva.com/security/advisories?name=MDVSA-2015:074
http://www.openldap.org/devel/gitweb.cgi?p=openldap.git%3Ba=commit%3Bh=c32e74763f77675b9e144126e375977ed6dc562c
http://www.openldap.org/its/?findid=8027
http://www.openwall.com/lists/oss-security/2015/02/07/3
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
http://www.securityfocus.com/bid/72519
http://www.securitytracker.com/id/1032399
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988
https://exchange.xforce.ibmcloud.com/vulnerabilities/100937
https://seclists.org/bugtraq/2019/Dec/23
https://support.apple.com/HT204659
https://support.apple.com/kb/HT210788
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
http://lists.opensuse.org/opensuse-updates/2015-07/msg00069.html
http://seclists.org/fulldisclosure/2019/Dec/26
http://secunia.com/advisories/62787
http://www.debian.org/security/2015/dsa-3209
http://www.mandriva.com/security/advisories?name=MDVSA-2015:073
http://www.mandriva.com/security/advisories?name=MDVSA-2015:074
http://www.openldap.org/devel/gitweb.cgi?p=openldap.git%3Ba=commit%3Bh=c32e74763f77675b9e144126e375977ed6dc562c
http://www.openldap.org/its/?findid=8027
http://www.openwall.com/lists/oss-security/2015/02/07/3
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
http://www.securityfocus.com/bid/72519
http://www.securitytracker.com/id/1032399
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988
https://exchange.xforce.ibmcloud.com/vulnerabilities/100937
https://seclists.org/bugtraq/2019/Dec/23
https://support.apple.com/HT204659
https://support.apple.com/kb/HT210788