Security update for openldap2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0887-1 Final 1 1 2015-04-13T12:35:26Z current 2015-04-13T12:35:26Z 2015-04-13T12:35:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openldap2 openldap2 was updated to fix three security issues and one non-security bug. The following vulnerabilities were fixed: * A remote attacker could cause a denial of service (slapd crash) by unbinding immediately after a search request. (bnc#846389, CVE-2013-4449) * A remote attacker could cause a denial of service through a NULL pointer dereference and crash via an empty attribute list in a deref control in a search request. (bnc#916897, CVE-2015-1545) * A remote attacker could cause a denial of service (crash) via a crafted search query with a matched values control. (bnc#916914, CVE-2015-1546) The following non-security bug was fixed: * Prevent connection-0 (internal connection) from showing up in the monitor back-end. (bnc#905959) Security Issues: * CVE-2015-1546 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1546> * CVE-2015-1545 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1545> * CVE-2013-4449 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4449> The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp3-openldap2-20150423,secsp3-openldap2-20150423,sledsp3-openldap2-20150423,slessp3-openldap2-20150423 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150887-1/ Link for SUSE-SU-2015:0887-1 https://lists.suse.com/pipermail/sle-security-updates/2015-May/001389.html E-Mail link for SUSE-SU-2015:0887-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/846389 SUSE Bug 846389 https://bugzilla.suse.com/905959 SUSE Bug 905959 https://bugzilla.suse.com/916897 SUSE Bug 916897 https://bugzilla.suse.com/916914 SUSE Bug 916914 https://www.suse.com/security/cve/CVE-2013-4449/ SUSE CVE CVE-2013-4449 page https://www.suse.com/security/cve/CVE-2015-1545/ SUSE CVE CVE-2015-1545 page https://www.suse.com/security/cve/CVE-2015-1546/ SUSE CVE CVE-2015-1546 page SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server 11-SECURITY SUSE Linux Enterprise Server for SAP Applications 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP3 openldap2-2.4.26-0.30.1 openldap2-back-perl-2.4.26-0.30.1 openldap2-devel-2.4.26-0.30.1 openldap2-devel-32bit-2.4.26-0.30.1 libldap-openssl1-2_4-2-2.4.26-0.30.2 libldap-openssl1-2_4-2-32bit-2.4.26-0.30.2 libldap-openssl1-2_4-2-x86-2.4.26-0.30.2 libldap-2_4-2-2.4.26-0.30.1 libldap-2_4-2-32bit-2.4.26-0.30.1 openldap2-client-2.4.26-0.30.1 compat-libldap-2_3-0-2.3.37-2.30.1 libldap-2_4-2-x86-2.4.26-0.30.1 openldap2-back-meta-2.4.26-0.30.1 libldap-2_4-2-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 libldap-2_4-2-32bit-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 openldap2-client-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 compat-libldap-2_3-0-2.3.37-2.30.1 as a component of SUSE Linux Enterprise Server 11 SP3 libldap-2_4-2-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP3 libldap-2_4-2-32bit-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP3 libldap-2_4-2-x86-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP3 openldap2-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP3 openldap2-back-meta-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP3 openldap2-client-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP3 compat-libldap-2_3-0-2.3.37-2.30.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libldap-2_4-2-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libldap-2_4-2-32bit-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libldap-2_4-2-x86-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA openldap2-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA openldap2-back-meta-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA openldap2-client-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libldap-openssl1-2_4-2-2.4.26-0.30.2 as a component of SUSE Linux Enterprise Server 11-SECURITY libldap-openssl1-2_4-2-32bit-2.4.26-0.30.2 as a component of SUSE Linux Enterprise Server 11-SECURITY libldap-openssl1-2_4-2-x86-2.4.26-0.30.2 as a component of SUSE Linux Enterprise Server 11-SECURITY compat-libldap-2_3-0-2.3.37-2.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libldap-2_4-2-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libldap-2_4-2-32bit-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libldap-2_4-2-x86-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 openldap2-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 openldap2-back-meta-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 openldap2-client-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 openldap2-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 openldap2-back-perl-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 openldap2-devel-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 openldap2-devel-32bit-2.4.26-0.30.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search. CVE-2013-4449 SUSE Linux Enterprise Desktop 11 SP3:libldap-2_4-2-2.4.26-0.30.1 SUSE Linux Enterprise Desktop 11 SP3:libldap-2_4-2-32bit-2.4.26-0.30.1 SUSE Linux Enterprise Desktop 11 SP3:openldap2-client-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:compat-libldap-2_3-0-2.3.37-2.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libldap-2_4-2-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libldap-2_4-2-32bit-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libldap-2_4-2-x86-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:openldap2-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:openldap2-back-meta-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:openldap2-client-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:compat-libldap-2_3-0-2.3.37-2.30.1 SUSE Linux Enterprise Server 11 SP3:libldap-2_4-2-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:libldap-2_4-2-32bit-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:libldap-2_4-2-x86-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:openldap2-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:openldap2-back-meta-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:openldap2-client-2.4.26-0.30.1 SUSE Linux Enterprise Server 11-SECURITY:libldap-openssl1-2_4-2-2.4.26-0.30.2 SUSE Linux Enterprise Server 11-SECURITY:libldap-openssl1-2_4-2-32bit-2.4.26-0.30.2 SUSE Linux Enterprise Server 11-SECURITY:libldap-openssl1-2_4-2-x86-2.4.26-0.30.2 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-libldap-2_3-0-2.3.37-2.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libldap-2_4-2-2.4.26-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libldap-2_4-2-32bit-2.4.26-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libldap-2_4-2-x86-2.4.26-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:openldap2-2.4.26-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:openldap2-back-meta-2.4.26-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:openldap2-client-2.4.26-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP3:openldap2-2.4.26-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP3:openldap2-back-perl-2.4.26-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP3:openldap2-devel-2.4.26-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP3:openldap2-devel-32bit-2.4.26-0.30.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150887-1/ https://www.suse.com/security/cve/CVE-2013-4449.html CVE-2013-4449 https://bugzilla.suse.com/846389 SUSE Bug 846389 https://bugzilla.suse.com/916897 SUSE Bug 916897 https://bugzilla.suse.com/916914 SUSE Bug 916914 The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request. CVE-2015-1545 SUSE Linux Enterprise Desktop 11 SP3:libldap-2_4-2-2.4.26-0.30.1 SUSE Linux Enterprise Desktop 11 SP3:libldap-2_4-2-32bit-2.4.26-0.30.1 SUSE Linux Enterprise Desktop 11 SP3:openldap2-client-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:compat-libldap-2_3-0-2.3.37-2.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libldap-2_4-2-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libldap-2_4-2-32bit-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libldap-2_4-2-x86-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:openldap2-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:openldap2-back-meta-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:openldap2-client-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:compat-libldap-2_3-0-2.3.37-2.30.1 SUSE Linux Enterprise Server 11 SP3:libldap-2_4-2-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:libldap-2_4-2-32bit-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:libldap-2_4-2-x86-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:openldap2-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:openldap2-back-meta-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:openldap2-client-2.4.26-0.30.1 SUSE Linux Enterprise Server 11-SECURITY:libldap-openssl1-2_4-2-2.4.26-0.30.2 SUSE Linux Enterprise Server 11-SECURITY:libldap-openssl1-2_4-2-32bit-2.4.26-0.30.2 SUSE Linux Enterprise Server 11-SECURITY:libldap-openssl1-2_4-2-x86-2.4.26-0.30.2 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-libldap-2_3-0-2.3.37-2.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libldap-2_4-2-2.4.26-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libldap-2_4-2-32bit-2.4.26-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libldap-2_4-2-x86-2.4.26-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:openldap2-2.4.26-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:openldap2-back-meta-2.4.26-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:openldap2-client-2.4.26-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP3:openldap2-2.4.26-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP3:openldap2-back-perl-2.4.26-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP3:openldap2-devel-2.4.26-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP3:openldap2-devel-32bit-2.4.26-0.30.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150887-1/ https://www.suse.com/security/cve/CVE-2015-1545.html CVE-2015-1545 https://bugzilla.suse.com/846389 SUSE Bug 846389 https://bugzilla.suse.com/916897 SUSE Bug 916897 https://bugzilla.suse.com/916914 SUSE Bug 916914 Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control. CVE-2015-1546 SUSE Linux Enterprise Desktop 11 SP3:libldap-2_4-2-2.4.26-0.30.1 SUSE Linux Enterprise Desktop 11 SP3:libldap-2_4-2-32bit-2.4.26-0.30.1 SUSE Linux Enterprise Desktop 11 SP3:openldap2-client-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:compat-libldap-2_3-0-2.3.37-2.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libldap-2_4-2-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libldap-2_4-2-32bit-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libldap-2_4-2-x86-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:openldap2-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:openldap2-back-meta-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:openldap2-client-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:compat-libldap-2_3-0-2.3.37-2.30.1 SUSE Linux Enterprise Server 11 SP3:libldap-2_4-2-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:libldap-2_4-2-32bit-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:libldap-2_4-2-x86-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:openldap2-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:openldap2-back-meta-2.4.26-0.30.1 SUSE Linux Enterprise Server 11 SP3:openldap2-client-2.4.26-0.30.1 SUSE Linux Enterprise Server 11-SECURITY:libldap-openssl1-2_4-2-2.4.26-0.30.2 SUSE Linux Enterprise Server 11-SECURITY:libldap-openssl1-2_4-2-32bit-2.4.26-0.30.2 SUSE Linux Enterprise Server 11-SECURITY:libldap-openssl1-2_4-2-x86-2.4.26-0.30.2 SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-libldap-2_3-0-2.3.37-2.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libldap-2_4-2-2.4.26-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libldap-2_4-2-32bit-2.4.26-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libldap-2_4-2-x86-2.4.26-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:openldap2-2.4.26-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:openldap2-back-meta-2.4.26-0.30.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:openldap2-client-2.4.26-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP3:openldap2-2.4.26-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP3:openldap2-back-perl-2.4.26-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP3:openldap2-devel-2.4.26-0.30.1 SUSE Linux Enterprise Software Development Kit 11 SP3:openldap2-devel-32bit-2.4.26-0.30.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150887-1/ https://www.suse.com/security/cve/CVE-2015-1546.html CVE-2015-1546 https://bugzilla.suse.com/916914 SUSE Bug 916914