Home / vulnerabilities

PDF

Mandriva Linux Security Advisory 2015-073

Posted on 28 March 2015
Source : packetstormsecurity.org Link

 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2015:073
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : openldap
Date : March 27, 2015
Affected: Business Server 2.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been discovered and corrected in openldap:

The deref_parseCtrl function in servers/slapd/overlays/deref.c in
OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a
denial of service (NULL pointer dereference and crash) via an empty
attribute list in a deref control in a search request (CVE-2015-1545).

Double free vulnerability in the get_vrFilter function in
servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to
cause a denial of service (crash) via a crafted search query with a
matched values control (CVE-2015-1546).

The updated packages provides a solution for these security issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1545
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1546
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 2/X86_64:
8cf3267fdb2dd7fe3e3d45560bdb21d0 mbs2/x86_64/lib64ldap2.4_2-2.4.40-1.mbs2.x86_64.rpm
865d9a982ce84212ac326c3c1e765bd7 mbs2/x86_64/lib64ldap2.4_2-devel-2.4.40-1.mbs2.x86_64.rpm
5257553f4101f109f611fb4a1169e032 mbs2/x86_64/lib64ldap2.4_2-static-devel-2.4.40-1.mbs2.x86_64.rpm
559e20b8fb73db0a2596ae53debb1171 mbs2/x86_64/openldap-2.4.40-1.mbs2.x86_64.rpm
d768c2cfd50d48df2c6d50cba2804f22 mbs2/x86_64/openldap-back_bdb-2.4.40-1.mbs2.x86_64.rpm
ca1be9bfd5f8494412dacd1704446a3d mbs2/x86_64/openldap-back_mdb-2.4.40-1.mbs2.x86_64.rpm
10616f8ee850c96f6f31a56c04b2f5c8 mbs2/x86_64/openldap-back_sql-2.4.40-1.mbs2.x86_64.rpm
abe8987076d7c071cf0556717824f968 mbs2/x86_64/openldap-clients-2.4.40-1.mbs2.x86_64.rpm
167cde52384ff479dbf66c9c3b9c1875 mbs2/x86_64/openldap-doc-2.4.40-1.mbs2.x86_64.rpm
7bb0cde0c37e82616d7e1c2f51339ea9 mbs2/x86_64/openldap-servers-2.4.40-1.mbs2.x86_64.rpm
fa9deaf6135eb3443dfa4ea2d5906d03 mbs2/x86_64/openldap-servers-devel-2.4.40-1.mbs2.x86_64.rpm
712530d38d7091f1feab1b0f214d8440 mbs2/x86_64/openldap-testprogs-2.4.40-1.mbs2.x86_64.rpm
e2a1576a5731e854ac0395c65014b8ea mbs2/x86_64/openldap-tests-2.4.40-1.mbs2.x86_64.rpm
38e739f91027490ef87474d6053b663f mbs2/SRPMS/openldap-2.4.40-1.mbs2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVFYFxmqjQ0CJFipgRApm0AJ4xcpT1u7CPnC7I7aiJTISBkiS08ACghGEn
vp6R7J2vex/HG9fkmQLo5EI=
=FTac
-----END PGP SIGNATURE-----

 

TOP