Vulnerability Description
servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged Results control with a page size of 0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openldap | Openldap | <= 2.4.44 |
| Debian | Debian Linux | 8.0 |
| Redhat | Enterprise Linux Desktop | 7.0 |
| Redhat | Enterprise Linux Eus | 7.4 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Server Aus | 7.4 |
| Redhat | Enterprise Linux Server Tus | 7.6 |
| Redhat | Enterprise Linux Workstation | 7.0 |
| Mcafee | Policy Auditor | < 6.5.1 |
| Oracle | Blockchain Platform | < 21.1.2 |
Related Weaknesses (CWE)
References
- http://www.debian.org/security/2017/dsa-3868Third Party Advisory
- http://www.openldap.org/its/?findid=8655ExploitPatchVendor Advisory
- http://www.securityfocus.com/bid/98736Broken Link
- http://www.securitytracker.com/id/1038591Broken Link
- https://access.redhat.com/errata/RHSA-2017:1852Third Party Advisory
- https://bugs.debian.org/863563Issue TrackingPatchThird Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- http://www.debian.org/security/2017/dsa-3868Third Party Advisory
- http://www.openldap.org/its/?findid=8655ExploitPatchVendor Advisory
- http://www.securityfocus.com/bid/98736Broken Link
- http://www.securitytracker.com/id/1038591Broken Link
- https://access.redhat.com/errata/RHSA-2017:1852Third Party Advisory
- https://bugs.debian.org/863563Issue TrackingPatchThird Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365Third Party Advisory
FAQ
What is CVE-2017-9287?
CVE-2017-9287 is a vulnerability with a CVSS score of 6.5 (MEDIUM). servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged R...
How severe is CVE-2017-9287?
CVE-2017-9287 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-9287?
Check the references section above for vendor advisories and patch information. Affected products include: Openldap Openldap, Debian Debian Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server.