Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.3. It is, therefore, affected by multiple vulnerabilities in the following components :

 - Admin Framework
 - Apache
 - ATS
 - Certificate Trust Policy
 - CFNetwork HTTPProtocol
 - CFNetwork Session
 - CFURL
 - CoreAnimation
 - FontParser
 - Graphics Driver
 - Hypervisor
 - ImageIO
 - IOHIDFamily
 - Kernel
 - LaunchServices
 - libnetcore
 - ntp
 - Open Directory Client
 - OpenLDAP
 - OpenSSL
 - PHP
 - QuickLook
 - SceneKit
 - ScreenSharing
 - Security - Code SIgning
 - UniformTypeIdentifiers
 - WebKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

OpenLDAP was updated to fix two security issues and one bug.

The following vulnerabilities were fixed :

  - CVE-2015-1546: slapd crash in valueReturnFilter cleanup     (bnc#916914)

  - CVE-2015-1545: slapd crashes on search with deref     control and empty attr list (bnc#916897)

The following non-security bug was fixed :

  - boo#905959: Prevent connection-0 (internal connection)     from show up in the monitor backend

openldap2 was updated to fix two security issues and one non-security bug.

The following vulnerabilities were fixed :

  - A remote attacker could cause a denial of service     through a NULL pointer dereference and crash via an     empty attribute list in a deref control in a search     request. (bnc#916897 CVE-2015-1545)

  - A remote attacker could cause a denial of service     (crash) via a crafted search query with a matched values     control. (bnc#916914 CVE-2015-1546)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

openldap2 was updated to fix three security issues and one non-security bug.

The following vulnerabilities were fixed :

  - A remote attacker could cause a denial of service (slapd     crash) by unbinding immediately after a search request.
    (bnc#846389, CVE-2013-4449)

  - A remote attacker could cause a denial of service     through a NULL pointer dereference and crash via an     empty attribute list in a deref control in a search     request. (bnc#916897, CVE-2015-1545)

  - A remote attacker could cause a denial of service     (crash) via a crafted search query with a matched values     control. (bnc#916914, CVE-2015-1546) The following     non-security bug was fixed :

  - Prevent connection-0 (internal connection) from showing     up in the monitor back-end. (bnc#905959)

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-004. It is, therefore, affected multiple vulnerabilities in the following components :

  - Apache
  - ATS
  - Certificate Trust Policy
  - CoreAnimation
  - FontParser
  - Graphics Driver
  - ImageIO
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - Open Directory Client
  - OpenLDAP
  - OpenSSL
  - PHP
  - QuickLook
  - SceneKit
  - Security - Code SIgning
  - UniformTypeIdentifiers

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.3. It is, therefore, affected multiple vulnerabilities in the following components :

  - Admin Framework
  - Apache
  - ATS
  - Certificate Trust Policy
  - CFNetwork HTTPProtocol
  - CFNetwork Session
  - CFURL
  - CoreAnimation
  - FontParser
  - Graphics Driver
  - Hypervisor
  - ImageIO
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - libnetcore
  - ntp
  - Open Directory Client
  - OpenLDAP
  - OpenSSL
  - PHP
  - QuickLook
  - SceneKit
  - ScreenSharing
  - Security - Code SIgning
  - UniformTypeIdentifiers
  - WebKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Multiple vulnerabilities has been discovered and corrected in openldap :

The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request (CVE-2015-1545).

Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control (CVE-2015-1546).

The updated packages provides a solution for these security issues.

ID	Name	Product	Family	Severity
700510	Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
85174	openSUSE Security Update : openldap2 (openSUSE-2015-526)	Nessus	SuSE Local Security Checks	medium
84261	SUSE SLED12 / SLES12 Security Update : openldap2 (SUSE-SU-2015:1077-1)	Nessus	SuSE Local Security Checks	medium
83516	SuSE 11.3 Security Update : openldap2 (SAT Patch Number 10635)	Nessus	SuSE Local Security Checks	medium
82700	Mac OS X Multiple Vulnerabilities (Security Update 2015-004) (FREAK)	Nessus	MacOS X Local Security Checks	critical
82699	Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities (FREAK)	Nessus	MacOS X Local Security Checks	critical
82326	Mandriva Linux Security Advisory : openldap (MDVSA-2015:073)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2015-1546

high

Tenable Plugins

critical

medium

medium

medium

critical

critical

medium