CVE-2017-9287 — openldap - security update

Description

servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged Results control with a page size of 0.

How to fix CVE-2017-9287

To remediate CVE-2017-9287, upgrade the affected package to a fixed version below.

Alpine/openldap—upgrade to 2.4.44-r5 or later
—upgrade to 2.4.44+dfsg-5 or later
—upgrade to 2.4.31-2+deb7u3 or later
—upgrade to 2.4.40+dfsg-1+deb8u3 or later

Is CVE-2017-9287 being exploited?

Moderate — EPSS is 22.8%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (4)

from 0, < 2.4.44-r5
from 0, < 2.4.44+dfsg-5
from 0, < 2.4.31-2+deb7u3
from 0, < 2.4.40+dfsg-1+deb8u3

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References (2)

ADVISORYsecurity.alpinelinux.org/vuln/CVE-2017-9287
ADVISORYsecurity-tracker.debian.org/tracker/CVE-2017-9287