CVE-2007-5794
Race condition in nss_ldap, when used in applications that are linked against the pthread library...
Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned, but other applications might also be affected.
Exploit likelihood
What each source reports
NVD Score used
Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned, but other applications might also be affected.
- Record
CVE-2007-5794- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned, but other applications might also be affected.
- Record
CVE-2007-5794- Updated
- 2026-11-02
EUVDEUVD-2007-5764 No score
Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned, but other applications might also be affected.
- Record
EUVD-2007-5764- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8frr-8v9h-5c7m No score
Race condition in nss_ldap, when used in applications that are linked against the pthread library...
Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned, but other applications might also be affected.
- Record
GHSA-8frr-8v9h-5c7m- Weakness
- CWE-362
- Updated
- 2026-11-02
OSV No score
Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned, but other applications might also be affected.
- Record
CVE-2007-5794- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-5794 No score
Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned, but other applications might also be affected.
- Record
DEBIAN-CVE-2007-5794- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libnss-ldapDebian:11 |
before 256-1 | 256-1 |
libnss-ldapDebian:4.0 |
before 251-7.5etch1, plus listed versions 251-7.5 |
251-7.5etch1 |
libnss-ldapDebian:3.1 |
before 238-1sarge1, plus listed versions 238-1 |
238-1sarge1 |
nss_ldapRed Hat:enterprise_linux:5::client |
before 0:253-12.el5 | 0:253-12.el5 |
nss_ldap-debuginfoRed Hat:enterprise_linux:5::client |
before 0:253-12.el5 | 0:253-12.el5 |
nss_ldapRed Hat:enterprise_linux:5::server |
before 0:253-12.el5 | 0:253-12.el5 |
nss_ldap-debuginfoRed Hat:enterprise_linux:5::server |
before 0:253-12.el5 | 0:253-12.el5 |
nss_ldapRed Hat:enterprise_linux:4::as |
before 0:253-5.el4 | 0:253-5.el4 |
nss_ldap-debuginfoRed Hat:enterprise_linux:4::as |
before 0:253-5.el4 | 0:253-5.el4 |
nss_ldapRed Hat:enterprise_linux:4::desktop |
before 0:253-5.el4 | 0:253-5.el4 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nss_ldap-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:253-5.el4 | 0:253-5.el4 |
nss_ldapRed Hat:enterprise_linux:4::es |
before 0:253-5.el4 | 0:253-5.el4 |
nss_ldap-debuginfoRed Hat:enterprise_linux:4::es |
before 0:253-5.el4 | 0:253-5.el4 |
nss_ldapRed Hat:enterprise_linux:4::ws |
before 0:253-5.el4 | 0:253-5.el4 |
nss_ldap-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:253-5.el4 | 0:253-5.el4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-5794 is a medium vulnerability (CVSS 4.3) in Nss Ldap Ldap, published November 13, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in libnss-ldap 256-1.
References
secunia.com/advisories/28061
bugs.debian.org/cgi-bin/bugreport.cgi?bug=453868
dovecot.org/list/dovecot/2005-March/006345.html
bugzilla.redhat.com/show_bug.cgi?id=154314
bugs.gentoo.org/show_bug.cgi?id=198390
Show 42 moreShow less
security.gentoo.org/glsa/glsa-200711-33.xml
securityfocus.com/archive/1/487985/100/0/threaded
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10625
issues.rpath.com/browse/RPL-1913
redhat.com/support/errata/RHSA-2008-0389.html
mandriva.com/security/advisories?name=MDVSA-2008:049
debian.org/security/2007/dsa-1430
support.avaya.com/elmodocs2/security/ASA-2008-332.htm
securitytracker.com/id?1020088
lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html
exchange.xforce.ibmcloud.com/vulnerabilities/38505
wiki.rpath.com/wiki/Advisories:rPSA-2007-0255
nvd.nist.gov/vuln/detail/CVE-2007-5794
github.com/advisories/GHSA-8frr-8v9h-5c7m
security-tracker.debian.org/tracker/CVE-2007-5794
access.redhat.com/errata/RHSA-2008:0389
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0389.json
cve.org/CVERecord?id=CVE-2007-5794