{"id":"CVE-2013-4449","aliases":["DEBIAN-CVE-2013-4449","DLA-203-1","DSA-3209-1","EUVD-2013-4320","GHSA-rmpx-9wfm-j7j4","MGASA-2014-0062","RHSA-2014:0126","RHSA-2014:0206","SUSE-SU-2015:0887-1","UBUNTU-CVE-2013-4449","USN-2622-1"],"status":"published","title":"The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which...","description":"The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.10913,"percentile":0.95907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-189"],"published":"2014-02-05T00:00:00Z","modified":"2026-09-01T20:03:18Z","fixes":[{"ecosystem":"Debian:12","package":"openldap","fixed_in":["2.4.39-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openldap","fixed_in":["2.4.39-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openldap","fixed_in":["2.4.39-1.1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"openldap","fixed_in":["2.4.33-7.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"openldap","fixed_in":["2.4.38-1.1.mga4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openldap","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openldap-clients","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openldap-debuginfo","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openldap-devel","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openldap-servers","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openldap-servers-sql","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openldap","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openldap-clients","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openldap-debuginfo","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openldap-devel","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openldap-servers","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openldap-servers-sql","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openldap","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openldap-clients","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openldap-debuginfo","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openldap-devel","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openldap-servers","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openldap-servers-sql","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openldap","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openldap-clients","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openldap-debuginfo","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openldap-devel","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openldap-servers","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openldap-servers-sql","fixed_in":["0:2.4.23-34.el6_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"compat-openldap","fixed_in":["0:2.3.43_2.2.29-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"openldap","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"openldap-clients","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"openldap-debuginfo","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"openldap","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"openldap-debuginfo","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"openldap-devel","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"openldap-servers","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"openldap-servers-overlays","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"openldap-servers-sql","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"compat-openldap","fixed_in":["0:2.3.43_2.2.29-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"openldap","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"openldap-clients","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"openldap-debuginfo","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"openldap-devel","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"openldap-servers","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"openldap-servers-overlays","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"openldap-servers-sql","fixed_in":["0:2.3.43-27.el5_10"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"openldap","fixed_in":["2.4.31-1+nmu2ubuntu8.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-1.1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-7.3+deb6u1"}]}],"versions":["2.4.23-7","2.4.23-7.1","2.4.23-7.2","2.4.23-7.3"],"bundled":4},{"source":"osv","ecosystem":"Debian:7","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.31-2"}]}],"versions":["2.4.31-1+nmu2"],"bundled":3},{"source":"osv","ecosystem":"Mageia:3","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.33-7.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-1.1.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openldap-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openldap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openldap-servers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openldap-servers-sql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openldap-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openldap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openldap-servers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openldap-servers-sql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openldap-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openldap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openldap-servers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openldap-servers-sql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openldap-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openldap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openldap-servers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openldap-servers-sql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-34.el6_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"compat-openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43_2.2.29-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"openldap-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"openldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"openldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"openldap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"openldap-servers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"openldap-servers-overlays","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"openldap-servers-sql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"compat-openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43_2.2.29-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"openldap-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"openldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"openldap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"openldap-servers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"openldap-servers-overlays","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"openldap-servers-sql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.43-27.el5_10"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.31-1+nmu2ubuntu8.1"}]}],"versions":["2.4.31-1+nmu2ubuntu3","2.4.31-1+nmu2ubuntu4","2.4.31-1+nmu2ubuntu5","2.4.31-1+nmu2ubuntu8"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.31-1+nmu2ubuntu8.1"}]}],"versions":["2.4.31-1+nmu2ubuntu3","2.4.31-1+nmu2ubuntu4","2.4.31-1+nmu2ubuntu5","2.4.31-1+nmu2ubuntu8"],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"openldap","product":"openldap"}],"references":[{"url":"http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openldap.org/its/index.cgi/Incoming?id=7723","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:026","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1019490","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://www.debian.org/security/2015/dsa-3209","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0126.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/10/19/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0206.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/63190","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10705","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1029711","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-4449","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","web"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10735","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://support.apple.com/kb/HT210788","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://seclists.org/bugtraq/2019/Dec/23","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2019/Dec/26","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4449","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rmpx-9wfm-j7j4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4449","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0062.html","tags":["advisory"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-0126.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12586","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0126","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0126.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4449","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4449","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0206","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0206.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150887-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/846389","tags":["report"]},{"url":"https://bugzilla.suse.com/905959","tags":["report"]},{"url":"https://bugzilla.suse.com/916897","tags":["report"]},{"url":"https://bugzilla.suse.com/916914","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1546","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2013-4449","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2622-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2012-1164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1545","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-4449","description":"The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.","status":"published","published":"2014-02-05T18:00:00Z","modified":"2024-08-06T16:45:14.585Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2013-4320","description":"The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.","status":"published","published":"2014-02-05T18:00:00Z","modified":"2024-08-06T16:45:14Z","updated_at":"2026-11-03T01:56:31.667445Z"}],"ghsa":[{"id":"GHSA-rmpx-9wfm-j7j4","title":"The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which...","description":"The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.","status":"published","published":"2022-05-17T03:23:24Z","modified":"2023-01-27T05:08:06Z","updated_at":"2026-11-02T14:43:15.040364Z"}],"nvd":[{"id":"CVE-2013-4449","description":"The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.","status":"published","published":"2014-02-05T18:55:06.317Z","modified":"2026-06-16T23:57:14.89Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"CVE-2013-4449","description":"The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.","status":"published","published":"2014-02-05T18:55:06Z","modified":"2026-04-16T06:17:27.030399645Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4449","description":"The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.","status":"published","published":"2014-02-05T18:55:06.317Z","modified":"2026-09-01T20:03:18.275531716Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DLA-203-1","title":"openldap - security update","status":"published","published":"2015-04-18T00:00:00Z","modified":"2026-03-09T01:21:57.397711Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-3209-1","title":"openldap - security update","status":"published","published":"2015-03-30T00:00:00Z","modified":"2026-03-09T01:21:22.833066Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0062","title":"Updated openldap packages fix security vulnerability","description":"A denial of service flaw was found in the way the OpenLDAP server daemon\n(slapd) performed reference counting when using the rwm (rewrite/remap)\noverlay. A remote attacker able to query the OpenLDAP server could use this\nflaw to crash the server by immediately unbinding from the server after\nsending a search request (CVE-2013-4449).\n","status":"published","published":"2014-02-12T17:20:43Z","modified":"2026-04-16T06:24:35.28215458Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"RHSA-2014:0126","title":"Red Hat Security Advisory: openldap security and bug fix update","status":"published","published":"2024-09-15T21:19:43Z","modified":"2026-06-26T10:23:17Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2014:0206","title":"Red Hat Security Advisory: openldap security update","status":"published","published":"2024-09-15T21:19:49Z","modified":"2026-06-26T12:21:46.12329123Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"SUSE-SU-2015:0887-1","title":"Security update for openldap2","description":"\nopenldap2 was updated to fix three security issues and one non-security \nbug.\n\nThe following vulnerabilities were fixed:\n\n    * A remote attacker could cause a denial of service (slapd crash) by\n      unbinding immediately after a search request. (bnc#846389,\n      CVE-2013-4449)\n    * A remote attacker could cause a denial of service through a NULL\n      pointer dereference and crash via an empty attribute list in a deref\n      control in a search request. (bnc#916897, CVE-2015-1545)\n    * A remote attacker could cause a denial of service (crash) via a\n      crafted search query with a matched values control. (bnc#916914,\n      CVE-2015-1546)\n\nThe following non-security bug was fixed:\n\n    * Prevent connection-0 (internal connection) from showing up in the\n      monitor back-end. (bnc#905959)\n\nSecurity Issues:\n\n    * CVE-2015-1546\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1546\u003e\n    * CVE-2015-1545\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1545\u003e\n    * CVE-2013-4449\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4449\u003e\n\n","status":"published","published":"2015-04-13T12:35:26Z","modified":"2026-02-04T02:46:02.596926Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2013-4449","description":"The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.","status":"published","published":"2014-02-05T00:00:00Z","modified":"2026-04-22T09:24:25.737323Z","updated_at":"2026-11-02T15:54:07.421078Z"},{"id":"USN-2622-1","title":"openldap vulnerabilities","description":"It was discovered that OpenLDAP incorrectly handled certain search queries\nthat returned empty attributes. A remote attacker could use this issue to\ncause OpenLDAP to assert, resulting in a denial of service. This issue only\naffected Ubuntu 12.04 LTS. (CVE-2012-1164)\n\nMichael Vishchers discovered that OpenLDAP improperly counted references\nwhen the rwm overlay was used. A remote attacker could use this issue to\ncause OpenLDAP to crash, resulting in a denial of service. (CVE-2013-4449)\n\nIt was discovered that OpenLDAP incorrectly handled certain empty attribute\nlists in search requests. A remote attacker could use this issue to cause\nOpenLDAP to crash, resulting in a denial of service. (CVE-2015-1545)\n","status":"published","published":"2015-05-26T17:45:13Z","modified":"2026-04-22T09:13:10.146338Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}