{"id":"CVE-2015-1545","aliases":["BELL-CVE-2015-1545","DEBIAN-CVE-2015-1545","DLA-203-1","DSA-3209-1","EUVD-2015-1679","GHSA-qwqq-jvm7-rm7c","MGASA-2015-0143","SUSE-SU-2015:0887-1","SUSE-SU-2015:1077-1","UBUNTU-CVE-2015-1545","USN-2622-1","openSUSE-SU-2024:11121-1"],"status":"published","title":"The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40...","description":"The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.11091,"percentile":0.95954,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2015-02-12T00:00:00Z","modified":"2026-09-09T06:47:25Z","fixes":[{"ecosystem":"Debian:12","package":"openldap","fixed_in":["2.4.40-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openldap","fixed_in":["2.4.40-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openldap","fixed_in":["2.4.40-4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"openldap","fixed_in":["2.4.38-1.3.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"openldap","fixed_in":["2.4.31-1+nmu2ubuntu8.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.40-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.40-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.40-4"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-7.3+deb6u1"}]}],"versions":["2.4.23-7","2.4.23-7.1","2.4.23-7.2","2.4.23-7.3"],"bundled":4},{"source":"osv","ecosystem":"Debian:7","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.31-2"}]}],"versions":["2.4.31-1+nmu2"],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-1.3.mga4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.31-1+nmu2ubuntu8.1"}]}],"versions":["2.4.31-1+nmu2ubuntu3","2.4.31-1+nmu2ubuntu4","2.4.31-1+nmu2ubuntu5","2.4.31-1+nmu2ubuntu8"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.31-1+nmu2ubuntu8.1"}]}],"versions":["2.4.31-1+nmu2ubuntu3","2.4.31-1+nmu2ubuntu4","2.4.31-1+nmu2ubuntu5","2.4.31-1+nmu2ubuntu8"],"bundled":2}],"products":[{"vendor":"openldap","product":"openldap"}],"references":[{"url":"http://www.securityfocus.com/bid/72519","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.openldap.org/devel/gitweb.cgi?p=openldap.git%3Ba=commit%3Bh=c32e74763f77675b9e144126e375977ed6dc562c","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://support.apple.com/HT204659","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100937","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3209","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-07/msg00069.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1032399","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:073","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:074","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://www.openldap.org/its/?findid=8027","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","evidence"]},{"url":"http://secunia.com/advisories/62787","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/02/07/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://support.apple.com/kb/HT210788","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://seclists.org/bugtraq/2019/Dec/23","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2019/Dec/26","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1545"},{"url":"http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=c32e74763f77675b9e144126e375977ed6dc562c"},{"url":"https://github.com/advisories/GHSA-qwqq-jvm7-rm7c"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2015-1545","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1545","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0143.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15232","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2015/02/07/3","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150887-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/846389","tags":["report"]},{"url":"https://bugzilla.suse.com/905959","tags":["report"]},{"url":"https://bugzilla.suse.com/916897","tags":["report"]},{"url":"https://bugzilla.suse.com/916914","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1546","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151077-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-1545","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2622-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1545","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2012-1164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4449","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8027","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-1545","description":"The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.","status":"published","published":"2015-02-12T16:00:00Z","modified":"2024-08-06T04:47:16.804Z","updated_at":"2026-11-02T14:35:44.404481Z"}],"euvd":[{"id":"EUVD-2015-1679","description":"The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.","status":"published","published":"2015-02-12T16:00:00Z","modified":"2024-08-06T04:47:16Z","updated_at":"2026-11-03T02:22:15.089401Z"}],"ghsa":[{"id":"GHSA-qwqq-jvm7-rm7c","title":"The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40...","description":"The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.","status":"published","published":"2022-05-17T01:10:21Z","modified":"2025-04-12T12:46:22Z","updated_at":"2026-11-02T15:01:20.846668Z"}],"nvd":[{"id":"CVE-2015-1545","description":"The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.","status":"published","published":"2015-02-12T16:59:06.143Z","modified":"2026-06-17T00:22:34.9Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:01.643178Z"}],"osv":[{"id":"BELL-CVE-2015-1545","title":"CVE-2015-1545 does not affect BellSoft software","status":"withdrawn","published":"2015-02-12T16:59:00Z","modified":"2026-03-05T07:15:22.481128Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2015-1545","description":"The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.","status":"published","published":"2015-02-12T16:59:06Z","modified":"2026-04-16T06:15:35.34513557Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2015-1545","description":"The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.","status":"published","published":"2015-02-12T16:59:06.143Z","modified":"2026-09-09T06:47:25.051072066Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DLA-203-1","title":"openldap - security update","status":"published","published":"2015-04-18T00:00:00Z","modified":"2026-03-09T01:21:57.397711Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-3209-1","title":"openldap - security update","status":"published","published":"2015-03-30T00:00:00Z","modified":"2026-03-09T01:21:22.833066Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0143","title":"Updated openldap packages fix CVE-2015-1545","description":"Updated openldap packages fix security vulnerability:\n\nThe deref overlay in slapd 2.4.13 through 2.4.40 dereferences a NULL pointer\nwhen a search request includes the Deref control with an empty list of\nattributes to return (missing input validation). This allows a remote\nunauthenticated client to crash the LDAP server (CVE-2015-1545).\n","status":"published","published":"2015-04-09T22:54:46Z","modified":"2026-04-16T06:25:41.035209211Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:11121-1","title":"libldap-2_4-2-2.4.59-69.3 on GA media","description":"These are all security issues fixed in the libldap-2_4-2-2.4.59-69.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:12:22.368649Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2015:0887-1","title":"Security update for openldap2","description":"\nopenldap2 was updated to fix three security issues and one non-security \nbug.\n\nThe following vulnerabilities were fixed:\n\n    * A remote attacker could cause a denial of service (slapd crash) by\n      unbinding immediately after a search request. (bnc#846389,\n      CVE-2013-4449)\n    * A remote attacker could cause a denial of service through a NULL\n      pointer dereference and crash via an empty attribute list in a deref\n      control in a search request. (bnc#916897, CVE-2015-1545)\n    * A remote attacker could cause a denial of service (crash) via a\n      crafted search query with a matched values control. (bnc#916914,\n      CVE-2015-1546)\n\nThe following non-security bug was fixed:\n\n    * Prevent connection-0 (internal connection) from showing up in the\n      monitor back-end. (bnc#905959)\n\nSecurity Issues:\n\n    * CVE-2015-1546\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1546\u003e\n    * CVE-2015-1545\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1545\u003e\n    * CVE-2013-4449\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4449\u003e\n\n","status":"published","published":"2015-04-13T12:35:26Z","modified":"2026-02-04T02:46:02.596926Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1077-1","title":"Security update for openldap2","description":"openldap2 was updated to fix two security issues and one non-security bug.\n\nThe following vulnerabilities were fixed:\n\n* A remote attacker could cause a denial of service through a NULL pointer dereference and crash via an empty attribute list in a deref control in a search request. (bnc#916897 CVE-2015-1545)\n* A remote attacker could cause a denial of service (crash) via a crafted search query with a matched values control. (bnc#916914 CVE-2015-1546) \n\nThe following non-security issue was fixed:\n\n* Prevent connection-0 (internal connection) from showing up in the monitor backend (bnc#905959)\n","status":"published","published":"2015-05-18T08:42:31Z","modified":"2026-02-04T02:23:27.927269Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2015-1545","description":"The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.","status":"published","published":"2015-02-12T00:00:00Z","modified":"2026-04-22T09:58:35.228338Z","updated_at":"2026-11-02T15:54:09.721803Z"},{"id":"USN-2622-1","title":"openldap vulnerabilities","description":"It was discovered that OpenLDAP incorrectly handled certain search queries\nthat returned empty attributes. A remote attacker could use this issue to\ncause OpenLDAP to assert, resulting in a denial of service. This issue only\naffected Ubuntu 12.04 LTS. (CVE-2012-1164)\n\nMichael Vishchers discovered that OpenLDAP improperly counted references\nwhen the rwm overlay was used. A remote attacker could use this issue to\ncause OpenLDAP to crash, resulting in a denial of service. (CVE-2013-4449)\n\nIt was discovered that OpenLDAP incorrectly handled certain empty attribute\nlists in search requests. A remote attacker could use this issue to cause\nOpenLDAP to crash, resulting in a denial of service. (CVE-2015-1545)\n","status":"published","published":"2015-05-26T17:45:13Z","modified":"2026-04-22T09:13:10.146338Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}