{"id":"CVE-2015-1546","aliases":["BELL-CVE-2015-1546","DEBIAN-CVE-2015-1546","EUVD-2015-1680","GHSA-cmjm-2wxx-774f","SUSE-SU-2015:0887-1","SUSE-SU-2015:1077-1","openSUSE-SU-2024:11121-1"],"status":"published","title":"Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4...","description":"Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03413,"percentile":0.88969,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2015-02-12T16:00:00Z","modified":"2026-09-09T06:47:20Z","fixes":[{"ecosystem":"Debian:12","package":"openldap","fixed_in":["2.4.40-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openldap","fixed_in":["2.4.40-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openldap","fixed_in":["2.4.40-4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.40-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.40-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.40-4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-16.1"}]}],"bundled":2}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"openldap","product":"openldap"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://support.apple.com/HT204659","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100938","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-07/msg00069.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:073","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://www.openldap.org/its/?findid=8046","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openldap.org/devel/gitweb.cgi?p=openldap.git%3Ba=commit%3Bh=2f1a2dd329b91afe561cd06b872d09630d4edb6a","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/62787","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/02/07/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1546"},{"url":"http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=2f1a2dd329b91afe561cd06b872d09630d4edb6a"},{"url":"https://github.com/advisories/GHSA-cmjm-2wxx-774f"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2015-1546","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1546","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150887-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/846389","tags":["report"]},{"url":"https://bugzilla.suse.com/905959","tags":["report"]},{"url":"https://bugzilla.suse.com/916897","tags":["report"]},{"url":"https://bugzilla.suse.com/916914","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1546","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151077-1/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8027","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-1546","description":"Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control.","status":"published","published":"2015-02-12T16:00:00Z","modified":"2024-08-06T04:47:16.836Z","updated_at":"2026-11-02T14:35:44.404481Z"}],"euvd":[{"id":"EUVD-2015-1680","description":"Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control.","status":"published","published":"2015-02-12T16:00:00Z","modified":"2024-08-06T04:47:16Z","updated_at":"2026-11-03T02:22:15.089401Z"}],"ghsa":[{"id":"GHSA-cmjm-2wxx-774f","title":"Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4...","description":"Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control.","status":"published","published":"2022-05-14T02:06:48Z","modified":"2025-04-12T12:46:22Z","updated_at":"2026-11-02T15:01:20.846668Z"}],"nvd":[{"id":"CVE-2015-1546","description":"Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control.","status":"published","published":"2015-02-12T16:59:07.097Z","modified":"2026-06-17T00:22:35.077Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:01.643178Z"}],"osv":[{"id":"BELL-CVE-2015-1546","title":"CVE-2015-1546 does not affect BellSoft software","status":"withdrawn","published":"2015-02-12T16:59:00Z","modified":"2026-03-05T07:15:22.745149Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2015-1546","description":"Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control.","status":"published","published":"2015-02-12T16:59:07Z","modified":"2026-04-10T03:45:07.558065Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2015-1546","description":"Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control.","status":"published","published":"2015-02-12T16:59:07.097Z","modified":"2026-09-09T06:47:20.13107655Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"openSUSE-SU-2024:11121-1","title":"libldap-2_4-2-2.4.59-69.3 on GA media","description":"These are all security issues fixed in the libldap-2_4-2-2.4.59-69.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:12:22.368649Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2015:0887-1","title":"Security update for openldap2","description":"\nopenldap2 was updated to fix three security issues and one non-security \nbug.\n\nThe following vulnerabilities were fixed:\n\n    * A remote attacker could cause a denial of service (slapd crash) by\n      unbinding immediately after a search request. (bnc#846389,\n      CVE-2013-4449)\n    * A remote attacker could cause a denial of service through a NULL\n      pointer dereference and crash via an empty attribute list in a deref\n      control in a search request. (bnc#916897, CVE-2015-1545)\n    * A remote attacker could cause a denial of service (crash) via a\n      crafted search query with a matched values control. (bnc#916914,\n      CVE-2015-1546)\n\nThe following non-security bug was fixed:\n\n    * Prevent connection-0 (internal connection) from showing up in the\n      monitor back-end. (bnc#905959)\n\nSecurity Issues:\n\n    * CVE-2015-1546\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1546\u003e\n    * CVE-2015-1545\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1545\u003e\n    * CVE-2013-4449\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4449\u003e\n\n","status":"published","published":"2015-04-13T12:35:26Z","modified":"2026-02-04T02:46:02.596926Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1077-1","title":"Security update for openldap2","description":"openldap2 was updated to fix two security issues and one non-security bug.\n\nThe following vulnerabilities were fixed:\n\n* A remote attacker could cause a denial of service through a NULL pointer dereference and crash via an empty attribute list in a deref control in a search request. (bnc#916897 CVE-2015-1545)\n* A remote attacker could cause a denial of service (crash) via a crafted search query with a matched values control. (bnc#916914 CVE-2015-1546) \n\nThe following non-security issue was fixed:\n\n* Prevent connection-0 (internal connection) from showing up in the monitor backend (bnc#905959)\n","status":"published","published":"2015-05-18T08:42:31Z","modified":"2026-02-04T02:23:27.927269Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}