{"id":"CVE-2017-17740","aliases":["ALPINE-CVE-2017-17740","BELL-CVE-2017-17740","DEBIAN-CVE-2017-17740","EUVD-2017-8892","GHSA-h7vm-9jwq-6c9r","MGASA-2020-0200","ROOT-OS-DEBIAN-12-CVE-2017-17740","SUSE-SU-2018:4150-1","SUSE-SU-2019:0931-1","SUSE-SU-2019:2395-1","openSUSE-SU-2019:2157-1","openSUSE-SU-2019:2176-1","openSUSE-SU-2024:11121-1"],"status":"published","title":"contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the...","description":"contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.07022,"percentile":0.94221,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2017-12-18T06:00:00Z","modified":"2026-11-02T02:45:55Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"openldap","fixed_in":["2.4.46-r0"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"openldap","fixed_in":["2.5.13+dfsg-5.root.io.5","2.5.13+dfsg-5.root.io.4","2.5.13+dfsg-5.root.io.2","2.5.13+dfsg-5.root.io.3","2.5.13+dfsg-5.root.io.6","2.5.13+dfsg-5.aikido.7"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-openldap","fixed_in":["2.5.13+dfsg-5.root.io.5","2.5.13+dfsg-5.root.io.4","2.5.13+dfsg-5.root.io.2","2.5.13+dfsg-5.root.io.3","2.5.13+dfsg-5.root.io.6","2.5.13+dfsg-5.aikido.7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openldap2","fixed_in":["2.4.41-18.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openldap2","fixed_in":["2.4.41-18.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"openldap2","fixed_in":["2.4.41-18.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"openldap2","fixed_in":["2.4.41-18.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openldap2","fixed_in":["2.4.41-18.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openldap2","fixed_in":["2.4.41-18.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openldap2","fixed_in":["2.4.41-18.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openldap2","fixed_in":["2.4.41-18.43.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.2.12-1","2.5.13+dfsg-5","2.5.13+dfsg-5+loong64","2.5.16+dfsg-1","2.5.16+dfsg-2","2.5.17+dfsg-1","2.5.18+dfsg-1","2.5.18+dfsg-2","2.5.18+dfsg-3","2.5.19+dfsg-1","2.6.10+dfsg-1","2.6.13+dfsg-1","2.6.14+dfsg-1","2.6.14+dfsg-2","2.6.2+dfsg-1~exp1","2.6.2+dfsg-1~exp2","2.6.3+dfsg-1~exp1","2.6.4+dfsg-1~exp1","2.6.5+dfsg-1~exp1","2.6.6+dfsg-1~exp1","2.6.6+dfsg-1~exp2","2.6.7+dfsg-1~exp1","2.6.8+dfsg-1~exp1","2.6.8+dfsg-1~exp2","2.6.8+dfsg-1~exp3","2.6.8+dfsg-1~exp4","2.6.9+dfsg-1","2.6.9+dfsg-1~exp1","2.6.9+dfsg-1~exp2","2.6.9+dfsg-2","2:1.2.12.1-1","2:1.2.12.1-1.0.1"]},{"source":"osv","ecosystem":"Debian:13","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.2.12-1","2.6.10+dfsg-1","2.6.13+dfsg-1","2.6.14+dfsg-1","2.6.14+dfsg-2","2:1.2.12.1-1","2:1.2.12.1-1.0.1"]},{"source":"osv","ecosystem":"Debian:14","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.2.12-1","2.6.10+dfsg-1","2.6.13+dfsg-1","2.6.14+dfsg-1","2.6.14+dfsg-2","2:1.2.12.1-1","2:1.2.12.1-1.0.1"]},{"source":"osv","ecosystem":"Mageia:7","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-1.1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:12","package":"openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.13+dfsg-5.root.io.5"},{"fixed":"2.5.13+dfsg-5.root.io.4"},{"fixed":"2.5.13+dfsg-5.root.io.2"},{"fixed":"2.5.13+dfsg-5.root.io.3"},{"fixed":"2.5.13+dfsg-5.root.io.6"},{"fixed":"2.5.13+dfsg-5.aikido.7"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-openldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.13+dfsg-5.root.io.5"},{"fixed":"2.5.13+dfsg-5.root.io.4"},{"fixed":"2.5.13+dfsg-5.root.io.2"},{"fixed":"2.5.13+dfsg-5.root.io.3"},{"fixed":"2.5.13+dfsg-5.root.io.6"},{"fixed":"2.5.13+dfsg-5.aikido.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.9.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.9.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.9.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.9.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.9.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.9.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.9.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.9.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openldap2-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-18.24.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP1","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP1","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-9.19.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-lp151.10.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"openldap2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.46-lp150.13.1"}]}],"bundled":3}],"products":[{"vendor":"mcafee","product":"policy_auditor"},{"vendor":"openldap","product":"openldap"},{"vendor":"opensuse","product":"leap"},{"vendor":"oracle","product":"blockchain_platform"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.openldap.org/its/index.cgi/Incoming?id=8759","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-17740"},{"url":"https://github.com/advisories/GHSA-h7vm-9jwq-6c9r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-17740","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-17740","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-17740","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0200.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26569","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24076","tags":["report"]},{"url":"https://lists.openldap.org/hyperkitty/list/openldap-announce@openldap.org/thread/NQ6OHLWNVRKIJU3HI5YGGAZL54H2RB73/","tags":["web"]},{"url":"https://lists.openldap.org/hyperkitty/list/openldap-announce@openldap.org/thread/VMMBUCQHEDF6QA4CDOONP2CDQEOR5YQA/","tags":["web"]},{"url":"https://lists.openldap.org/hyperkitty/list/openldap-announce@openldap.org/thread/FUOYA6YCHBXMLANBJMSO22JD2NB22WGC/","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-09/msg00113.html","tags":["web"]},{"url":"https://www.debian.org/security/2020/dsa-4666","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20184150-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1073313","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17740","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190931-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1031702","tags":["report"]},{"url":"https://bugzilla.suse.com/1037396","tags":["report"]},{"url":"https://bugzilla.suse.com/1041764","tags":["report"]},{"url":"https://bugzilla.suse.com/1065083","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9287","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192395-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1111388","tags":["report"]},{"url":"https://bugzilla.suse.com/1114845","tags":["report"]},{"url":"https://bugzilla.suse.com/1143194","tags":["report"]},{"url":"https://bugzilla.suse.com/1143273","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13565","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/46KFS6OC36UWKEJS7D2YUROL2323KWEB/#46KFS6OC36UWKEJS7D2YUROL2323KWEB","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TQYMYQN54XQCPQJJZEIGGCBW3W7U53IW/#TQYMYQN54XQCPQJJZEIGGCBW3W7U53IW","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8027","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-17740","description":"contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.","status":"published","published":"2017-12-18T06:00:00Z","modified":"2024-08-05T20:59:17.662Z","updated_at":"2026-11-02T14:33:18.248329Z"}],"euvd":[{"id":"EUVD-2017-8892","description":"contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.","status":"published","published":"2017-12-18T06:00:00Z","modified":"2024-08-05T20:59:17Z","updated_at":"2026-11-03T02:23:08.959608Z"}],"ghsa":[{"id":"GHSA-h7vm-9jwq-6c9r","title":"contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the...","description":"contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.","status":"published","published":"2022-05-13T01:01:03Z","modified":"2023-01-27T05:02:15Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:42:02.011098Z"}],"nvd":[{"id":"CVE-2017-17740","description":"contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.","status":"published","published":"2017-12-18T06:29:00.397Z","modified":"2026-06-17T01:11:34.287Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:04:11.215487Z"}],"osv":[{"id":"ALPINE-CVE-2017-17740","description":"contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.","status":"published","published":"2017-12-18T06:29:00.397Z","modified":"2026-06-15T18:18:06.786642078Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2017-17740","title":"CVE-2017-17740 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:37.264008Z","modified":"2026-03-05T07:15:14.001651Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-17740","description":"contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.","status":"published","published":"2017-12-18T06:29:00.397Z","modified":"2026-11-02T02:45:55.224347826Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-17740","description":"contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.","status":"published","published":"2017-12-18T06:29:00.397Z","modified":"2026-09-01T20:03:45.829819042Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"MGASA-2020-0200","title":"Updated openldap packages fix security vulnerabilities","description":"Updated openldap packages fix security vulnerabilities:\n\nWhen both the nops module and the member of overlay are enabled, attempts to\nfree a buffer that was allocated on the stack, which allows remote attackers to\ncause a denial of service (slapd crash) via a member MODDN operation\n(CVE-2017-17740).\n\nIn filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested\nboolean expressions can result in denial of service (daemon crash)\n(CVE-2020-12243).\n\nThe nops overlay has been dropped from the package, fixing CVE-2017-17740.\n\nThe openldap package has been updated to version 2.4.50, fixing CVE-2020-12243\nand several other bugs.\n","status":"published","published":"2020-05-05T12:20:37Z","modified":"2026-04-16T04:42:55.246045153Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:2157-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption (bsc#1143194).\n- CVE-2019-13057: Fixed an issue with delegated database admin privileges (bsc#1143273).\n- CVE-2017-17740: When both the nops module and the member of overlay\n  are enabled, attempts to free a buffer that was allocated on the stack,\n  which allows remote attackers to cause a denial of service (slapd crash)\n  via a member MODDN operation. (bsc#1073313)\n\nNon-security issues fixed:\n\n- Fixed broken shebang line in openldap_update_modules_path.sh (bsc#1114845).\n- Create files in /var/lib/ldap/ during initial start to allow for transactional updates (bsc#1111388)\n- Fixed incorrect post script call causing tmpfiles creation not to be run (bsc#1111388).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-09-23T18:19:38Z","modified":"2026-02-04T03:01:08.357746Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2176-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption (bsc#1143194).\n- CVE-2019-13057: Fixed an issue with delegated database admin privileges (bsc#1143273).\n- CVE-2017-17740: When both the nops module and the member of overlay\n  are enabled, attempts to free a buffer that was allocated on the stack,\n  which allows remote attackers to cause a denial of service (slapd crash)\n  via a member MODDN operation. (bsc#1073313)\n\nNon-security issues fixed:\n\n- Fixed broken shebang line in openldap_update_modules_path.sh (bsc#1114845).\n- Create files in /var/lib/ldap/ during initial start to allow for transactional updates (bsc#1111388)\n- Fixed incorrect post script call causing tmpfiles creation not to be run (bsc#1111388).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-09-24T08:20:38Z","modified":"2026-02-04T02:59:45.283421Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11121-1","title":"libldap-2_4-2-2.4.59-69.3 on GA media","description":"These are all security issues fixed in the libldap-2_4-2-2.4.59-69.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:12:22.368649Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2017-17740","title":"CVE-2017-17740 in openldap - Patched by Root","description":"Root has patched CVE-2017-17740 in the openldap package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T12:17:55Z","modified":"2026-08-26T01:12:54.793188206Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"SUSE-SU-2018:4150-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-17740: When both the nops module and the memberof overlay\n  are enabled, attempts to free a buffer that was allocated on the stack,\n  which allows remote attackers to cause a denial of service (slapd crash)\n  via a member MODDN operation.  (bsc#1073313)\n","status":"published","published":"2018-12-17T07:51:44Z","modified":"2026-02-04T02:39:40.647914Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0931-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-9287: A double free vulnerability in the mdb backend during search with page size 0 was fixed (bsc#1041764).\n- CVE-2017-17740: Fixed a denial of service (slapd crash) via a member MODDN operation that could have been triggered when both the nops module and the memberof overlay are enabled (bsc#1073313).\n\nNon-security issues fixed:\n\n- Fix a regression in handling of non-blocking connections (bsc#1031702)\n- Fix an uninitialised variable that causes startup failure (bsc#1037396)\n- Fix libldap leaks socket descriptors issue (bsc#1065083)\n","status":"published","published":"2019-04-11T09:11:33Z","modified":"2026-02-04T02:59:09.574729Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:2395-1","title":"Security update for openldap2","description":"This update for openldap2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption (bsc#1143194).\n- CVE-2019-13057: Fixed an issue with delegated database admin privileges (bsc#1143273).\n- CVE-2017-17740: When both the nops module and the member of overlay\n  are enabled, attempts to free a buffer that was allocated on the stack,\n  which allows remote attackers to cause a denial of service (slapd crash)\n  via a member MODDN operation. (bsc#1073313)\n\nNon-security issues fixed:\n\n- Fixed broken shebang line in openldap_update_modules_path.sh (bsc#1114845).\n- Create files in /var/lib/ldap/ during initial start to allow for transactional updates (bsc#1111388)\n- Fixed incorrect post script call causing tmpfiles creation not to be run (bsc#1111388).\n","status":"published","published":"2019-09-18T06:31:55Z","modified":"2026-02-04T04:21:30.820036Z","updated_at":"2026-11-02T15:53:46.44301Z"}]}}