CVE-2017-9287

Publication date 29 May 2017

Last updated 25 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

6.5 · Medium

Score breakdown

Description

servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged Results control with a page size of 0.

Status

Package Ubuntu Release Status
openldap 17.04 zesty
Fixed 2.4.44+dfsg-3ubuntu2.1
16.10 yakkety
Fixed 2.4.42+dfsg-2ubuntu4.1
16.04 LTS xenial
Fixed 2.4.42+dfsg-2ubuntu3.2
14.04 LTS trusty
Fixed 2.4.31-1+nmu2ubuntu8.4

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
openldap

Severity score breakdown

Parameter Value
Base score 6.5 · Medium
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

Other references