23 Feb
2015
23 Feb
'15
4:36 p.m.
Clément OUDOT wrote:
Hi,
I saw today two CVE on OpenLDAP:
- http://vigilance.fr/vulnerability/OpenLDAP-NULL-pointer-dereference-via-dere...
- http://vigilance.fr/vulnerability/OpenLDAP-use-after-free-via-Matched-Values...
Don't know if they are reported in some ITS.
That's because you're reading 2nd or 3rd-hand reports. Read the actual CVEs and you'll see that relevant ITSs already linked.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1545 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1546
Given that the deref overlay isn't even documented and is probably used by only a handful of OpenLDAP developers I don't believe it even merited a CVE record.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/