openldap: CVE-2015-1545: crashes on search with deref control and empty attr list

Related Vulnerabilities: CVE-2015-1545   CVE-2015-1546   CVE-2014-9713   CVE-2013-4449   CVE-2012-1164  

Debian Bug report logs - #776988
openldap: CVE-2015-1545: crashes on search with deref control and empty attr list

version graph

Reported by: Ryan Tandy <ryan@nardis.ca>

Date: Tue, 3 Feb 2015 20:12:14 UTC

Severity: important

Tags: fixed-upstream, security, upstream

Found in versions openldap/2.4.40-3, openldap/2.4.31-1+nmu2, openldap/2.4.23-7.3

Fixed in versions openldap/2.4.40-4, openldap/2.4.31-2, openldap/2.4.23-7.3+deb6u1

Done: Ryan Tandy <ryan@nardis.ca>

Bug is archived. No further changes may be made.

Forwarded to http://www.openldap.org/its/?findid=8027

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian OpenLDAP Maintainers <pkg-openldap-devel@lists.alioth.debian.org>:
Bug#776988; Package slapd. (Tue, 03 Feb 2015 20:12:18 GMT) (full text, mbox, link).


Acknowledgement sent to Ryan Tandy <ryan@nardis.ca>:
New Bug report received and forwarded. Copy sent to Debian OpenLDAP Maintainers <pkg-openldap-devel@lists.alioth.debian.org>. (Tue, 03 Feb 2015 20:12:18 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Ryan Tandy <ryan@nardis.ca>
To: submit@bugs.debian.org
Subject: slapd: crashes on search with deref control and empty attr list
Date: Tue, 3 Feb 2015 12:11:27 -0800
Package: slapd
Version: 2.4.40-3
Severity: important
Tags: upstream fixed-upstream
Control: found -1 2.4.31-1+nmu2
Control: found -1 2.4.23-7.3
Control: forwarded -1 http://www.openldap.org/its/?findid=8027

With the deref overlay enabled, ldapsearch with '-E deref=member:' 
causes slapd to crash.

2.4 patch: http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=7a5a98577a0481d864ca7fe05b9b32274d4d1fb5



Marked as found in versions openldap/2.4.31-1+nmu2. Request was from Ryan Tandy <ryan@nardis.ca> to submit@bugs.debian.org. (Tue, 03 Feb 2015 20:12:19 GMT) (full text, mbox, link).


Marked as found in versions openldap/2.4.23-7.3. Request was from Ryan Tandy <ryan@nardis.ca> to submit@bugs.debian.org. (Tue, 03 Feb 2015 20:12:20 GMT) (full text, mbox, link).


Set Bug forwarded-to-address to 'http://www.openldap.org/its/?findid=8027'. Request was from Ryan Tandy <ryan@nardis.ca> to submit@bugs.debian.org. (Tue, 03 Feb 2015 20:12:21 GMT) (full text, mbox, link).


Added tag(s) security. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Fri, 06 Feb 2015 06:03:06 GMT) (full text, mbox, link).


Changed Bug title to 'openldap: CVE-2015-1545: crashes on search with deref control and empty attr list' from 'slapd: crashes on search with deref control and empty attr list' Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sat, 07 Feb 2015 13:09:08 GMT) (full text, mbox, link).


Added tag(s) pending. Request was from Ryan Tandy <ryan@nardis.ca> to control@bugs.debian.org. (Mon, 09 Feb 2015 02:30:05 GMT) (full text, mbox, link).


Reply sent to Ryan Tandy <ryan@nardis.ca>:
You have taken responsibility. (Mon, 09 Feb 2015 21:24:06 GMT) (full text, mbox, link).


Notification sent to Ryan Tandy <ryan@nardis.ca>:
Bug acknowledged by developer. (Mon, 09 Feb 2015 21:24:06 GMT) (full text, mbox, link).


Message #22 received at 776988-close@bugs.debian.org (full text, mbox, reply):

From: Ryan Tandy <ryan@nardis.ca>
To: 776988-close@bugs.debian.org
Subject: Bug#776988: fixed in openldap 2.4.40-4
Date: Mon, 09 Feb 2015 21:22:23 +0000
Source: openldap
Source-Version: 2.4.40-4

We believe that the bug you reported is fixed in the latest version of
openldap, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 776988@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Ryan Tandy <ryan@nardis.ca> (supplier of updated openldap package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sun, 08 Feb 2015 20:19:11 +0000
Source: openldap
Binary: slapd slapd-smbk5pwd ldap-utils libldap-2.4-2 libldap-2.4-2-dbg libldap2-dev slapd-dbg
Architecture: source amd64
Version: 2.4.40-4
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenLDAP Maintainers <pkg-openldap-devel@lists.alioth.debian.org>
Changed-By: Ryan Tandy <ryan@nardis.ca>
Description:
 ldap-utils - OpenLDAP utilities
 libldap-2.4-2 - OpenLDAP libraries
 libldap-2.4-2-dbg - Debugging information for OpenLDAP libraries
 libldap2-dev - OpenLDAP development libraries
 slapd      - OpenLDAP server (slapd)
 slapd-dbg  - Debugging information for the OpenLDAP server (slapd)
 slapd-smbk5pwd - Keeps Samba and Kerberos passwords in sync within slapd.
Closes: 776988 776991
Changes:
 openldap (2.4.40-4) unstable; urgency=medium
 .
   * debian/patches/ITS8027-deref-reject-empty-attr-list.patch: Import upstream
     patch to fix a crash when a search includes the Deref control with an
     empty attribute list. (ITS#8027) (CVE-2015-1545, Closes: #776988)
   * debian/patches/ITS8046-fix-vrFilter_free-crash.patch: Import upstream
     patch to fix a double free triggered by certain search queries using the
     Matched Values control. (ITS#8046) (CVE-2015-1546, Closes: #776991)
Checksums-Sha1:
 6916d2f8bc6887a28fecad20ab7b6c453fb26b17 2756 openldap_2.4.40-4.dsc
 da5218904f2f5e221143e42b69938c039e0d1515 177329 openldap_2.4.40-4.diff.gz
 1b43f58f2890204b23434a7ea19770ab329bf16a 1419858 slapd_2.4.40-4_amd64.deb
 d7bfa33906f1fea02e78f75e18be59603497f638 82750 slapd-smbk5pwd_2.4.40-4_amd64.deb
 c9a0f3cf0f1ff13423d87d70fa0970f9fd855cfa 187856 ldap-utils_2.4.40-4_amd64.deb
 f0636e63420ad391a0185ae1b4a53eeb45b9544a 217322 libldap-2.4-2_2.4.40-4_amd64.deb
 21915916c3c65add67ec5fdf7de7b80f290fbdda 441688 libldap-2.4-2-dbg_2.4.40-4_amd64.deb
 fad1b3b56d1671ed7c11fdc1bcf7169d53e694b2 323568 libldap2-dev_2.4.40-4_amd64.deb
 19c4d3274b94cc8387650c306ab6b9ee916c2233 4902624 slapd-dbg_2.4.40-4_amd64.deb
Checksums-Sha256:
 5dcc3b9b7703e341c8878e6dc407ac3956aa314edc8404af8efd1738236e00a5 2756 openldap_2.4.40-4.dsc
 3be4cc54cfdcdb8d17fd535bd4a374744bc84c9b4ae843521511683cc7439302 177329 openldap_2.4.40-4.diff.gz
 b66b4e92f6cdf4759330234ddb81ad67413f4b8875644682a052afc2e9415abe 1419858 slapd_2.4.40-4_amd64.deb
 389e1e6c655aba6707e37a437489784aba753240fcc8120a17c1c59a56f3dfda 82750 slapd-smbk5pwd_2.4.40-4_amd64.deb
 d3031cfb280c988f9fa75cf0bcfe66f9f7690617bf61a0f6f42238342e8a3c23 187856 ldap-utils_2.4.40-4_amd64.deb
 30cb149047edec729662178925fbf06a6eab6d534527c5ae8de4c5e6950bd304 217322 libldap-2.4-2_2.4.40-4_amd64.deb
 7713b0bfabf7c38b807055cbb1835d6c3705c9ff79be0970f0cfdf2f87b1da43 441688 libldap-2.4-2-dbg_2.4.40-4_amd64.deb
 9e26e2d23ed7794ae9d6d56dbbf35f1a8e276612f3338b312950027a7bf92198 323568 libldap2-dev_2.4.40-4_amd64.deb
 3945b83f2116d9738983adf052282ef12f2d82b42e20c66a70ec76968db09b32 4902624 slapd-dbg_2.4.40-4_amd64.deb
Files:
 e82089d8b0454af877cd977019c4e198 2756 net optional openldap_2.4.40-4.dsc
 ee2a355182429e1e1a44ed5023066bc2 177329 net optional openldap_2.4.40-4.diff.gz
 21a3dbd738dc25f79406b82f3c918d29 1419858 net optional slapd_2.4.40-4_amd64.deb
 598e3eed03cd2e3551e86c1037a28c43 82750 net extra slapd-smbk5pwd_2.4.40-4_amd64.deb
 8b1a4599560f5a70f6a5a62dd499d68b 187856 net optional ldap-utils_2.4.40-4_amd64.deb
 cf939f6113367fdae5ab9efa025e7434 217322 libs standard libldap-2.4-2_2.4.40-4_amd64.deb
 2b5c75b5bdfc14e94366315ac8b12701 441688 debug extra libldap-2.4-2-dbg_2.4.40-4_amd64.deb
 2f20eb1930bb2698e1c2106ed06f742d 323568 libdevel extra libldap2-dev_2.4.40-4_amd64.deb
 90bb744295d0b68568f3ad0ef2a565db 4902624 debug extra slapd-dbg_2.4.40-4_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJU2RC/AAoJEKmDSiJSB45OqwcQALjHqhyE+2cKByq6HEAlXjCv
ZMT4XhpChsMAKfBi81/9L/yOmFp+8GS180hJvwU5Gvx0Ip8VN4S7aW81Mui1BEGX
b4+AK5EbTLWf5nolo93o2ivXQnDDLP+kd5KJSwbgto99DuSeYxt/YBtZ9KuBqubP
qpuf+1xp7h4X+qI2mG8WfE0s/Yy9K1xPt+NwcbGVPD92Oo9JR/cAtMZqLAAlKU9j
wsXw0ozAiQY8jxMDAsanRzJpDsRA4VQ1cET2l+sTyBFWXtXqD7V1tgF2Uc0U2/zJ
8cB8kSDBJCw4+MqPzigC4q/adqR7wO7eU+qyAJBwZko2uH4VBRqkF40PzjeHdkRB
xcru++8xcFI3t+mm/Jt7EeyLJemj63XByXKMQ4dWG0ZNtfOOMqfERGtxofSF0Nug
mUs01XM/rXMvYtb0Mujh5Z5GmGZB4xW426UE7H00WKxbNRTMLy4fYbdgLbcZ9VIS
651Z/wcg53uv9nALK1mLLFznPez8Zz9pXAxstm7nwzJs0UZQqeUMOc3cXtjw+S+d
2gQxRKzwMOfaDiDtRJ+A/q54YDQ/2et8wVdcGfhzEzAroVfyv26qF64dK8Q1egKP
vMG1MXvMh0bByxuzxDLWEKM2jGjkELe/iohlNgwH0w+8PWXSdh42zxVQEeMpBOu8
n/A3TrWlaW3I54AQUlZ5
=egnU
-----END PGP SIGNATURE-----




Reply sent to Luca Bruno <lucab@debian.org>:
You have taken responsibility. (Fri, 03 Apr 2015 18:21:09 GMT) (full text, mbox, link).


Notification sent to Ryan Tandy <ryan@nardis.ca>:
Bug acknowledged by developer. (Fri, 03 Apr 2015 18:21:09 GMT) (full text, mbox, link).


Message #27 received at 776988-close@bugs.debian.org (full text, mbox, reply):

From: Luca Bruno <lucab@debian.org>
To: 776988-close@bugs.debian.org
Subject: Bug#776988: fixed in openldap 2.4.31-2
Date: Fri, 03 Apr 2015 18:17:11 +0000
Source: openldap
Source-Version: 2.4.31-2

We believe that the bug you reported is fixed in the latest version of
openldap, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 776988@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Luca Bruno <lucab@debian.org> (supplier of updated openldap package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Mon, 30 Mar 2015 10:03:58 +0200
Source: openldap
Binary: slapd slapd-smbk5pwd ldap-utils libldap-2.4-2 libldap-2.4-2-dbg libldap2-dev slapd-dbg
Architecture: source amd64
Version: 2.4.31-2
Distribution: wheezy-security
Urgency: high
Maintainer: Debian OpenLDAP Maintainers <pkg-openldap-devel@lists.alioth.debian.org>
Changed-By: Luca Bruno <lucab@debian.org>
Description: 
 ldap-utils - OpenLDAP utilities
 libldap-2.4-2 - OpenLDAP libraries
 libldap-2.4-2-dbg - Debugging information for OpenLDAP libraries
 libldap2-dev - OpenLDAP development libraries
 slapd      - OpenLDAP server (slapd)
 slapd-dbg  - Debugging information for the OpenLDAP server (slapd)
 slapd-smbk5pwd - Keeps Samba and Kerberos passwords in sync within slapd.
Closes: 729367 761406 776988
Changes: 
 openldap (2.4.31-2) wheezy-security; urgency=high
 .
   * Team upload.
 .
   [ Ryan Tandy ]
   * debian/slapd.init.ldif: Disallow modifying one's own entry by default,
     except specific attributes. (CVE-2014-9713) (Closes: #761406)
   * debian/slapd.{config,templates}: On upgrade, if an access rule begins with
     "to * by self write", show a debconf note warning that it should be
     changed.
   * debian/slapd.README.debian: Add information about how to remove "to * by
     self write" from existing ACLs.
   * debian/po/*: Add translations of debconf warning.
   * debian/patches/ITS8027-deref-reject-empty-attr-list.patch: Import upstream
     patch to fix a crash when a search includes the Deref control with an
     empty attribute list. (ITS#8027) (CVE-2015-1545) (Closes: #776988)
   * debian/patches/ITS7723-fix-reference-counting.patch: Import upstream patch
     to fix a crash in the rwm overlay when a search is immediately followed by
     an unbind. (ITS#7723) (CVE-2013-4449) (Closes: #729367)
Checksums-Sha1: 
 9902f63ca472c59f2d555e9bb0585a5ce8ee5029 2708 openldap_2.4.31-2.dsc
 864e7b6ba54cc00ef5b834fd5b5739a7900dd6e3 4720612 openldap_2.4.31.orig.tar.gz
 1ac7bc70a573680a9adfbbe01fdb5afdaf52f8fc 168099 openldap_2.4.31-2.diff.gz
 d3047baad3b8bf1f793f80e389bd8645fa772e17 1769812 slapd_2.4.31-2_amd64.deb
 f4be89ee37704de647c8e301d838ef6ac636e253 78818 slapd-smbk5pwd_2.4.31-2_amd64.deb
 d8a5fc72d98b8776cac2171b1289ebc199f37aec 340800 ldap-utils_2.4.31-2_amd64.deb
 47eb041c111803ee66f56500cb4ff1eb7b69b985 242712 libldap-2.4-2_2.4.31-2_amd64.deb
 a4eaa6e7c3ede4532a9f6b361de24cc415978af4 474562 libldap-2.4-2-dbg_2.4.31-2_amd64.deb
 e57cc5d19ff9ee73f439af6598575737a5e8f65f 563556 libldap2-dev_2.4.31-2_amd64.deb
 522d7d30d522090d2eedbfc45a975c8dd30fba0d 5522190 slapd-dbg_2.4.31-2_amd64.deb
Checksums-Sha256: 
 0690c59995d8dc3c105ce4baa7f57e0140a86f5fab899c1b7c0b8d934d4a8c85 2708 openldap_2.4.31-2.dsc
 dff60c1044021217ab97a7bdda5a7016015f042db0fbfd566d52abb266d19239 4720612 openldap_2.4.31.orig.tar.gz
 8c373d066e8eedd2190b0cca883b29e27883a41b2d9da9cdde1970a53b283a5e 168099 openldap_2.4.31-2.diff.gz
 c3d1b5f737e92e8189176a93234a5f54c3e2b3726a91c2abfeaa6e2d5f5a9627 1769812 slapd_2.4.31-2_amd64.deb
 e24189be83741f7c4f00ac1e1580cbc40754df6e0ff9f12b4bbe4f1e54f13a3a 78818 slapd-smbk5pwd_2.4.31-2_amd64.deb
 93fe6de7a0e584d46f02c61e544a70d4b41c2e2845d89ef523e16468779854c8 340800 ldap-utils_2.4.31-2_amd64.deb
 2371d5f91defe83589f018d58b251785598f55eb9ca7049ffcd49b16a3425b73 242712 libldap-2.4-2_2.4.31-2_amd64.deb
 6685d3339470379904402f61c2a8af06b776809dc51e5cb952857d38c175aa70 474562 libldap-2.4-2-dbg_2.4.31-2_amd64.deb
 8763c1c86b9cd0599581970d7b38e0a49262c7063392da30c02827aec27bd7fe 563556 libldap2-dev_2.4.31-2_amd64.deb
 0be8e27341d8453580203a2d4a5553a9972c68bbcf9baf86bbde88e7307dc67d 5522190 slapd-dbg_2.4.31-2_amd64.deb
Files: 
 feb6c408246cb66012d98560b9f751ad 2708 net optional openldap_2.4.31-2.dsc
 a8631b2202d8099143edb57e36b33dea 4720612 net optional openldap_2.4.31.orig.tar.gz
 e53283709fbf76177e1e8d8f615a0edc 168099 net optional openldap_2.4.31-2.diff.gz
 b800ab265241a8f6994a8422cf4b665a 1769812 net optional slapd_2.4.31-2_amd64.deb
 3df4d86033eb493ee7d1625f294e202d 78818 net extra slapd-smbk5pwd_2.4.31-2_amd64.deb
 8a1304eabd47b629cbc7aa5ffec68654 340800 net optional ldap-utils_2.4.31-2_amd64.deb
 f0b95baa0dce9563c39271714430faaf 242712 libs standard libldap-2.4-2_2.4.31-2_amd64.deb
 bb91c1a098c1d11bc09ac5a2cb87ff61 474562 debug extra libldap-2.4-2-dbg_2.4.31-2_amd64.deb
 76738a9b54f5e4451909af772b7e3420 563556 libdevel extra libldap2-dev_2.4.31-2_amd64.deb
 ce404a2da186b4ba83897e00ef3bc513 5522190 debug extra slapd-dbg_2.4.31-2_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIbBAEBAgAGBQJVGSZtAAoJEKmDSiJSB45OsdMP+MqgPcwt/jYbnVMlRt7GKMbY
DZs6f5KT3H9ELeW7G070EJfD5wy4RdL4erzZYwqSVJiNpA/qxTPM27f2NiIcSxtn
pTpk68Jr/1mUdSoDwYAzGHZ4XmYr+k5Bux17adBH3EAhhja9Rjh4MJyv4+2aZl4G
1YpsVBsSdpb2TkirNHx7DnqhbAOqrVQD1tXU907RnMpLgU2w/QWETL9+ciatuPJr
TwZq3qUi3fdu/98/0fE11udB5hUcXZYBK/yeiCFVzvaecuLp5sUFn3cSjlYPtug9
7c3tmwyiQa5bHkaGtlQdQ9aFN3y1eBG31I/EstC78Ebe+8xA2/mb03jNxeoqtDOb
WFE+4UZLafC6Aa9epqRdp6SiVrK7FXszvAKm9TlfjDlaqRgIh4CNt6RVpxxMIzLg
AKbmAYQ3r/g0xzbKz3nymA+Z6/Yw0nbK72/4EUQ+YQRQmxh4HujSrH8o0JovvBrq
6xRFI/Hc5xehtdHK8T+0zIvEa02OrS64W3sqS0Y4LqNEkVJTBr5AD9iCjMoadOdB
yJd8940rQuW9OorWO6X4DEPzbNyoCPUmOJTE5sKa53bxhw33sRGTcWcMnk9T1EHx
sY2+ZVpbiwhZJdJeTz7hRd8qcmuGs2jV7iajbKOf1HkVfp/8v/j7vcyApHKAwC1x
m38iSTevtGc0ijpBmag=
=TkVF
-----END PGP SIGNATURE-----




Reply sent to Ryan Tandy <ryan@nardis.ca>:
You have taken responsibility. (Sat, 18 Apr 2015 15:21:10 GMT) (full text, mbox, link).


Notification sent to Ryan Tandy <ryan@nardis.ca>:
Bug acknowledged by developer. (Sat, 18 Apr 2015 15:21:10 GMT) (full text, mbox, link).


Message #32 received at 776988-close@bugs.debian.org (full text, mbox, reply):

From: Ryan Tandy <ryan@nardis.ca>
To: 776988-close@bugs.debian.org
Subject: Bug#776988: fixed in openldap 2.4.23-7.3+deb6u1
Date: Sat, 18 Apr 2015 15:19:15 +0000
Source: openldap
Source-Version: 2.4.23-7.3+deb6u1

We believe that the bug you reported is fixed in the latest version of
openldap, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 776988@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Ryan Tandy <ryan@nardis.ca> (supplier of updated openldap package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 17 Apr 2015 18:39:40 -0700
Source: openldap
Binary: slapd slapd-smbk5pwd ldap-utils libldap-2.4-2 libldap-2.4-2-dbg libldap2-dev slapd-dbg
Architecture: source
Version: 2.4.23-7.3+deb6u1
Distribution: squeeze-lts
Urgency: high
Maintainer: Debian OpenLDAP Maintainers <pkg-openldap-devel@lists.alioth.debian.org>
Changed-By: Ryan Tandy <ryan@nardis.ca>
Description:
 ldap-utils - OpenLDAP utilities
 libldap-2.4-2 - OpenLDAP libraries
 libldap-2.4-2-dbg - Debugging information for OpenLDAP libraries
 libldap2-dev - OpenLDAP development libraries
 slapd      - OpenLDAP server (slapd)
 slapd-dbg  - Debugging information for the OpenLDAP server (slapd)
 slapd-smbk5pwd - Keeps Samba and Kerberos passwords in sync within slapd.
Closes: 663644 729367 761406 776988
Changes:
 openldap (2.4.23-7.3+deb6u1) squeeze-lts; urgency=high
 .
   * debian/slapd.init.ldif: Disallow modifying one's own entry by default,
     except specific attributes. (CVE-2014-9713) (Closes: #761406)
   * debian/slapd.{config,templates}: On upgrade, if an access rule begins with
     "to * by self write", show a debconf note warning that it should be
     changed.
   * debian/slapd.README.debian: Add information about how to remove "to * by
     self write" from existing ACLs.
   * debian/po/*: Add translations of debconf warning.
   * debian/patches/ITS7723-fix-reference-counting.patch: Import upstream patch
     to fix a crash in the rwm overlay when a search is immediately followed by
     an unbind. (ITS#7723) (CVE-2013-4449) (Closes: #729367)
   * debian/patches/ITS8027-deref-reject-empty-attr-list.patch: Import upstream
     patch to fix a crash when a search includes the Deref control with an
     empty attribute list. (ITS#8027) (CVE-2015-1545) (Closes: #776988)
   * debian/patches/ITS7143-fix-attr_dup2-when-attrsOnly.patch: Import upstream
     patch to fix a crash when doing an attrsOnly search of a database
     configured with both the rwm and translucent overlays. (ITS#7143)
     (CVE-2012-1164) (Closes: #663644)
Checksums-Sha1:
 1c6613375b3790e37e03e45ebf31e4bc7264366e 2815 openldap_2.4.23-7.3+deb6u1.dsc
 bfc98011bbd0c141a57475e3834c38bc4f93cffe 158490 openldap_2.4.23-7.3+deb6u1.diff.gz
Checksums-Sha256:
 33675c439af8d610864a245cb5f1e64503d31702db306c711fd5da99e0151739 2815 openldap_2.4.23-7.3+deb6u1.dsc
 bb22b677fea356751bf0db75facd99e27ee33fd365b81694a333d2bfceba2ee2 158490 openldap_2.4.23-7.3+deb6u1.diff.gz
Files:
 162d12730ed2e79a03ad36ba527dfce5 2815 net optional openldap_2.4.23-7.3+deb6u1.dsc
 dd93ab71922f8b61ebf20088cf9b8147 158490 net optional openldap_2.4.23-7.3+deb6u1.diff.gz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIVAwUBVTJiLwkauFYGmqocAQrn6w/9HD9K0wcQmVR2F1o2bSfhHtmwexVczipm
WjswT0jPdAxLiZ/QZNJNbqun8Bh6EaHYDJ+6Gs/+Pusok1Ci/pCaFrAHeQq10F7G
8ty1GltHkcz381HcVE9E47hjFvJtGxvDoFcRqOLOgYfFoO2oRsM0x707KKiEljDr
lIhq6YYdwxnYuh5Rl7j45s4HSA0mDMfOBT9u0APozHsYugxJr8P8BCe5B5/CBj8/
l4HKxYPuKHW0AFT8g6eIXttlg6Ar/XztQ+XEsRS8meh5Qses4baokHZlXMvGIBwM
EX3sad5d8gZPPn/YQ5P8qUXJkowujrPVWdKNiEk1DaMlMt3uw+gYz8z/VnRGMaw6
BdZoTgTRjE/FfFC8HLJudCC/700rWMUmDIxozF4ySaK33Ocnws1Q0CeVhhEK2SbH
QvuMjQLkPldaT5wMr0S7UlyE48Jm3RlofFD+SL91HxcCR/3xoj4/ughnREaioHe1
66dhHR99saDEmaGnEs5MUVgM+/achHAZNyiShKOVU7Mcfp5N5PS9EPATwFvLlQTl
uijmtRKO2GoF6+5kCi9PMeVjkQcSx8ZuDZRahx/z/2O5m44i/ay6KHSeJB61iyFw
nVjtGCpHZZq25nj/gzDRjQRtFCm3tH8NyuUMYEC+OpD0RBKbC7xGzOL0pOxvqbQx
VmwZzpVJPuo=
=cvbE
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Thu, 21 May 2015 07:28:49 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 14:27:47 2019; Machine Name: beach

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.