The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Debian_linux | Debian | 7.0 (including) | 7.0 (including) |
| Debian_linux | Debian | 8.0 (including) | 8.0 (including) |
| Red Hat Enterprise Linux 5 | RedHat | openldap-0:2.3.43-27.el5_10 | * |
| Red Hat Enterprise Linux 6 | RedHat | openldap-0:2.4.23-34.el6_5.1 | * |
| Openldap | Ubuntu | devel | * |
| Openldap | Ubuntu | lucid | * |
| Openldap | Ubuntu | precise | * |
| Openldap | Ubuntu | quantal | * |
| Openldap | Ubuntu | raring | * |
| Openldap | Ubuntu | saucy | * |
| Openldap | Ubuntu | trusty | * |
| Openldap | Ubuntu | upstream | * |
| Openldap | Ubuntu | utopic | * |
| Openldap | Ubuntu | vivid | * |
| Openldap | Ubuntu | vivid/stable-phone-overlay | * |
| Openldap | Ubuntu | vivid/ubuntu-core | * |