CVE-2008-2952

Publication date 1 July 2008

Last updated 24 July 2024

Ubuntu priority

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openldap	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	7.04 feisty	Not in release
	6.06 LTS dapper	Not in release
openldap2.2	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	7.04 feisty	Not in release
	6.06 LTS dapper	Fixed 2.2.26-5ubuntu2.8
openldap2.3	8.04 LTS hardy	Fixed 2.4.9-0ubuntu0.8.04.1
	7.10 gutsy	Fixed 2.3.35-1ubuntu0.3
	7.04 feisty	Fixed 2.3.30-2ubuntu0.3
	6.06 LTS dapper	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
openldap	Upstream: http://www.openldap.org/devel/cvsweb.cgi/libraries/liblber/io.c.diff?r1=1.111.2.7&r2=1.111.2.8&hideattic=1&sortbydate=0
openldap2.3	Upstream: http://www.openldap.org/devel/cvsweb.cgi/libraries/liblber/io.c.diff?r1=1.107.2.7&r2=1.107.2.8&hideattic=1&sortbydate=0

CVE-2008-2952

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references