Search for packages
| purl | pkg:deb/debian/389-ds-base@1.4.4.11-2?distro=trixie |
| Next non-vulnerable version | 1.4.4.11-2+deb11u1 |
| Latest non-vulnerable version | 3.1.2+vendor1-2 |
| Risk | 3.4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-63rm-mq1r-5fbz
Aliases: CVE-2022-1949 |
389-ds-base: access control bypass by query (filter in LDAP terms) optimiser |
Affected by 0 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-6f2q-qatg-kucr
Aliases: CVE-2024-6237 |
389-ds-base: unauthenticated user can trigger a DoS by sending a specific extended search request |
Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-bpw5-xeju-93f3
Aliases: CVE-2023-1055 |
RHDS: LDAP browser tries to decode userPassword instead of userCertificate attribute |
Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-kbvd-dfmn-buat
Aliases: CVE-2024-1062 |
389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr) |
Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-pqe1-ewjj-uqbn
Aliases: CVE-2025-14905 |
389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow |
Affected by 0 other vulnerabilities. |
|
VCID-xs3r-chc9-27dr
Aliases: CVE-2025-2487 |
389-ds-base: null pointer dereference leads to denial of service |
Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-1cnv-xra9-d7fw | 389-ds-base: Remote DoS via search filters in slapi_filter_sprintf in slapd/util.c |
CVE-2017-15134
|
| VCID-1emx-jre5-v7dm | 389-ds-base: ns-slapd crash via large filter value in ldapsearch |
CVE-2018-1089
|
| VCID-34te-4xhe-17h2 | 389-ds-base: worker threads do not detect abnormally closed connections causing DoS |
CVE-2016-0741
|
| VCID-3paj-fqdp-yyg3 | 389-ds-base: using dscreate in verbose mode results in information disclosure |
CVE-2019-10224
|
| VCID-3x4e-w658-z7as | 389-ds: flaw in parsing authzid can lead to privilege escalation |
CVE-2014-0132
|
| VCID-4tdy-umt6-4ubr | 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c |
CVE-2024-2199
|
| VCID-4tn2-her5-6fe1 | 389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() |
CVE-2021-3514
|
| VCID-676b-82um-duhh | rhds/389: plaintext password disclosure flaw |
CVE-2012-2678
|
| VCID-6cvm-779c-dkgk | 389-ds-base: Insufficient fix for CVE-2018-14648 denial of service in RHEL-7.5 |
CVE-2019-10171
|
| VCID-77rw-db6h-hya9 | 389-ds-base: sending crafted message could result in DoS |
CVE-2022-0918
|
| VCID-7teh-3vk4-a7du | 389-ds-base: Server crash through modify command with large DN |
CVE-2018-14624
|
| VCID-c27j-6m3j-mqer | rhds/389: plaintext password disclosure in audit log |
CVE-2012-2746
|
| VCID-dyu2-n7b9-tfam | 389-ds: unauthenticated denial of service vulnerability in handling of LDAPv3 control data |
CVE-2013-0312
|
| VCID-ewv4-4dk9-8bew | 389-ds-base: Password verification vulnerable to timing attack |
CVE-2016-5405
|
| VCID-f3t3-vxrz-8uew | 389-ds-base: Crash in delete_passwdPolicy when persistent search connections are terminated unexpectedly |
CVE-2018-14638
|
| VCID-f5kv-utgm-1ueu | 389-ds-base: password hashing bypassed when "nsslapd-unhashed-pw-switch" is set to off |
CVE-2014-8112
|
| VCID-f83m-2rhu-r3fs | Server: ACLs inoperative in some search scenarios |
CVE-2013-2219
|
| VCID-gmg8-mepq-87ez | 389-ds-base: Mishandled search requests in servers/slapd/search.c:do_search() allows for denial of service |
CVE-2018-14648
|
| VCID-gmpt-rg5q-n3dk | 389-ds-base: nsSSL3Ciphers preference not enforced server side (regression) |
CVE-2015-3230
|
| VCID-hjvf-3mm8-xfhq | 389-ds-base: double free of the virtual attribute context in persistent search |
CVE-2021-4091
|
| VCID-hvag-zpvk-vqbw | 389-ds-base: ldapsearch with server side sort allows users to cause a crash |
CVE-2018-10935
|
| VCID-jge6-uqra-yba1 | 389-ds-base: Password brute-force possible for locked account due to different return codes |
CVE-2017-7551
|
| VCID-kkeh-mm7b-quc4 | 389-ds-base: remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 in collate.c |
CVE-2018-1054
|
| VCID-knxk-357y-efhh | 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed |
CVE-2021-3652
|
| VCID-n9jd-zew1-77d7 | 389-ds-base: Heap buffer overflow in uiduniq.c |
CVE-2017-2591
|
| VCID-pexr-smr8-gbhh | 389-ds-base: information disclosure during the binding of a DN |
CVE-2020-35518
|
| VCID-ppep-3m4d-93dv | 389-ds-base: information disclosure through 'cn=changelog' subtree |
CVE-2014-8105
|
| VCID-qkca-awn5-hfas | 389-ds-base: server crash while modifying `userPassword` using malformed input (Incomplete fix for CVE-2024-2199) |
CVE-2024-8445
|
| VCID-qp2a-6fbp-gqf4 | 389-ds: unauthenticated information disclosure |
CVE-2014-3562
|
| VCID-qv4g-5kzs-9kfa | 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request |
CVE-2024-3657
|
| VCID-rffx-mwhe-tqe5 | 389-ds-base: Malformed userPassword hash may cause Denial of Service |
CVE-2024-5953
|
| VCID-run7-4j26-ubam | 389-ds-base: Change on SLAPI_MODRDN_NEWSUPERIOR is not evaluated in ACL (ACL rules bypass possible) |
CVE-2012-4450
|
| VCID-s6gq-duxz-huaf | 389: denial of service when using certificate groups |
CVE-2012-0833
|
| VCID-s9es-be9s-t3h3 | 389-ds-base: race condition on reference counter leads to DoS using persistent search |
CVE-2018-10850
|
| VCID-svsr-ktp8-n7a5 | 389-ds-base: DoS when connecting with a missing username/dn |
CVE-2013-0336
|
| VCID-vu7g-kqpe-83hq | 389-ds-base: Authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c |
CVE-2017-15135
|
| VCID-vx15-pahy-ufbn | 389-ds-base: SIGSEGV in sync_repl |
CVE-2022-2850
|
| VCID-w63d-ccdm-dyce | 389-ds: unintended information exposure when rootdse is enabled |
CVE-2013-1897
|
| VCID-wcyy-45hw-2fc6 | 389-ds-base: DoS via hanging secured connections |
CVE-2019-3883
|
| VCID-wk61-n55m-j3fg | 389-ds-base: Remote crash via crafted LDAP messages |
CVE-2017-2668
|
| VCID-wqg4-uer5-u3fd | 389-ds-base: Information disclosure via repeated use of LDAP ADD operation |
CVE-2016-4992
|
| VCID-x8k9-na1n-8fgj | 389-ds-base: expired password was still allowed to access the database |
CVE-2022-0996
|
| VCID-x99c-7876-rfas | 389-ds-base: DoS due to improper handling of ger attr searches |
CVE-2013-4485
|
| VCID-xq1g-upbu-x7dp | 389-ds-base: access control bypass with modrdn |
CVE-2015-1854
|
| VCID-yaw8-dzr7-hyha | 389-ds-base: replication and the Retro Changelog plugin store plaintext password by default |
CVE-2018-10871
|
| VCID-z2f6-17wx-w7e5 | 389-ds-base: ns-slapd crash due to bogus DN |
CVE-2013-4283
|
| VCID-z7kp-3dwk-wkgr | 389-ds-base: Read permission check bypass via the deref plugin |
CVE-2019-14824
|