CVE-2017-2668

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119CWE-476

Affected software

No affected versions have been published.

Timeline

Published
Jun 22, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-26697.5Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the useCVE-2017-26707.5It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effecCVE-2017-26715.5The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannCVE-2017-26728.8A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log CVE-2017-26737.2An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federCVE-2017-26745.4JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sCVE-2017-26757.8Little Snitch version 3.0 through 3.7.3 suffer from a local privilege escalation vulnerability in the installer part. The vulnerability is rCVE-2017-26806.5Specially crafted PROFINET DCP broadcast packets could cause a denial of service condition of affected products on a local Ethernet segment CVE-2017-26816.5Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial of service conCVE-2017-26828.8The Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could allow a remote attacker to perform a Cross-Site RequestCVE-2017-26838.2A non-privileged user of the Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could perform a persistent Cross-SitCVE-2017-26849.0Siemens SIMATIC Logon prior to V1.5 SP3 Update 2 could allow an attacker with knowledge of a valid user name, and physical or network access
CVE-2017-2668: Medium severity, CVSS 6.5 | Vulnix