debian/libnss-ldap vulnerabilities

Latest debian/libnss-ldap CVEs

Newest publication first

1. DSA-1430-1 libnss-ldap - information disclosure

   Published 2007-12-11

   Unknown

2. CVE-2007-5794 Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handl...

   Published 2007-11-13

   Medium·CVSS 4.3 EPSS 1.2%

   Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot...

3. CVE-2005-2069 pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to....

   Published 2005-06-29

   Medium·CVSS 5.0 EPSS 2.8%

   pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password.

4. CVE-2003-0734 Unknown vulnerability in the pam_filter mechanism in pam_ldap before version 162, when LDAP based authentication is being used, allows users to bypass host-based access restrictions and log onto the s...

   Published 2003-09-04

   High·CVSS 10.0 EPSS 2.3%

   Unknown vulnerability in the pam_filter mechanism in pam_ldap before version 162, when LDAP based authentication is being used, allows users to bypass host-based access restrictions and log onto the system.

5. CVE-2002-0825 Buffer overflow in the DNS SRV code for nss_ldap before nss_ldap-198 allows remote attackers to cause a denial of service and possibly execute arbitrary code.

   Published 2002-08-07

   High·CVSS 7.5 EPSS 2.5%

   Buffer overflow in the DNS SRV code for nss_ldap before nss_ldap-198 allows remote attackers to cause a denial of service and possibly execute arbitrary code.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.