Description
OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allows remote or local attackers to execute arbitrary code when libldap reads the .ldaprc file within applications that are running with extra privileges.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | openldap2 | 2.0.23-6.3 | DSA-227 |
Advisories 1
- DSA-227 openldap2 - buffer overflows and other bugs Debian Security (DSA / DLA) · Mar 9, 2026
References
- SuSE-SA:2002:047 vendor-advisory
- MDKSA-2003:006 vendor-advisory
- DSA-227 vendor-advisory