Description
Double free vulnerability in the SLPDKnownDAAdd function in slpd/slpd_knownda.c in OpenSLP 1.2.1 allows remote attackers to cause a denial of service (crash) via a crafted package.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | openslp-dfsg | 1.2.1-10+deb8u1 | DSA-3353-1 |
| Debian 7 | openslp-dfsg | 1.2.1-9+deb7u1 | DSA-3353-1 |
| Debian 6.0 | openslp-dfsg | 1.2.1-7.8+deb6u1 | DLA-304-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | openslp-dfsg | 1.2.1-9ubuntu0.2 | USN-2730-1 |
Advisories 3
- USN-2730-1 openslp-dfsg vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-304-1 openslp-dfsg - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3353-1 openslp-dfsg - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://sourceforge.net/p/openslp/mercurial/ci/2bc15d0494f886d9c4fe342d23bc160605aea51d/
- DSA-3353 vendor-advisory
- 1033719 vdb-entry
- 76635 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1251064