The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1545
Reference (s):
- APPLE:APPLE-SA-2015-04-08-2
- URL: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
- BID:72519
- URL: http://www.securityfocus.com/bid/72519
- BUGTRAQ:20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra