4.3

CVE-2013-4449: debian debian_linux Numeric Errors

CVSS: 4.3v2.0MediumModified
AliasesMGASA-2014-0062RHSA-2014:0126RHSA-2014:0206
Published 05-02-2014Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2013-4449 is a medium (CVSS 4.3) Numeric Errors vulnerability in debian debian_linux. EPSS estimates a 10.91% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities.

Overall risk
19/100
0100
Low · default modelHow is this calculated?
CVSS score
4.3/10
010
Medium · v2.0 (NVD)
EPSS score
10.91%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 1
DLA-203-1DSA-3209-1USN-2622-1

Timeline

  1. 05-02-2014
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

10.91%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 10.91% on 18-09-2026

18-09-202618-10-2026
EPSS score
10.91%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat8 products
  • compat-openldap< 0:2.3.43_2.2.29-27.el5_10
  • openldap< 0:2.4.23-34.el6_5.1 | < 0:2.3.43-27.el5_10
  • openldap-clients< 0:2.4.23-34.el6_5.1 | < 0:2.3.43-27.el5_10
  • openldap-debuginfo< 0:2.4.23-34.el6_5.1 | < 0:2.3.43-27.el5_10
  • openldap-devel< 0:2.4.23-34.el6_5.1 | < 0:2.3.43-27.el5_10
Debian2 products
Mageia2 products
  • openldap< 2.4.33-7.1.mga3
  • openldap< 2.4.38-1.1.mga4
Openldap1 product
  • openldap≤ 2.4.36 | 2.4.6 | 2.4.7 | 2.4.8 | 2.4.9 | 2.4.10 | 2.4.11 | 2.4.12 | 2.4.13 | 2.4.14 | 2.4.15 | 2.4.16 | 2.4.17 | 2.4.18 | 2.4.19 | 2.4.20 | 2.4.21 | 2.4.22 | 2.4.23 | 2.4.24 | 2.4.25 | 2.4.26 | 2.4.27 | 2.4.28 | 2.4.29 | 2.4.30 | 2.4.31 | 2.4.32 | 2.4.33 | 2.4.34 | 2.4.35
Ubuntu1 product
  • openldap< 2.4.31-1+nmu2ubuntu8.1

5 vendors · 14 products

References

30 links
Show all 30 references