CVE-2008-2952

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-07-01 · updated 2026-06-16
Weakness: CWE-399

Description

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.

Affected products

openldap: 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9 (+41)

References

http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00006.html
http://secunia.com/advisories/30853
http://secunia.com/advisories/30917
http://secunia.com/advisories/30996
http://secunia.com/advisories/31326
http://secunia.com/advisories/31364
http://secunia.com/advisories/31436
http://secunia.com/advisories/32254
http://secunia.com/advisories/32316
http://security.gentoo.org/glsa/glsa-200808-09.xml
http://wiki.rpath.com/Advisories:rPSA-2008-0249

Get alerted when CVE-2008-2952 or the next vulnerability affects your stack