What’s Vulnerable › Vulnerabilities

CVE-2023-2953

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-05-30 · updated 2026-10-14
• Weakness: CWE-476

Description

A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.

Affected products

• Apple macOS: from 11.0 before 11.7.9; from 12.0 before 12.6.8; from 13.0 before 13.5 — fixed in 11.7.9, 12.6.8, 13.5
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• Clustered Data ONTAP: all versions
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700S Firmware: all versions
• NetApp Ontap Tools: all versions
• openldap: 2.4
• Red Hat Enterprise Linux: 8.0, 9.0

How to fix

Upgrade to a fixed version: Apple macOS 11.7.9, 12.6.8, 13.5. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2023/Jul/47
• http://seclists.org/fulldisclosure/2023/Jul/48
• http://seclists.org/fulldisclosure/2023/Jul/52
• https://access.redhat.com/security/cve/CVE-2023-2953
• https://bugs.openldap.org/show_bug.cgi?id=9904
• https://security.netapp.com/advisory/ntap-20230703-0005/
• https://support.apple.com/kb/HT213843
• https://support.apple.com/kb/HT213844
• https://support.apple.com/kb/HT213845
• http://seclists.org/fulldisclosure/2023/Jul/47
• http://seclists.org/fulldisclosure/2023/Jul/48
• http://seclists.org/fulldisclosure/2023/Jul/52

Get alerted when CVE-2023-2953 or the next vulnerability affects your stack