Unrated severityNVD Advisory· Published Feb 5, 2014· Updated Apr 29, 2026
CVE-2013-4449
CVE-2013-4449
Description
The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.
Affected products
33cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*+ 30 more
- cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*range: <=2.4.36
- cpe:2.3:a:openldap:openldap:2.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.13:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.14:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.15:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.16:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.17:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.18:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.19:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.20:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.21:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.22:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.23:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.24:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.25:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.26:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.27:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.28:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.29:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.30:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.31:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.32:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.33:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.34:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.35:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:openldap:openldap:2.4.9:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
16- kb.juniper.net/InfoCenter/indexnvd
- kb.juniper.net/InfoCenter/indexnvd
- rhn.redhat.com/errata/RHSA-2014-0126.htmlnvd
- rhn.redhat.com/errata/RHSA-2014-0206.htmlnvd
- seclists.org/fulldisclosure/2019/Dec/26nvd
- tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-4449nvd
- www.debian.org/security/2015/dsa-3209nvd
- www.mandriva.com/security/advisoriesnvd
- www.openldap.org/its/index.cgi/Incomingnvd
- www.openwall.com/lists/oss-security/2013/10/19/3nvd
- www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlnvd
- www.securityfocus.com/bid/63190nvd
- www.securitytracker.com/id/1029711nvd
- bugzilla.redhat.com/show_bug.cginvd
- seclists.org/bugtraq/2019/Dec/23nvd
- support.apple.com/kb/HT210788nvd
News mentions
0No linked articles in our index yet.