The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user     with access to search the directory can crash slapd by issuing a search including the Paged Results     control with a page size of 0. (CVE-2017-9287)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for openldap2 fixes the following issues :

Security issues fixed :

CVE-2017-9287: A double free vulnerability in the mdb backend during search with page size 0 was fixed (bsc#1041764).

CVE-2017-17740: Fixed a denial of service (slapd crash) via a member MODDN operation that could have been triggered when both the nops module and the memberof overlay are enabled (bsc#1073313).

Non-security issues fixed: Fix a regression in handling of non-blocking connections (bsc#1031702)

Fix an uninitialised variable that causes startup failure (bsc#1037396)

Fix libldap leaks socket descriptors issue (bsc#1065083)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1852 advisory.

    - fix CVE-2017-9287 openldap: Double free vulnerability in servers/slapd/back-mdb/search.c (#1458210)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for openldap2 fixes the following issues :

  - Let OpenLDAP read system wide certificate directory by     default and avoid hiding the error if user specified CA     location cannot be read (boo#1009470).

  - Fix CVE-2017-9287: openldap2: Double free vulnerability     with patch (boo#1041764)

  - Fix an uninitialized variable that causes startup     failure (boo#1037396)

  - Fix a regression in handling of non-blocking connection     with (boo#1031702)

According to the version of the openldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A double-free flaw was found in the way OpenLDAP's     slapd server using the MDB backend handled LDAP     searches. A remote attacker with access to search the     directory could potentially use this flaw to crash     slapd by issuing a specially crafted LDAP search query.
    (CVE-2017-9287)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-1911:01 advisory.

    OpenLDAP is an open source suite of LDAP (Lightweight Directory Access     Protocol) applications and development tools. LDAP is a set of     protocols for accessing directory services (usually phone book style     information, but other information is possible) over the Internet,     similar to the way DNS (Domain Name System) information is propagated     over the Internet. The openldap package contains configuration files,     libraries, and documentation for OpenLDAP.
    CVE-2017-9287     servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to     a double free vulnerability. A user with access to search the directory     can crash slapd by issuing a search including the Paged Results control     with a page size of 0.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
221760	Linux Distros Unpatched Vulnerability : CVE-2017-9287	Nessus	Misc.	2025/3/4	2026/7/24	medium
124018	SUSE SLES12 Security Update : openldap2 (SUSE-SU-2019:0931-1)	Nessus	SuSE Local Security Checks	2019/4/12	2024/6/3	high
102282	Oracle Linux 7 : openldap (ELSA-2017-1852)	Nessus	Oracle Linux Local Security Checks	2017/8/9	2025/12/2	medium
102555	openSUSE Security Update : openldap2 (openSUSE-2017-936)	Nessus	SuSE Local Security Checks	2017/8/18	2025/11/26	medium
103059	EulerOS 2.0 SP1 : openldap (EulerOS-SA-2017-1201)	Nessus	Huawei Local Security Checks	2017/9/11	2025/11/24	medium
103060	EulerOS 2.0 SP2 : openldap (EulerOS-SA-2017-1202)	Nessus	Huawei Local Security Checks	2017/9/11	2025/11/24	medium
289219	MiracleLinux 7 : openldap-2.4.44-5.el7 (AXSA:2017-1911:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	medium

偵測

搜尋 Plugin

medium

high

medium

medium

medium

medium

medium