UpHeron
All vulnerabilities

Servers and applications

CVE-2010-0211

The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences, which triggers a free of an invalid, uninitialized pointer in the…

Severity
Critical 9.8
Published
28 Jul 2010
Last changed
16 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
28% in the next 30 daysHigher than 98% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
CWE-252
Attack
Over the network · No login needed · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Sources
NVD

Description

The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences, which triggers a free of an invalid, uninitialized pointer in the slap_mods_free function, as demonstrated using the Codenomicon LDAPv3 test suite.

From NVD.

Affected software

SoftwareAffected versions
VMware ESXiServers and applications · cpe:o:vmware:esxi
  • Version 4.0
  • Version 4.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2010-0211
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2010-0211