REDHAT-BUG-1251064: Double Free
First published: Thu Aug 06 2015(Updated: )
A double free flaw was found in openslp's SLPDProcessMessage() function. A crafted package could cause openslp to crash. This flaw only affects version 1.2.1 of openslp, which is only shipped in EPEL 5. Version 2.0.0 is not affected. OpenSLP is not actively maintained upstream so patches are not available. Acknowledgements: Red Hat would like to thank Qinghao Tang of QIHU 360 for reporting this issue.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CentOS OpenSLP Server |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-1251064?
The severity of REDHAT-BUG-1251064 is significant due to the potential for crashes caused by the double free flaw.
How do I fix REDHAT-BUG-1251064?
To fix REDHAT-BUG-1251064, upgrade to OpenSLP version 2.0.0 or later, as version 1.2.1 is affected and lacks upstream patches.
Which versions are affected by REDHAT-BUG-1251064?
REDHAT-BUG-1251064 affects only version 1.2.1 of OpenSLP, which is included in EPEL 5.
Is OpenSLP still actively maintained for REDHAT-BUG-1251064?
OpenSLP is not actively maintained upstream, meaning there are no new patches or updates available for REDHAT-BUG-1251064.
What is a double free flaw in the context of REDHAT-BUG-1251064?
A double free flaw occurs when memory that has already been freed is attempted to be freed again, potentially leading to application crashes or vulnerabilities.
- agent/type
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-5177
- agent/severity
- agent/weakness
- agent/event
- agent/description
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/openslp
- canonical/centos openslp server