A heap overflow vulnerability was found in openslp, that may result in remote code execution.

Symbolic link vulnerability in the slpd script slpd.allinit for OpenSLP before 1.0.11 allows local users to overwrite arbitrary files via the route.check temporary file.

Buffer overflow in the SLPFoldWhiteSpace function in common/slpcompare.c in OpenSLP 2.0 allows remote attackers to have unspecified impact via a crafted string.

A null pointer dereference vulnerability was found in function xrealloc() in xlspxmalloc.c in OpenSLP. A remote attacker could potentially crash the server when large number of packets are sent.

Vulnerable code:

void xrealloc(const char file, int line, void ptr, sizet size) { xallocationt x;

if (!ptr) return xmalloc(file, line, size);

if (!size) { xfree(file, line, ptr); return 0; }

x = xmallocfind(ptr); if (x != 0) { void newptr = ptr; if (x->size != size) { newptr = xmalloc(file, line, size); // return 0 if failed from xmalloc memcpy(newptr, ptr, x->size); // it'll cased a null pointer reference xfree(file, line, x); } return newptr; }

if (Gxmallocfh) fprintf(Gxmallocfh, " xrealloc called on " "non-xmalloc'd memory \n");

return 0; }

Last updated 25 August 2025

Multiple buffer overflows in OpenSLP before 1.1.5 allow remote attackers to have an unknown impact via malformed SLP packets.

The extension parser in slpv2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.

openslp: SLPIntersectStringList()' Function has a DoS vulnerability

A double free flaw was found in openslp's SLPDProcessMessage() function. A crafted package could cause openslp to crash.

This flaw only affects version 1.2.1 of openslp, which is only shipped in EPEL 5. Version 2.0.0 is not affected.

OpenSLP is not actively maintained upstream so patches are not available.

Acknowledgements:

Red Hat would like to thank Qinghao Tang of QIHU 360 for reporting this issue.

A double free flaw was found in openslp's SLPDProcessMessage() function. A crafted package could cause openslp to crash.

This flaw only affects version 1.2.1 of openslp, which is only shipped in EPEL 5. Version 2.0.0 is not affected.

OpenSLP is not actively maintained upstream so patches are not available.

Acknowledgements:

Red Hat would like to thank Qinghao Tang of QIHU 360 for reporting this issue.

A heap overflow vulnerability was found in openslp, that may result in remote code execution.

OpenSLP releases have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability.

Upstream patch:

https://sourceforge.net/p/openslp/mercurial/ci/151f07745901cbdba6e00e4889561b4083250da1/

A null pointer dereference vulnerability was found in function xrealloc() in xlspxmalloc.c in OpenSLP. A remote attacker could potentially crash the server when large number of packets are sent.

Vulnerable code:

void xrealloc(const char file, int line, void ptr, sizet size) { xallocationt x;

if (!ptr) return xmalloc(file, line, size);

if (!size) { xfree(file, line, ptr); return 0; }

x = xmallocfind(ptr); if (x != 0) { void newptr = ptr; if (x->size != size) { newptr = xmalloc(file, line, size); // return 0 if failed from xmalloc memcpy(newptr, ptr, x->size); // it'll cased a null pointer reference xfree(file, line, x); } return newptr; }

if (Gxmallocfh) fprintf(Gxmallocfh, " xrealloc called on " "non-xmalloc'd memory \n");

return 0; }