CVE-2007-5794

nss_ldap - Race Condition in LDAP Connection Handling

Title source: llm
STIX 2.1

Description

Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned, but other applications might also be affected.

References (29)

Core 29
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28061
Issue Tracking x_refsource_confirm
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=453868
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27670
Various Sources mailing-list x_refsource_mlist
http://www.dovecot.org/list/dovecot/2005-March/006345.html
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=154314
Issue Tracking x_refsource_confirm
http://bugs.gentoo.org/show_bug.cgi?id=198390
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29083
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200711-33.xml
Various Sources mailing-list x_refsource_mlist
http://www.dovecot.org/list/dovecot/2005-April/006859.html
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/487985/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10625
Issue Tracking x_refsource_confirm
https://issues.rpath.com/browse/RPL-1913
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27768
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/26452
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=367461
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27839
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0389.html
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2008:049
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30352
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31227
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2007/dsa-1430
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31524
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1020088
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0715.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28838
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/38505
Third Party Advisory x_refsource_confirm
http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0255

Scores

EPSS 0.0116
EPSS Percentile 63.3%

Details

CWE
CWE-362
Status published
Products (1)
nss_ldap/nss_ldap
Published Nov 13, 2007
Tracked Since Feb 18, 2026