1. Ubuntu Security Notices
  2. USN-2856-1

USN-2856-1: ldb vulnerabilities

Publication date

5 January 2016

Overview

Several security issues were fixed in ldb.

Releases

Packages

  • ldb - LDAP-like embedded database

Details

Thilo Uttendorfer discovered that the ldb incorrectly handled certain zero
values. A remote attacker could use this issue to cause applications using
ldb, such as Samba, to stop responding, resulting in a denial of service.
(CVE-2015-3223)

Douglas Bagnall discovered that ldb incorrectly handled certain string
lengths. A remote attacker could use this issue to possibly access
sensitive information from memory of applications using ldb, such as Samba.
(CVE-2015-5330)

Thilo Uttendorfer discovered that the ldb incorrectly handled certain zero
values. A remote attacker could use this issue to cause applications using
ldb, such as Samba, to stop responding, resulting in a denial of service.
(CVE-2015-3223)

Douglas Bagnall discovered that ldb incorrectly handled certain string
lengths. A remote attacker could use this issue to possibly access
sensitive information from memory of applications using ldb, such as Samba.
(CVE-2015-5330)

Update instructions

After a standard system update you need to restart applications using ldb, such as Samba, to make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
15.10 wily libldb1 –  2:1.1.20-2ubuntu0.1
15.04 vivid libldb1 –  1:1.1.18-1ubuntu0.1
14.04 trusty libldb1 –  1:1.1.16-1ubuntu0.1
12.04 precise libldb1 –  1:1.1.4-1ubuntu0.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›