Description of the patch:
This update for 389-ds fixes the following issues:
Update to version 2.2.10~git255.752643c78.
Security issues fixed:
- CVE-2026-11610: missing bounds check in
sasl_io_recv() can lead to a heap buffer overflow when processing a
specially crafted oversized LDAP UNBIND packet (bsc#1270695).
- CVE-2026-11611: Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated
client stops reading sync responses(bsc#1267975).
- CVE-2026-11774: integer overflow in
sasl_io_start_packet() can lead to heap buffer overflow when processing a
crafted SASL packet length prefix (bsc#1268298).
- CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure in
LDA responses (bsc#1268065).
- CVE-2026-11786: out-of-bounds read in the LDIF parser when processing attribute types with trailing semicolons during
database import (bsc#1268064).
- CVE-2026-11787: missing bounds check in the
ldap_utf8prev() functioncan can lead to a heap buffer overread in
string filter parsing(bsc#1268062).
- CVE-2026-11788: missing allocation check in the dereference control plugin before using a BER structure can lead to
LDAP server crash when the system is under memory pressure (bsc#1268057).
- CVE-2026-11789: integer underflow in the SMD5 password storage plugin can lead to a buffer overread when computing
salt length from a crafted password hash shorter than 16 bytes (bsc#1268058).
- CVE-2026-11790: improper bounds enforcement in the BKDF2-SHA256 password storage plugin can lead to excessive
resource consumption during authentication and cause a DoS (bsc#1268060).
- CVE-2026-11791: use-after-free in the schema reload mechanism can lead to a
ns-slapd crash when concurrent LDAP
query traffic is active (bsc#1268047).
- CVE-2026-11792: missing checks in
create_masked_entry_string can lead to a heap and log output corruption whe a
short cleartext password is...