A vulnerability was found in OpenLDAP during the processing of a modrdn call with a specially crafted destination rdn string.  An unauthenticated user could cause slapd to segfault or abort.

Quoting the report:

In the function modrdn.c:386:slap_modrdn2mods() a call is made to
448:*desc->ad_type->sat_equality->smr_normalize() without checking its
return value. In this case the call fails and leaves mod_tmp->sml_nvalues
uninitialized which leads to an invalid free() later in
modrdn.c:202:slap_mods_free(). The breakdown of smr_normalize() is caused
by invalid UTF-8 sequences, which are passed to the software via
hex-formatted strings. It could be possible to insert and execute malicious
code by careful manipulation of the program state prior to triggering the
vulnerability. At least with a vanilla compilation of 2.4.22 it proved
possible to freely control the invalid pointer being freed. For example,
the following kind of log message is produced:

    * ** glibc detected *** /usr/sbin/slapd: double free or corruption (out): 0x002ce400 ***

This has been reportedly tested against upstream 2.4.22 as well as 2.4.11 (Debian) and 2.4.21 (Ubuntu).

Acknowledgements:

Red Hat would like to thank CERT-FI for responsibly reporting this flaw, who
credit Ilkka Mattila and Tuomas Salomäki for the discovery of the issue.