samba (SUSE:Linux Enterprise High Availability Extension 15) — known CVEs & security advisories
Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise High Availability Extension 15 package samba, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.
CVEs (28)
CVE-2021-44142 — CVSS 8.8 (high): The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and…
CVE-2020-25717 — CVSS 8.1 (high): A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible…
CVE-2018-1139 — CVSS 8.1 (high): A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly…
CVE-2020-10704 — CVSS 7.5 (high): A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active…
CVE-2018-16853 — CVSS 7.5 (high): Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the…
CVE-2020-10745 — CVSS 7.5 (high): A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. This…
CVE-2021-20254 — CVSS 6.8 (medium): A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that…
CVE-2019-14907 — CVSS 6.5 (medium): All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level =…
CVE-2018-1140 — CVSS 6.5 (medium): A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker could use this flaw…
CVE-2018-14629 — CVSS 6.5 (medium): A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead…
CVE-2018-16841 — CVSS 6.5 (medium): Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept…
CVE-2018-16851 — CVSS 6.5 (medium): Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP…
CVE-2019-10218 — CVSS 6.5 (medium): A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a…
CVE-2020-14383 — CVSS 6.5 (medium): A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also…
CVE-2016-2124 — CVSS 5.9 (medium): A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent…
CVE-2020-14323 — CVSS 5.5 (medium): A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local…
CVE-2019-14870 — CVSS 5.4 (medium): All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos…
CVE-2019-14833 — CVSS 5.4 (medium): A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user…
CVE-2019-14902 — CVSS 5.4 (medium): There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before…
CVE-2019-3880 — CVSS 5.4 (medium): A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could…
CVE-2019-14861 — CVSS 5.3 (medium): All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver…
CVE-2018-10918 — CVSS 5.2 (medium): A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker…
CVE-2019-14847 — CVSS 4.9 (medium): A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync…
CVE-2022-32742 — CVSS 4.3 (medium): A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill…
CVE-2018-10919 — CVSS 4.3 (medium): The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An…
CVE-2020-14318 — CVSS 4.3 (medium): A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to…
CVE-2018-10858 — CVSS 4.3 (medium): A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server…