Login Request a demo
High severity · published Dec 29, 2015
CVE-2015-5330
ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles string lengths, which allows remote attackers…
7.5
CVSS
6.1%
EPSS
No
On KEV
Description
ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles string lengths, which allows remote attackers to obtain sensitive information from daemon heap memory by sending crafted packets and then reading (1) an error message or (2) a database value.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.1% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Samba · Samba
4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more · source: NVD
Affected product
SA
Samba
Samba
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5330
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5330
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00002.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00017.html
More from Samba
9.8
CVE-2017-7494
Samba Remote Code Execution Vulnerability
5.5
CVE-2020-1472
Netlogon Elevation of Privilege Vulnerability
9.8
CVE-2026-4408
Samba: remote code execution in samr
9.8
CVE-2023-3961
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory
9.8
CVE-2022-45141
Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable…