SA
Product
samba
On CISA KEVExploited in the wildRansomware-linked
216
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 41Medium 76Low 1
Watch
Add samba to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-5370 | 5.9 | Apr 25 | Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform… Affected: 3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.6.4; 3.6.5; +34 more |
| CVE-2016-0771 | 5.9 | Mar 13 | The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remote authenticated… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2022-1615 | 5.5 | Sep 1 | In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values Affected: 4.1.0 before 4.17.0 |
| CVE-2020-14323 | 5.5 | Oct 29 | A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1 Affected: 3.6.0 before 4.11.15; 4.12.0 before 4.12.9; 4.13.0 before 4.13.1 |
| CVE-2022-32746 | 5.4 | Aug 25 | A flaw was found in the Samba AD LDAP server Affected: 4.3.0 before 4.14.14; 4.15.0 before 4.15.9; 4.16.0 before 4.16.4 |
| CVE-2019-14902 | 5.4 | Jan 21 | There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right… Affected: 4.0.0 before 4.9.18; 4.10.0 before 4.10.12; 4.11.0 before 4.11.5 |
| CVE-2019-14870 | 5.4 | Dec 10 | All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing… Affected: 4.0.0 before 4.9.17; 4.10.0 before 4.10.11; 4.11.0 before 4.11.3 |
| CVE-2019-14833 | 5.4 | Nov 6 | A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a… Affected: 4.5.0 before 4.9.15; 4.10.0 before 4.10.10; 4.11.0 before 4.11.2 |
| CVE-2019-3880 | 5.4 | Apr 9 | A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API Affected: 3.2.0 before 4.8.11; 4.9.0 before 4.9.6; 4.10.0 before 4.10.2 |
| CVE-2015-5296 | 5.4 | Dec 29 | Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to… Affected: 3.2.0 before 4.1.22; 4.2.0 before 4.2.7; 4.3.0 before 4.3.3 |
| CVE-2023-34968 | 5.3 | Jul 20 | A path disclosure vulnerability was found in Samba Affected: before 4.16.11; 4.17.0 before 4.17.10; 4.18.0 before 4.18.5 |
| CVE-2023-34967 | 5.3 | Jul 20 | A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight Affected: before 4.16.11; 4.17.0 before 4.17.10; 4.18.0 before 4.18.5 |
| CVE-2020-10700 | 5.3 | May 4 | A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control Affected: 4.10.0 before 4.10.15; 4.11.0 before 4.11.8; 4.12.0 before 4.12.2 |
| CVE-2019-14861 | 5.3 | Dec 10 | All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative… Affected: 4.0.0 before 4.9.17; 4.10.0 before 4.10.11; 4.11.0 before 4.11.3 |
| CVE-2015-5299 | 5.3 | Dec 29 | The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not verify that… Affected: 3.0.20 before 4.1.22; 4.2.0 before 4.2.7; 4.3.0 before 4.3.3 |
| CVE-2015-3223 | 5.3 | Dec 29 | The ldb_wildcard_compare function in ldb_match.c in ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3,… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2025-0620 | 4.9 | Jun 6 | A flaw was found in Samba Affected: 4.21.0 before 4.21.6; 4.22.0 before 4.22.2 |
| CVE-2019-14847 | 4.9 | Nov 6 | A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10 Affected: 4.0.0 before 4.9.15; 4.10.0 before 4.10.10 |
| CVE-2011-3585 | 4.7 | Dec 31 | Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a SIGKILL signal… Affected: 3.6.0 |
| CVE-2018-16852 | 4.4 | Nov 28 | Samba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference Affected: 4.9.0 before 4.9.3 |
| CVE-2023-0225 | 4.3 | Apr 3 | A flaw was found in Samba Affected: 4.17.0 before 4.17.7; 4.18.0; 4.18.0; 4.18.0; 4.18.0; 4.18.0 |
| CVE-2018-14628 | 4.3 | Jan 17 | An information leak vulnerability was discovered in Samba's LDAP server Affected: 4.0.0 before 4.18.9; 4.19.0 before 4.19.3 |
| CVE-2022-32742 | 4.3 | Aug 25 | A flaw was found in Samba Affected: before 4.14.14; 4.15.0 before 4.15.9; 4.16.0 before 4.16.4 |
| CVE-2021-44141 | 4.3 | Feb 21 | All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system… Affected: before 4.15.5 |
| CVE-2020-14318 | 4.3 | Dec 3 | A flaw was found in the way samba handled file and directory permissions Affected: 3.6.0 before 4.11.15; 4.12.0 before 4.12.9; 4.13.0 before 4.13.1 |
| CVE-2018-1050 | 4.3 | Mar 13 | All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon Affected: 3.6.0 before 4.5.16; 4.6.0 before 4.6.14; 4.7.0 before 4.7.6 |