CVE-2015-2704

realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf...

5.0 MediumFix available

realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.

Exploit likelihood

2.54%Up 1.3 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.

Record: CVE-2015-2704
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-74
Updated: 2026-11-02

CVE List No score

realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.

Record: CVE-2015-2704
Updated: 2026-11-02

EUVDEUVD-2015-2794 No score

realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.

Record: EUVD-2015-2794
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5vx5-x2xx-23pj No score

realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf...

realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.

Record: GHSA-5vx5-x2xx-23pj
Weakness: CWE-74
Updated: 2026-11-02

OSVAZL-36985 No score

CVE-2015-2704 affecting package realmd 0.17.1-1

realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.

Record: AZL-36985
Updated: 2026-11-05

OSVAZL-7338 No score

CVE-2015-2704 affecting package realmd 0.16.3-25

realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.

Record: AZL-7338
Updated: 2026-11-02

OSV No score

realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.

Record: CVE-2015-2704
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-2704 No score

realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.

Record: DEBIAN-CVE-2015-2704
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-2704 No score

realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.

Record: UBUNTU-CVE-2015-2704
Updated: 2026-11-02

Affected products

realmd project realmd

Affected packages

Affected packages
Package	Affected	Fixed
`realmd` Azure Linux:3	through 0.17.1-1	None known
`realmd` Azure Linux:2	through 0.16.3-25	None known
`realmd` Debian:12	before 0.16.0-1	0.16.0-1
`realmd` Debian:13	before 0.16.0-1	0.16.0-1
`realmd` Debian:14	before 0.16.0-1	0.16.0-1
`realmd-debuginfo` Red Hat:enterprise_linux:7::client	before 0:0.16.1-5.el7	0:0.16.1-5.el7
`realmd-devel-docs` Red Hat:enterprise_linux:7::client	before 0:0.16.1-5.el7	0:0.16.1-5.el7
`realmd` Red Hat:enterprise_linux:7::client	before 0:0.16.1-5.el7	0:0.16.1-5.el7
`realmd-debuginfo` Red Hat:enterprise_linux:7::computenode	before 0:0.16.1-5.el7	0:0.16.1-5.el7
`realmd-devel-docs` Red Hat:enterprise_linux:7::computenode	before 0:0.16.1-5.el7	0:0.16.1-5.el7

Show 8 moreShow less

Affected packages
Package	Affected	Fixed
`realmd` Red Hat:enterprise_linux:7::computenode	before 0:0.16.1-5.el7	0:0.16.1-5.el7
`realmd-debuginfo` Red Hat:enterprise_linux:7::server	before 0:0.16.1-5.el7	0:0.16.1-5.el7
`realmd-devel-docs` Red Hat:enterprise_linux:7::server	before 0:0.16.1-5.el7	0:0.16.1-5.el7
`realmd` Red Hat:enterprise_linux:7::server	before 0:0.16.1-5.el7	0:0.16.1-5.el7
`realmd-debuginfo` Red Hat:enterprise_linux:7::workstation	before 0:0.16.1-5.el7	0:0.16.1-5.el7
`realmd-devel-docs` Red Hat:enterprise_linux:7::workstation	before 0:0.16.1-5.el7	0:0.16.1-5.el7
`realmd` Red Hat:enterprise_linux:7::workstation	before 0:0.16.1-5.el7	0:0.16.1-5.el7
`realmd` Ubuntu:Pro:14.04:LTS	before 0.15.0-1ubuntu0.1+esm1, plus listed versions 0.14.6-10.14.6-20.15.0-10.15.0-1ubuntu0.1	0.15.0-1ubuntu0.1+esm1

History

History
Recorded	Changed	Sources
Nov 5, 2026	facts	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-2704 is a medium vulnerability (CVSS 5.0) in Realmd Project Realmd, published May 18, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.54%, the 85th percentile. Fixed in realmd 0.16.0-1.

References

Show 15 moreShow less