{"id":"CVE-2018-10919","aliases":["ALPINE-CVE-2018-10919","DEBIAN-CVE-2018-10919","DLA-1539-1","DSA-4271-1","EUVD-2018-2973","GHSA-2h4c-mfg2-2f7f","MGASA-2018-0424","SUSE-SU-2018:2318-1","SUSE-SU-2018:3161-1","UBUNTU-CVE-2018-10919","USN-3738-1","openSUSE-SU-2024:11365-1"],"status":"published","title":"The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because...","description":"The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.","severity":{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.02167,"percentile":0.82377,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-203"],"published":"2018-08-14T00:00:00Z","modified":"2026-10-24T10:30:58Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"samba","fixed_in":["4.5.16-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"samba","fixed_in":["4.6.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"samba","fixed_in":["4.7.6-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"samba","fixed_in":["4.8.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"samba","fixed_in":["2:4.8.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"samba","fixed_in":["2:4.8.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"samba","fixed_in":["2:4.8.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"samba","fixed_in":["4.6.16+git.124.aee309c5c18-3.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP3","package":"samba","fixed_in":["4.6.16+git.124.aee309c5c18-3.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"samba","fixed_in":["4.6.16+git.124.aee309c5c18-3.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"samba","fixed_in":["4.6.16+git.124.aee309c5c18-3.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"samba","fixed_in":["4.6.16+git.124.aee309c5c18-3.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 5","package":"samba","fixed_in":["4.6.16+git.124.aee309c5c18-3.32.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"samba","fixed_in":["2:4.3.11+dfsg-0ubuntu0.14.04.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"samba","fixed_in":["2:4.3.11+dfsg-0ubuntu0.16.04.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"samba","fixed_in":["2:4.7.6+dfsg~ubuntu-0ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.16-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.6.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.7.6-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.8.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.8.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.8.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.14+dfsg-0+deb8u10"}]}],"versions":["2:4.1.17+dfsg-2","2:4.1.17+dfsg-2+deb8u1","2:4.1.17+dfsg-2+deb8u2","2:4.1.17+dfsg-3","2:4.1.17+dfsg-4","2:4.1.17+dfsg-5","2:4.1.20+dfsg-1","2:4.1.21+dfsg-1","2:4.1.21+dfsg-2","2:4.1.22+dfsg-1","2:4.2.1+dfsg-1","2:4.2.10+dfsg-0+deb8u1","2:4.2.10+dfsg-0+deb8u2","2:4.2.10+dfsg-0+deb8u3","2:4.2.14+dfsg-0+deb8u1","2:4.2.14+dfsg-0+deb8u2","2:4.2.14+dfsg-0+deb8u3","2:4.2.14+dfsg-0+deb8u4","2:4.2.14+dfsg-0+deb8u5","2:4.2.14+dfsg-0+deb8u6","2:4.2.14+dfsg-0+deb8u7","2:4.2.14+dfsg-0+deb8u8","2:4.2.14+dfsg-0+deb8u9"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.5.12+dfsg-2+deb9u3"}]}],"versions":["2:4.5.12+dfsg-1","2:4.5.12+dfsg-2","2:4.5.12+dfsg-2+deb9u1","2:4.5.12+dfsg-2+deb9u2","2:4.5.8+dfsg-2","2:4.5.8+dfsg-2+deb9u1","2:4.5.8+dfsg-2+deb9u2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.16-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.8+git.86.94b6d10f7dd-4.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.8+git.86.94b6d10f7dd-4.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.16+git.124.aee309c5c18-3.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.16+git.124.aee309c5c18-3.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.16+git.124.aee309c5c18-3.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.16+git.124.aee309c5c18-3.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.16+git.124.aee309c5c18-3.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.16+git.124.aee309c5c18-3.32.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.14.04.16"}]}],"versions":["2:3.6.18-1ubuntu3","2:4.0.10+dfsg-4ubuntu2","2:4.0.13+dfsg-1ubuntu1","2:4.1.3+dfsg-2ubuntu2","2:4.1.3+dfsg-2ubuntu3","2:4.1.3+dfsg-2ubuntu4","2:4.1.3+dfsg-2ubuntu5","2:4.1.6+dfsg-1ubuntu1","2:4.1.6+dfsg-1ubuntu2","2:4.1.6+dfsg-1ubuntu2.14.04.1","2:4.1.6+dfsg-1ubuntu2.14.04.2","2:4.1.6+dfsg-1ubuntu2.14.04.3","2:4.1.6+dfsg-1ubuntu2.14.04.4","2:4.1.6+dfsg-1ubuntu2.14.04.5","2:4.1.6+dfsg-1ubuntu2.14.04.7","2:4.1.6+dfsg-1ubuntu2.14.04.8","2:4.1.6+dfsg-1ubuntu2.14.04.9","2:4.1.6+dfsg-1ubuntu2.14.04.11","2:4.1.6+dfsg-1ubuntu2.14.04.12","2:4.1.6+dfsg-1ubuntu2.14.04.13","2:4.3.8+dfsg-0ubuntu0.14.04.2","2:4.3.9+dfsg-0ubuntu0.14.04.1","2:4.3.9+dfsg-0ubuntu0.14.04.3","2:4.3.11+dfsg-0ubuntu0.14.04.1","2:4.3.11+dfsg-0ubuntu0.14.04.2","2:4.3.11+dfsg-0ubuntu0.14.04.3","2:4.3.11+dfsg-0ubuntu0.14.04.4","2:4.3.11+dfsg-0ubuntu0.14.04.6","2:4.3.11+dfsg-0ubuntu0.14.04.7","2:4.3.11+dfsg-0ubuntu0.14.04.8","2:4.3.11+dfsg-0ubuntu0.14.04.9","2:4.3.11+dfsg-0ubuntu0.14.04.10","2:4.3.11+dfsg-0ubuntu0.14.04.11","2:4.3.11+dfsg-0ubuntu0.14.04.12","2:4.3.11+dfsg-0ubuntu0.14.04.13","2:4.3.11+dfsg-0ubuntu0.14.04.14"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.15"}]}],"versions":["2:4.1.17+dfsg-4ubuntu2","2:4.1.20+dfsg-1ubuntu1","2:4.1.20+dfsg-1ubuntu2","2:4.1.20+dfsg-1ubuntu3","2:4.1.20+dfsg-1ubuntu5","2:4.3.3+dfsg-1ubuntu1","2:4.3.3+dfsg-1ubuntu2","2:4.3.3+dfsg-1ubuntu3","2:4.3.6+dfsg-1ubuntu1","2:4.3.8+dfsg-0ubuntu1","2:4.3.9+dfsg-0ubuntu0.16.04.1","2:4.3.9+dfsg-0ubuntu0.16.04.2","2:4.3.9+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.1","2:4.3.11+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.5","2:4.3.11+dfsg-0ubuntu0.16.04.6","2:4.3.11+dfsg-0ubuntu0.16.04.7","2:4.3.11+dfsg-0ubuntu0.16.04.8","2:4.3.11+dfsg-0ubuntu0.16.04.9","2:4.3.11+dfsg-0ubuntu0.16.04.10","2:4.3.11+dfsg-0ubuntu0.16.04.11","2:4.3.11+dfsg-0ubuntu0.16.04.12","2:4.3.11+dfsg-0ubuntu0.16.04.13"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.7.6+dfsg~ubuntu-0ubuntu2.2"}]}],"versions":["2:4.6.7+dfsg-1ubuntu3","2:4.7.1+dfsg-1ubuntu1","2:4.7.3+dfsg-1ubuntu1","2:4.7.4+dfsg-1ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.14.04.16"}]}],"versions":["2:3.6.18-1ubuntu3","2:4.0.10+dfsg-4ubuntu2","2:4.0.13+dfsg-1ubuntu1","2:4.1.3+dfsg-2ubuntu2","2:4.1.3+dfsg-2ubuntu3","2:4.1.3+dfsg-2ubuntu4","2:4.1.3+dfsg-2ubuntu5","2:4.1.6+dfsg-1ubuntu1","2:4.1.6+dfsg-1ubuntu2","2:4.1.6+dfsg-1ubuntu2.14.04.1","2:4.1.6+dfsg-1ubuntu2.14.04.2","2:4.1.6+dfsg-1ubuntu2.14.04.3","2:4.1.6+dfsg-1ubuntu2.14.04.4","2:4.1.6+dfsg-1ubuntu2.14.04.5","2:4.1.6+dfsg-1ubuntu2.14.04.7","2:4.1.6+dfsg-1ubuntu2.14.04.8","2:4.1.6+dfsg-1ubuntu2.14.04.9","2:4.1.6+dfsg-1ubuntu2.14.04.11","2:4.1.6+dfsg-1ubuntu2.14.04.12","2:4.1.6+dfsg-1ubuntu2.14.04.13","2:4.3.8+dfsg-0ubuntu0.14.04.2","2:4.3.9+dfsg-0ubuntu0.14.04.1","2:4.3.9+dfsg-0ubuntu0.14.04.3","2:4.3.11+dfsg-0ubuntu0.14.04.1","2:4.3.11+dfsg-0ubuntu0.14.04.2","2:4.3.11+dfsg-0ubuntu0.14.04.3","2:4.3.11+dfsg-0ubuntu0.14.04.4","2:4.3.11+dfsg-0ubuntu0.14.04.6","2:4.3.11+dfsg-0ubuntu0.14.04.7","2:4.3.11+dfsg-0ubuntu0.14.04.8","2:4.3.11+dfsg-0ubuntu0.14.04.9","2:4.3.11+dfsg-0ubuntu0.14.04.10","2:4.3.11+dfsg-0ubuntu0.14.04.11","2:4.3.11+dfsg-0ubuntu0.14.04.12","2:4.3.11+dfsg-0ubuntu0.14.04.13","2:4.3.11+dfsg-0ubuntu0.14.04.14"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.15"}]}],"versions":["2:4.1.17+dfsg-4ubuntu2","2:4.1.20+dfsg-1ubuntu1","2:4.1.20+dfsg-1ubuntu2","2:4.1.20+dfsg-1ubuntu3","2:4.1.20+dfsg-1ubuntu5","2:4.3.3+dfsg-1ubuntu1","2:4.3.3+dfsg-1ubuntu2","2:4.3.3+dfsg-1ubuntu3","2:4.3.6+dfsg-1ubuntu1","2:4.3.8+dfsg-0ubuntu1","2:4.3.9+dfsg-0ubuntu0.16.04.1","2:4.3.9+dfsg-0ubuntu0.16.04.2","2:4.3.9+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.1","2:4.3.11+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.5","2:4.3.11+dfsg-0ubuntu0.16.04.6","2:4.3.11+dfsg-0ubuntu0.16.04.7","2:4.3.11+dfsg-0ubuntu0.16.04.8","2:4.3.11+dfsg-0ubuntu0.16.04.9","2:4.3.11+dfsg-0ubuntu0.16.04.10","2:4.3.11+dfsg-0ubuntu0.16.04.11","2:4.3.11+dfsg-0ubuntu0.16.04.12","2:4.3.11+dfsg-0ubuntu0.16.04.13"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.7.6+dfsg~ubuntu-0ubuntu2.2"}]}],"versions":["2:4.6.7+dfsg-1ubuntu3","2:4.7.1+dfsg-1ubuntu1","2:4.7.3+dfsg-1ubuntu1","2:4.7.4+dfsg-1ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu2"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.6+git.182.2205d5224e3-1.1"}]}],"bundled":66}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"samba","product":"samba"},{"vendor":"the samba team","product":"samba"}],"references":[{"url":"https://www.debian.org/security/2018/dsa-4271","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3738-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.samba.org/samba/security/CVE-2018-10919.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10919","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20180814-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/105081","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/202003-52","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10919"},{"url":"https://github.com/advisories/GHSA-2h4c-mfg2-2f7f"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-10919","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-10919","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0424.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23444","tags":["report"]},{"url":"https://www.samba.org/samba/security/CVE-2018-10858.html","tags":["advisory"]},{"url":"https://www.samba.org/samba/history/samba-4.6.13.html","tags":["web"]},{"url":"https://www.samba.org/samba/history/samba-4.6.14.html","tags":["web"]},{"url":"https://www.samba.org/samba/history/samba-4.6.15.html","tags":["web"]},{"url":"https://www.samba.org/samba/history/samba-4.6.16.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182318-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1095048","tags":["report"]},{"url":"https://bugzilla.suse.com/1095056","tags":["report"]},{"url":"https://bugzilla.suse.com/1095057","tags":["report"]},{"url":"https://bugzilla.suse.com/1103411","tags":["report"]},{"url":"https://bugzilla.suse.com/1103414","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1140","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183161-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1068059","tags":["report"]},{"url":"https://bugzilla.suse.com/1087931","tags":["report"]},{"url":"https://bugzilla.suse.com/1102230","tags":["report"]},{"url":"https://bugzilla.suse.com/1110943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10919","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3738-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10919","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1139","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10918","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-3403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-0452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-3789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20277","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-10919","description":"The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.","status":"published","published":"2018-08-22T17:00:00Z","modified":"2024-08-05T07:54:36.241Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:35:01.28843Z"}],"euvd":[{"id":"EUVD-2018-2973","description":"The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.","status":"published","published":"2018-08-22T17:00:00Z","modified":"2024-08-05T07:54:36Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T02:39:57.009215Z"}],"ghsa":[{"id":"GHSA-2h4c-mfg2-2f7f","title":"The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because...","description":"The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.","status":"published","published":"2022-05-13T01:34:54Z","modified":"2023-02-01T05:08:32Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:50:47.846536Z"}],"nvd":[{"id":"CVE-2018-10919","description":"The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.","status":"published","published":"2018-08-22T17:29:00.603Z","modified":"2026-06-17T01:34:55.357Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-203","CWE-200"],"updated_at":"2026-11-02T14:04:36.842579Z"}],"osv":[{"id":"ALPINE-CVE-2018-10919","description":"The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.","status":"published","published":"2018-08-22T17:29:00.603Z","modified":"2026-10-23T17:17:55.202351992Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"CVE-2018-10919","description":"The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.","status":"published","published":"2018-08-22T17:29:00.603Z","modified":"2026-10-24T10:30:58.467729287Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-10919","description":"The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.","status":"published","published":"2018-08-22T17:29:00.603Z","modified":"2026-10-23T18:02:57.078714712Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"UBUNTU-CVE-2018-10919","description":"The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.","status":"published","published":"2018-08-14T00:00:00Z","modified":"2026-04-22T11:40:27.484664Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DLA-1539-1","title":"samba - security update","status":"published","published":"2018-10-08T00:00:00Z","modified":"2026-03-09T01:18:53.25653Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4271-1","title":"samba - security update","status":"published","published":"2018-08-14T00:00:00Z","modified":"2026-03-09T02:10:36.585251Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0424","title":"Updated samba packages fix security vulnerabilities","description":"Updated samba packages fix security vulnerabilities:\n\nA malicious server could return a directory entry that could corrupt\nlibsmbclient memory (CVE-2018-10858).\n\nMissing access control checks allow discovery of confidential attribute\nvalues via authenticated LDAP search expressions (CVE-2018-10919).\n\nThe samba package has been updated to version 4.6.16, fixing these issues\nand other bugs.\n","status":"published","published":"2018-10-30T18:01:43Z","modified":"2026-04-16T06:25:21.439242395Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11365-1","title":"ctdb-4.14.6+git.182.2205d5224e3-1.1 on GA media","description":"These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:12:49.07167Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:2318-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\nThe following security vulnerabilities were fixed:\n\n- CVE-2018-1139: Disable NTLMv1 auth if smb.conf doesn't allow it; (bsc#1095048)\n- CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes; (bsc#1095056)\n- CVE-2018-10919: Confidential attribute disclosure via substring search; (bsc#1095057)\n- CVE-2018-10858: smbc_urlencode helper function is a subject to buffer overflow; (bsc#1103411)\n- CVE-2018-10918: Fix NULL ptr dereference in DsCrackNames on a user without a SPN; (bsc#1103414)\n\n","status":"published","published":"2018-08-14T09:53:11Z","modified":"2026-02-04T04:08:21.035288Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:3161-1","title":"Security update for samba","description":"\n\nSamba was updated to 4.6.15, bringing bug and security fixes. (bsc#1110943)\n\nFollowing security issues were fixed:\n\n- CVE-2018-10919: Fix unauthorized attribute access via searches. (bsc#1095057);\n\nNon-security bugs fixed:\n\n- Fix ctdb_mutex_ceph_rados_helper deadlock (bsc#1102230).\n- Allow idmap_rid to have primary group other than 'Domain Users' (bsc#1087931).\n- winbind: avoid using fstrcpy in _dual_init_connection.\n- Fix ntlm authentications with 'winbind use default domain = yes' (bsc#1068059).\n","status":"published","published":"2018-10-16T09:15:02Z","modified":"2026-02-04T02:41:50.494869Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-3738-1","title":"samba vulnerabilities","description":"Svyatoslav Phirsov discovered that the Samba libsmbclient library\nincorrectly handled extra long filenames. A malicious server could use this\nissue to cause Samba to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2018-10858)\n\nVolker Mauel discovered that Samba incorrectly handled database output.\nWhen used as an Active Directory Domain Controller, a remote authenticated\nattacker could use this issue to cause Samba to crash, resulting in a\ndenial of service. This issue only affected Ubuntu 18.04 LTS.\n(CVE-2018-10918)\n\nPhillip Kuhrt discovered that the Samba LDAP server incorrectly handled\ncertain confidential attribute values. A remote authenticated attacker\ncould possibly use this issue to obtain certain sensitive information.\n(CVE-2018-10919)\n\nVivek Das discovered that Samba incorrectly handled NTLMv1 being explicitly\ndisabled on the server. A remote user could possibly be authenticated using\nNTLMv1, contrary to expectations. This issue only affected Ubuntu 18.04\nLTS. (CVE-2018-1139)\n","status":"published","published":"2018-08-14T17:02:50Z","modified":"2026-04-22T09:47:47.922312Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}