{"id":"CVE-2019-14902","aliases":["ALPINE-CVE-2019-14902","DEBIAN-CVE-2019-14902","DLA-2668-1","DLA-3563-1","EUVD-2019-6007","GHSA-h5p3-7352-mh38","MGASA-2020-0058","SUSE-SU-2020:0223-1","SUSE-SU-2020:0224-1","SUSE-SU-2020:2673-1","UBUNTU-CVE-2019-14902","USN-4244-1","openSUSE-SU-2020:0122-1","openSUSE-SU-2024:11365-1"],"status":"published","title":"There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4...","description":"There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.01421,"percentile":0.73008,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2020-01-21T00:00:00Z","modified":"2026-10-24T10:30:54Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"samba","fixed_in":["4.10.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"samba","fixed_in":["4.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"samba","fixed_in":["4.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"samba","fixed_in":["4.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"samba","fixed_in":["4.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"samba","fixed_in":["4.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"samba","fixed_in":["4.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"samba","fixed_in":["4.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"samba","fixed_in":["4.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"samba","fixed_in":["4.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"samba","fixed_in":["4.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"samba","fixed_in":["4.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"samba","fixed_in":["4.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"samba","fixed_in":["4.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"samba","fixed_in":["4.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"samba","fixed_in":["4.8.12-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"samba","fixed_in":["4.8.12-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"samba","fixed_in":["2:4.11.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"samba","fixed_in":["2:4.11.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"samba","fixed_in":["2:4.11.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"samba","fixed_in":["2:4.7.6+dfsg~ubuntu-0ubuntu2.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"samba","fixed_in":["2:4.11.5+dfsg-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.10.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.12-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.8.12-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.11.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.11.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.11.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.5.16+dfsg-1+deb9u4"}]}],"versions":["2:4.5.12+dfsg-1","2:4.5.12+dfsg-2","2:4.5.12+dfsg-2+deb9u1","2:4.5.12+dfsg-2+deb9u2","2:4.5.12+dfsg-2+deb9u3","2:4.5.12+dfsg-2+deb9u4","2:4.5.16+dfsg-1","2:4.5.16+dfsg-1+deb9u1","2:4.5.16+dfsg-1+deb9u2","2:4.5.16+dfsg-1+deb9u3","2:4.5.8+dfsg-2","2:4.5.8+dfsg-2+deb9u1","2:4.5.8+dfsg-2+deb9u2"],"bundled":8},{"source":"osv","ecosystem":"Debian:10","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9.5+dfsg-5+deb10u4"}]}],"versions":["2:4.9.5+dfsg-5","2:4.9.5+dfsg-5+deb10u1","2:4.9.5+dfsg-5+deb10u2","2:4.9.5+dfsg-5+deb10u3"],"bundled":7},{"source":"osv","ecosystem":"Mageia:7","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.12-1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5+git.243.e76c5cb3d97-3.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP1","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5+git.243.e76c5cb3d97-3.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5+git.243.e76c5cb3d97-3.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5+git.243.e76c5cb3d97-3.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.11+git.218.58b95cbfc0f-4.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.11+git.218.58b95cbfc0f-4.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.11+git.218.58b95cbfc0f-4.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.11+git.218.58b95cbfc0f-4.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.11+git.218.58b95cbfc0f-4.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.11+git.218.58b95cbfc0f-4.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.11+git.218.58b95cbfc0f-4.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.17+git.203.862547088ca-3.14.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-3.5.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.17+git.203.862547088ca-3.14.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-3.5.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.17+git.203.862547088ca-3.14.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-3.5.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.17+git.203.862547088ca-3.14.1"}]}],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.6.18-1ubuntu3","2:4.0.10+dfsg-4ubuntu2","2:4.0.13+dfsg-1ubuntu1","2:4.1.3+dfsg-2ubuntu2","2:4.1.3+dfsg-2ubuntu3","2:4.1.3+dfsg-2ubuntu4","2:4.1.3+dfsg-2ubuntu5","2:4.1.6+dfsg-1ubuntu1","2:4.1.6+dfsg-1ubuntu2","2:4.1.6+dfsg-1ubuntu2.14.04.1","2:4.1.6+dfsg-1ubuntu2.14.04.2","2:4.1.6+dfsg-1ubuntu2.14.04.3","2:4.1.6+dfsg-1ubuntu2.14.04.4","2:4.1.6+dfsg-1ubuntu2.14.04.5","2:4.1.6+dfsg-1ubuntu2.14.04.7","2:4.1.6+dfsg-1ubuntu2.14.04.8","2:4.1.6+dfsg-1ubuntu2.14.04.9","2:4.1.6+dfsg-1ubuntu2.14.04.11","2:4.1.6+dfsg-1ubuntu2.14.04.12","2:4.1.6+dfsg-1ubuntu2.14.04.13","2:4.3.8+dfsg-0ubuntu0.14.04.2","2:4.3.9+dfsg-0ubuntu0.14.04.1","2:4.3.9+dfsg-0ubuntu0.14.04.3","2:4.3.11+dfsg-0ubuntu0.14.04.1","2:4.3.11+dfsg-0ubuntu0.14.04.2","2:4.3.11+dfsg-0ubuntu0.14.04.3","2:4.3.11+dfsg-0ubuntu0.14.04.4","2:4.3.11+dfsg-0ubuntu0.14.04.6","2:4.3.11+dfsg-0ubuntu0.14.04.7","2:4.3.11+dfsg-0ubuntu0.14.04.8","2:4.3.11+dfsg-0ubuntu0.14.04.9","2:4.3.11+dfsg-0ubuntu0.14.04.10","2:4.3.11+dfsg-0ubuntu0.14.04.11","2:4.3.11+dfsg-0ubuntu0.14.04.12","2:4.3.11+dfsg-0ubuntu0.14.04.13","2:4.3.11+dfsg-0ubuntu0.14.04.14","2:4.3.11+dfsg-0ubuntu0.14.04.16","2:4.3.11+dfsg-0ubuntu0.14.04.17","2:4.3.11+dfsg-0ubuntu0.14.04.19","2:4.3.11+dfsg-0ubuntu0.14.04.20","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm1","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm2","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm3","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm4","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm6","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm7","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm8","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm9","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm11","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm12","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm13","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm14","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.1.17+dfsg-4ubuntu2","2:4.1.20+dfsg-1ubuntu1","2:4.1.20+dfsg-1ubuntu2","2:4.1.20+dfsg-1ubuntu3","2:4.1.20+dfsg-1ubuntu5","2:4.3.3+dfsg-1ubuntu1","2:4.3.3+dfsg-1ubuntu2","2:4.3.3+dfsg-1ubuntu3","2:4.3.6+dfsg-1ubuntu1","2:4.3.8+dfsg-0ubuntu1","2:4.3.9+dfsg-0ubuntu0.16.04.1","2:4.3.9+dfsg-0ubuntu0.16.04.2","2:4.3.9+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.1","2:4.3.11+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.5","2:4.3.11+dfsg-0ubuntu0.16.04.6","2:4.3.11+dfsg-0ubuntu0.16.04.7","2:4.3.11+dfsg-0ubuntu0.16.04.8","2:4.3.11+dfsg-0ubuntu0.16.04.9","2:4.3.11+dfsg-0ubuntu0.16.04.10","2:4.3.11+dfsg-0ubuntu0.16.04.11","2:4.3.11+dfsg-0ubuntu0.16.04.12","2:4.3.11+dfsg-0ubuntu0.16.04.13","2:4.3.11+dfsg-0ubuntu0.16.04.15","2:4.3.11+dfsg-0ubuntu0.16.04.16","2:4.3.11+dfsg-0ubuntu0.16.04.17","2:4.3.11+dfsg-0ubuntu0.16.04.18","2:4.3.11+dfsg-0ubuntu0.16.04.19","2:4.3.11+dfsg-0ubuntu0.16.04.20","2:4.3.11+dfsg-0ubuntu0.16.04.21","2:4.3.11+dfsg-0ubuntu0.16.04.23","2:4.3.11+dfsg-0ubuntu0.16.04.24","2:4.3.11+dfsg-0ubuntu0.16.04.25","2:4.3.11+dfsg-0ubuntu0.16.04.26","2:4.3.11+dfsg-0ubuntu0.16.04.27","2:4.3.11+dfsg-0ubuntu0.16.04.28","2:4.3.11+dfsg-0ubuntu0.16.04.29","2:4.3.11+dfsg-0ubuntu0.16.04.30","2:4.3.11+dfsg-0ubuntu0.16.04.31","2:4.3.11+dfsg-0ubuntu0.16.04.32","2:4.3.11+dfsg-0ubuntu0.16.04.34","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm1","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm2","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm3","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.7.6+dfsg~ubuntu-0ubuntu2.15"}]}],"versions":["2:4.6.7+dfsg-1ubuntu3","2:4.7.1+dfsg-1ubuntu1","2:4.7.3+dfsg-1ubuntu1","2:4.7.4+dfsg-1ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu2","2:4.7.6+dfsg~ubuntu-0ubuntu2.2","2:4.7.6+dfsg~ubuntu-0ubuntu2.4","2:4.7.6+dfsg~ubuntu-0ubuntu2.5","2:4.7.6+dfsg~ubuntu-0ubuntu2.6","2:4.7.6+dfsg~ubuntu-0ubuntu2.7","2:4.7.6+dfsg~ubuntu-0ubuntu2.9","2:4.7.6+dfsg~ubuntu-0ubuntu2.10","2:4.7.6+dfsg~ubuntu-0ubuntu2.11","2:4.7.6+dfsg~ubuntu-0ubuntu2.13","2:4.7.6+dfsg~ubuntu-0ubuntu2.14"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.11.5+dfsg-1ubuntu1"}]}],"versions":["2:4.10.7+dfsg-0ubuntu2","2:4.10.7+dfsg-0ubuntu3","2:4.11.1+dfsg-3ubuntu1","2:4.11.1+dfsg-3ubuntu2","2:4.11.1+dfsg-3ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.25"}]}],"versions":["2:4.1.17+dfsg-4ubuntu2","2:4.1.20+dfsg-1ubuntu1","2:4.1.20+dfsg-1ubuntu2","2:4.1.20+dfsg-1ubuntu3","2:4.1.20+dfsg-1ubuntu5","2:4.3.3+dfsg-1ubuntu1","2:4.3.3+dfsg-1ubuntu2","2:4.3.3+dfsg-1ubuntu3","2:4.3.6+dfsg-1ubuntu1","2:4.3.8+dfsg-0ubuntu1","2:4.3.9+dfsg-0ubuntu0.16.04.1","2:4.3.9+dfsg-0ubuntu0.16.04.2","2:4.3.9+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.1","2:4.3.11+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.5","2:4.3.11+dfsg-0ubuntu0.16.04.6","2:4.3.11+dfsg-0ubuntu0.16.04.7","2:4.3.11+dfsg-0ubuntu0.16.04.8","2:4.3.11+dfsg-0ubuntu0.16.04.9","2:4.3.11+dfsg-0ubuntu0.16.04.10","2:4.3.11+dfsg-0ubuntu0.16.04.11","2:4.3.11+dfsg-0ubuntu0.16.04.12","2:4.3.11+dfsg-0ubuntu0.16.04.13","2:4.3.11+dfsg-0ubuntu0.16.04.15","2:4.3.11+dfsg-0ubuntu0.16.04.16","2:4.3.11+dfsg-0ubuntu0.16.04.17","2:4.3.11+dfsg-0ubuntu0.16.04.18","2:4.3.11+dfsg-0ubuntu0.16.04.19","2:4.3.11+dfsg-0ubuntu0.16.04.20","2:4.3.11+dfsg-0ubuntu0.16.04.21","2:4.3.11+dfsg-0ubuntu0.16.04.23","2:4.3.11+dfsg-0ubuntu0.16.04.24"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.7.6+dfsg~ubuntu-0ubuntu2.15"}]}],"versions":["2:4.6.7+dfsg-1ubuntu3","2:4.7.1+dfsg-1ubuntu1","2:4.7.3+dfsg-1ubuntu1","2:4.7.4+dfsg-1ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu2","2:4.7.6+dfsg~ubuntu-0ubuntu2.2","2:4.7.6+dfsg~ubuntu-0ubuntu2.4","2:4.7.6+dfsg~ubuntu-0ubuntu2.5","2:4.7.6+dfsg~ubuntu-0ubuntu2.6","2:4.7.6+dfsg~ubuntu-0ubuntu2.7","2:4.7.6+dfsg~ubuntu-0ubuntu2.9","2:4.7.6+dfsg~ubuntu-0ubuntu2.10","2:4.7.6+dfsg~ubuntu-0ubuntu2.11","2:4.7.6+dfsg~ubuntu-0ubuntu2.13","2:4.7.6+dfsg~ubuntu-0ubuntu2.14"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5+git.243.e76c5cb3d97-lp151.2.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.6+git.182.2205d5224e3-1.1"}]}],"bundled":66}],"products":[{"vendor":"[unknown]","product":"samba"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"leap"},{"vendor":"samba","product":"samba"}],"references":[{"url":"https://www.samba.org/samba/security/CVE-2019-14902.html","tags":["x_transferred","Mailing List","Vendor Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14902","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20200122-0001/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_20_01","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4244-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00055.html","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GQ6U65I2K23YJC4FESW477WL55TU3PPT/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ACZVNMIFQGGXNJPMHAVBN3H2U65FXQY/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202003-52","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html","tags":["mailing-list","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14902"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ACZVNMIFQGGXNJPMHAVBN3H2U65FXQY/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GQ6U65I2K23YJC4FESW477WL55TU3PPT/"},{"url":"https://github.com/advisories/GHSA-h5p3-7352-mh38"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-14902","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14902","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0058.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26113","tags":["report"]},{"url":"https://www.samba.org/samba/security/CVE-2019-14907.html","tags":["advisory"]},{"url":"https://www.samba.org/samba/security/CVE-2019-19344.html","tags":["advisory"]},{"url":"https://www.samba.org/samba/history/samba-4.10.12.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200223-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1141320","tags":["report"]},{"url":"https://bugzilla.suse.com/1160850","tags":["report"]},{"url":"https://bugzilla.suse.com/1160852","tags":["report"]},{"url":"https://bugzilla.suse.com/1160888","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19344","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200224-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202673-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1141267","tags":["report"]},{"url":"https://bugzilla.suse.com/1144902","tags":["report"]},{"url":"https://bugzilla.suse.com/1154289","tags":["report"]},{"url":"https://bugzilla.suse.com/1154598","tags":["report"]},{"url":"https://bugzilla.suse.com/1158108","tags":["report"]},{"url":"https://bugzilla.suse.com/1158109","tags":["report"]},{"url":"https://bugzilla.suse.com/1169850","tags":["report"]},{"url":"https://bugzilla.suse.com/1169851","tags":["report"]},{"url":"https://bugzilla.suse.com/1173159","tags":["report"]},{"url":"https://bugzilla.suse.com/1173160","tags":["report"]},{"url":"https://bugzilla.suse.com/1173359","tags":["report"]},{"url":"https://bugzilla.suse.com/1174120","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14303","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-14902","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4244-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14902","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19344","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OSS2CK6VSLL6IEQRPPMP2VPFDOZ7PYGK/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-3403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-0452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-3789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20277","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-14902","description":"There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers.","status":"published","published":"2020-01-21T00:00:00Z","modified":"2024-08-05T00:26:39.142Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:20:17.722148Z"}],"euvd":[{"id":"EUVD-2019-6007","description":"There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers.","status":"published","published":"2020-01-21T00:00:00Z","modified":"2024-08-05T00:26:39Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T02:40:38.166988Z"}],"ghsa":[{"id":"GHSA-h5p3-7352-mh38","title":"There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4...","description":"There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers.","status":"published","published":"2022-05-24T17:07:00Z","modified":"2023-09-14T18:32:38Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:54:46.481792Z"}],"nvd":[{"id":"CVE-2019-14902","description":"There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers.","status":"published","published":"2020-01-21T18:15:12.653Z","modified":"2026-06-17T02:19:17.25Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:05:42.416368Z"}],"osv":[{"id":"ALPINE-CVE-2019-14902","description":"There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers.","status":"published","published":"2020-01-21T18:15:12.653Z","modified":"2026-09-21T06:17:52.489318582Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"CVE-2019-14902","description":"There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers.","status":"published","published":"2020-01-21T18:15:12.653Z","modified":"2026-10-24T10:30:54.136695108Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"DEBIAN-CVE-2019-14902","description":"There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers.","status":"published","published":"2020-01-21T18:15:12.653Z","modified":"2026-09-21T07:02:42.301501036Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"UBUNTU-CVE-2019-14902","description":"There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers.","status":"published","published":"2020-01-21T00:00:00Z","modified":"2026-04-22T12:11:17.834385Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-2668-1","title":"samba - security update","status":"published","published":"2021-05-29T00:00:00Z","modified":"2026-03-09T01:19:05.969398Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-3563-1","title":"samba - security update","status":"published","published":"2023-09-12T00:00:00Z","modified":"2026-03-09T01:20:21.758142Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2020-0058","title":"Updated samba packages fix security vulnerabilities","description":"The implementation of ACL inheritance in the Samba AD DC was not\ncomplete, and so absent a 'full-sync' replication, ACLs could get out of\nsync between domain controllers (CVE-2019-14902).\n\nWhen processing untrusted string input Samba can read past the end of\nthe allocated buffer when printing a \"Conversion error\" message to the\nlogs. This can cause a crash after the failed character conversion when\noperating at log level 3 or above (CVE-2019-14907).\n\nDuring DNS zone scavenging (of expired dynamic entries) in a Samba AD\nDC, there is a read of memory after it has been freed (CVE-2019-19344).\n\nNote that manual intervention is required to fully implement the fix\nfor CVE-2019-14902.  See the upstream advisory for details.\n","status":"published","published":"2020-01-28T07:52:40Z","modified":"2026-04-16T04:43:10.045056463Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0122-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-14907: Fixed a Server-side crash after charset conversion failure during NTLMSSP processing (bsc#1160888).\n- CVE-2019-14902: Fixed an issue where automatic replication of ACLs down subtree on AD Directory is not working (bsc#1160850).\n- CVE-2019-19344: Fixed a server crash when using dns zone scavenging = yes (bsc#1160852).\n\nNon-security issue fixed:\n\n- Fixed Ceph snapshot path handling relative to root (bsc#1141320).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-01-28T23:11:37Z","modified":"2026-02-04T03:36:36.8715Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11365-1","title":"ctdb-4.14.6+git.182.2205d5224e3-1.1 on GA media","description":"These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:12:49.07167Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2020:0223-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-14907: Fixed a Server-side crash after charset conversion failure during NTLMSSP processing (bsc#1160888).\n- CVE-2019-14902: Fixed an issue where automatic replication of ACLs down subtree on AD Directory is not working (bsc#1160850).\n- CVE-2019-19344: Fixed a server crash when using dns zone scavenging = yes (bsc#1160852).\n\nNon-security issue fixed:\n\n- Fixed Ceph snapshot path handling relative to root (bsc#1141320).\n","status":"published","published":"2020-01-23T15:20:47Z","modified":"2026-02-04T04:00:15.679606Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0224-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\n- CVE-2019-14902: Fixed an issue where automatic replication of ACLs down subtree on AD Directory is not working (bsc#1160850).\n- CVE-2019-14907: Fixed a Server-side crash after charset conversion failure during NTLMSSP processing (bsc#1160888).\n","status":"published","published":"2020-01-23T16:05:30Z","modified":"2026-02-04T03:16:51.189829Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:2673-1","title":"Security update for samba","description":"This update for samba to version 4.10.17 fixes the following issues:\n\n- Fixed net command unable to negotiate SMB2; (bsc#1174120);\n\t  \n- Update to 4.10.17\n  - CVE-2020-10745: Invalid DNS or NBT queries containing dots use\n    several seconds of CPU each; (bso#14378); (bsc#1173160).\n  - CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ\n    and VLV combined; (bso#14364); (bsc#1173159).\n  - CVE-2020-10760: Fix use-after-free in AD DC Global Catalog LDAP\n    server with paged_result or VLV; (bso#14402); (1173161).\n  - CVE-2020-14303: Fix endless loop from empty UDP packet sent to\n    AD DC nbt_server; (bso#14417); (bsc#1173359).\n  - CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ\n    and VLV combined, ldb: Bump version to 1.5.8; (bso#14364);\n    (bsc#1173159).\n- Update to 4.10.16\n    s3: lib: Paranoia around use of snprintf copying into a fixed-size buffer\n    from a getenv() pointer.\n    lib:util: Fix smbclient -l basename dir; (bso#14345).\n    Malicous SMB1 server can crash libsmbclient; (bso#14366).\n    s3:libads: Fix ads_get_upn(); (bso#14336).\n    docs-xml: Fix usernames in pam_winbind manpages; (bso#14358).\n    Client tools are not able to read gencache anymore since 4.10; (bso#14370).\n- Update to 4.10.15\n   - CVE-2020-10700: Fix use-after-free in AD DC LDAP server when\n     ASQ and paged_results combined; (bso#14331); (bsc#1169850).\n   - CVE-2020-10704: Fix LDAP Denial of Service (stack overflow) in\n     Samba AD DC; (bso#20454); (bsc#1169851).\n- Update to 4.10.14\n    s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239).\n    s3: VFS: full_audit. Use system session_info if called from a\n    temporary share definition; (bso#14283).\n    nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#20193).\n    dsdb: Correctly handle memory in objectclass_attrs; (bso#14258).\n    auth: Fix CID 1458418 Null pointer dereferences (REVERSE_INULL),\n    auth: Fix CID 1458420 Null pointer dereferences (REVERSE_INULL); (bso#14247).\n    winbind member (source3) fails local SAM auth with empty domain\n    name; (bso#14247).\n    winbindd: Handling missing idmap in getgrgid(); (bso#14265).\n    lib:util: Log mkdir error on correct debug levels; (bso#14253).\n    wafsamba: Do not use 'rU' as the 'U' is deprecated in\n    Python 3.9; (bso#14266).\n    ctdb-tcp: Make error handling for outbound connection\n    consistent; (bso#14274).\n    Starting ctdb node that was powered off hard before results in\n     recovery loop; (bso#14295).\n- Update to 4.10.13\n    s3: libsmb: Ensure SMB1 cli_qpathinfo2() doesn't return an\n    inode number; (bso#14161).\n    s3: utils: smbtree. Ensure we don't call cli_RNetShareEnum()\n    on an SMB1 connection; (bso#14174).\n    s3: libsmb: Ensure return from net_share_enum_rpc() sets\n    cli-\u003eraw_status on error; (bso#14176).\n    s3: smbd: SMB2 - Ensure we use the correct session_id if\n    encrypting an interim response; (bso#14189).\n    s3: smbd: Only set xconn-\u003esmb1.negprot.done = true after\n    supported_protocols[protocol].proto_reply_fn() succeeds; (bso#14205).\n    pygpo: Use correct method flags; (bso#14209).\n    s3: Remove now unneeded call to cmdline_messaging_context(); (bso#13925).\n    Incomplete conversion of former parametric options; (bso#14069).\n    Fix sync dosmode fallback in async dosmode codepath; (bso#14070).\n    vfs_fruit returns capped resource fork length; (bso#14171).\n    s3:printing: Fix %J substition; (bso#13745).\n    libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116).\n    Avoiding bad call flags with python 3.8, using METH_NOARGS\n    instead of zero; (bso#14209).\n    docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122).\n    ctdb-tcp: Close inflight connecting TCP sockets after fork; (bso#14175).\n    s4:dirsync: Fix interaction of dirsync and extended_dn controls; (bso#14153).\n    upgradedns: Ensure lmdb lock files linked; (bso#14199).\n    s3: VFS: glusterfs: Reset nlinks for symlink entries during\n    readdir; (bso#14182).\n    wscript: Remove checks for shm_open and shmget; (bso#14140).\n    libsmbclient: smbc_stat() doesn't return the correct st_mode\n    and also the uid/gid is not filled (SMBv1); (bso#14101).\n    replace: Only link libnsl and libsocket if required; (bso#14168).\n    librpc: Fix string length checking in\n    ndr_pull_charset_to_null(); (bso#14219).\n    heimdal-build: Avoid hard-coded /usr/include/heimdal in\n    asn1_compile-generated code; (bso#13856).\n    ctdb-tcp: Drop tracking of file descriptor for incoming\n    connections; (bso#14175).\n    ctdb-scripts: Strip square brackets when gathering connection\n     info; (bso#14227).\n- Update to 4.10.12\n   - CVE-2019-14902: Replication of ACLs down subtree on AD Directory\n     not automatic; (bso#12497); (bsc#1160850);\n   - CVE-2019-14907: lib/util: Do not print the failed to convert\n     string into the logs; (bso#14208); (bsc#1160888).\n   - CVE-2019-19344: kcc dns scavenging: Fix use after free in\n     dns_tombstone_records_zone; (bso#14050); (bsc#1160852).\n- Update to 4.10.11\n   - CVE-2019-14861: Fix DNSServer RPC server crash; (bso#14138);\n     (bsc#1158108).\n   - CVE-2019-14870: DelegationNotAllowed not being enforced; (bso#14187);\n     (bsc#1158109).\n- Update to 4.10.10\n   - CVE-2019-10218 - s3: libsmb: Protect SMB1 and SMB2 client code\n     from evil server returned names; (bso#14071); (bsc#1144902).\n   - CVE-2019-14833: Use utf8 characters in the unacceptable\n     password; (bso#12438); (bsc#1154289).\n   - CVE-2019-14847 dsdb: Correct behaviour of ranged_results when\n     combined with dirsync; (bso#14040); (bsc#1154598).\n   - CVE-2019-14833 dsdb: Send full password to check password\n     script; (bso#12438); (bsc#1154289).\n- Update to 4.10.9\n    Different Device Id for GlusterFS FUSE mount is causing data\n    loss in CTDB cluster; (bso#13972).\n    winbind: Provide passwd struct for group sid with ID_TYPE_BOTH\n    mapping (again); (bso#14141).\n    smbc_readdirplus() is incompatible with smbc_telldir() and\n    smbc_lseekdir(); (bso#14094).\n    s3: smbclient: Stop an SMB2-connection from blundering into\n    SMB1-specific calls; (bso#14152).\n    s4/scripting: MORE py3 compatible print functions.\n    ldb: Release ldb 1.5.6; (bso#13978).\n    undoduididx: Add 'or later' to warning about using tools from\n    Samba 4.8; (bso#13978).\n    ldb_tdb fails to check error return when parsing pack formats; (bso#13959).\n    ctdb: Fix compilation on systems with glibc robust mutexes; (bso#14038).\n    GPO security filtering based on the groups in Kerberos PAC (but\n    primary group is missing); (bso#11362).\n    Fix spnego fallback from kerberos to ntlmssp in smbd server; (bso#14106).\n    s3-winbindd: fix forest trusts with additional trust attributes; (bso#14130).\n    vfs_glusterfs: Use pthreadpool for scheduling aio operations; (bso#14098).\n    ldb: baseinfo pack format check on init; (bso#13977).\n    ldb: ldbdump key and pack format version comments; (bso#13978).\n    Overlinking libreplace against librt and pthread against every\n    binary or library causes issues; (bso#14140).\n    ctdb-vacuum: Process all records not deleted on a remote node; (bso#14147).\n    classicupgrade: Fix uncaught exception; (bso#14136).\n    fault.c: Improve fault_report message text pointing to our wiki; (bso#14139).\n    s3:client:Use DEVICE_URI, instead of argv[0],for Device URI; (bso#14128).\n    We should send SMB2_NETNAME_NEGOTIATE_CONTEXT_ID negotiation\n    context; (bso#14055).\n    'pam_winbind' with 'krb5_auth' or 'wbinfo -K' doesn't work for\n    users of trusted domains/forests principals' logic; (bso#14124).\n    vfs_glusterfs: Enable profiling for file system operations; (bso#14093).\n    vfs_gpfs: Implement special case for denying owner access to\n    ACL; (bso#14032).\n    Joining Active Directory should not use SAMR to set the\n    password; (bso#13884).\n    s3:libsmb: Do not check the SPNEGO neg token for KRB5; (bso#14106).\n    Overlinking libreplace against librt and pthread against every\n    binary or library causes issues; (bso#14140).\n    'kpasswd' fails when built with MIT Kerberos; (bso#14155).\n    CTDB replies can be lost before nodes are bidirectionally\n    connected; (bso#14084).\n    'ctdb stop' command completes before databases are frozen; (bso#14087).\n    ctdb-tools: Stop deleted nodes from influencing ctdb nodestatus\n    exit code; (bso#14129).\n    s3:ldap: Fix join with don't exists machine account; (bso#14007).\n- Update to 4.10.8\n   - CVE-2019-10197: Permissions check deny can allow user to escape\n     from the share; (bso#14035); (bsc#1141267).\n   - CVE-2019-10197: Permissions check deny can allow user to escape\n     from the share; (bso#14035); (bsc#1141267).\n- Update to 4.10.7\n    Unable to create or rename file/directory inside shares\n    configured with vfs_glusterfs_fuse module; (bso#14010).\n    build: Allow build when '--disable-gnutls' is set; (bso#13844).\n    samba-tool: Add 'import samba.drs_utils' to fsmo.py; (bso#13973).\n    Fix 'Error 32 determining PSOs in system' message on old DB\n    with FL upgrade; (bso#14008).\n    s4/libnet: Fix joining a Windows pre-2008R2 DC; (bso#14021).\n    join: Use a specific attribute order for the DsAddEntry\n    nTDSDSA object; (bso#14046).\n    vfs_catia: Pass stat info to synthetic_smb_fname(); (bso#14015).\n    lookup_name: Allow own domain lookup when flags == 0; (bso#14091).\n    s4 librpc rpc pyrpc: Ensure tevent_context deleted last; (bso#13932).\n    DEBUGC and DEBUGADDC doesn't print into a class specific log\n    file; (bso#13915).\n    Request to keep deprecated option 'server schannel',\n    VMWare Quickprep requires 'auto'; (bso#13949).\n    dbcheck: Fallback to the default tombstoneLifetime of 180 days; (bso#13967).\n    dnsProperty fails to decode values from older Windows versions; (bso#13969).\n    samba-tool: Use only one LDAP modify for dns partition fsmo\n    role transfer; (bso#13973).\n    third_party: Update waf to version 2.0.17; (bso#13960).\n    netcmd: Allow 'drs replicate --local' to create partitions; (bso#14051).\n    ctdb-config: Depend on /etc/ctdb/nodes file; (bso#14017).\n- Update to 4.10.6\n    s3: winbind: Fix crash when invoking winbind idmap scripts; (bso#13956).\n    smbd does not correctly parse arguments passed to dfree and\n    quota scripts; (bso#13964).\n    samba-tool dns: use bytes for inet_ntop; (bso#13965).\n    samba-tool domain provision: Fix --interactive module in\n    python3; (bso#13828).\n    ldb_kv: Skip @ records early in a search full scan; (bso#13893).\n    docs: Improve documentation of 'lanman auth' and 'ntlm auth'\n    connection; (bso#13981).\n    python/ntacls: Use correct 'state directory' smb.conf option\n    instead of 'state dir'; (bso#14002).\n    registry: Add a missing include; (bso#13840).\n    Fix SMB guest authentication; (bso#13944).\n    AppleDouble conversion breaks Resourceforks; (bso#13958).\n    vfs_fruit makes direct use of syscalls like mmap() and pread(); (bso#13968).\n    s3:mdssvc: Fix flex compilation error; (bso#13987).\n    s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly:; (bso#13872).\n    dsdb:samdb: schemainfo update with relax control; (bso#13799).\n    s3:util: Move static file_pload() function to lib/util; (bso#13964).\n    smbd: Fix a panic; (bso#13957).\n    ldap server: Generate correct referral schemes; (bso#12478).\n    s4 dsdb/repl_meta_data: fix use after free in\n    dsdb_audit_add_ldb_value; (bso#13941).\n    s4 dsdb: Fix use after free in\n    samldb_rename_search_base_callback; (bso#13942).\n    dsdb/repl: we need to replicate the whole schema before we can\n    apply it; (bso#12204).\n    ldb: Release ldb 1.5.5; (bso#12478).\n    Schema replication fails if link crosses chunk boundary\n    backwards; (bso#13713).\n    'samba-tool domain schemaupgrade' uses relax control and skips\n    the schemaInfo update provision; (bso#13799).\n    dsdb_audit: avoid printing '... remote host [Unknown]\n    SID [(NULL SID)] ...'; (bso#13916).\n    python/ntacls: We only need security.SEC_STD_READ_CONTROL in\n    order to get the ACL; (bso#13917).\n    s3:loadparm: Ensure to truncate FS Volume Label at multibyte\n    boundary; (bso#13947).\n    Using Kerberos credentials to print using spoolss doesn't work; (bso#13939).\n    wafsamba: Use native waf timer; (bso#13998).\n    ctdb-scripts: Fix tcp_tw_recycle existence check; (bso#13984).\n\nThis update for ldb to version 1.5.8 fixes the following issues:\n\n- Update to 1.5.8\n   - CVE-2020-10730: Fixed a null de-reference in AD DC LDAP server when ASQ and VLV combined (bsc#1173159).\n- Update to 1.5.7\n   - CVE-2020-10700: Fixed a use-after-free in AD DC LDAP server when ASQ and paged_results combined (bsc#1169850).\n- Update to 1.5.6\n   - Fix segfault parsing new pack formats or invalid packed data \n   - Check for new pack formats during startup \n   - Making ldbdump print out pack format info and keys so we have\n    low level visibility for testing in python \n- Update to 1.5.5\n   LDAP_REFERRAL_SCHEME_OPAQUE was added \n   Skip @ records early in a search full scan \n\n\n","status":"published","published":"2020-09-17T13:33:18Z","modified":"2026-02-04T04:37:51.694123Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-4244-1","title":"samba vulnerabilities","description":"It was discovered that Samba did not automatically replicate ACLs set to\ninherit down a subtree on AD Directory, contrary to expectations. This\nissue was only addressed in Ubuntu 18.04 LTS, Ubuntu 19.04 and Ubuntu\n19.10. (CVE-2019-14902)\n\nRobert Święcki discovered that Samba incorrectly handled certain character\nconversions when the log level is set to 3 or above. In certain\nenvironments, a remote attacker could possibly use this issue to cause\nSamba to crash, resulting in a denial of service. (CVE-2019-14907)\n\nChristian Naumer discovered that Samba incorrectly handled DNS zone\nscavenging. This issue could possibly result in some incorrect data being\nwritten to the DB. This issue only applied to Ubuntu 19.04 and Ubuntu\n19.10. (CVE-2019-19344)\n","status":"published","published":"2020-01-21T12:59:17Z","modified":"2026-04-27T15:48:44.374670488Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}