samba
46 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-10230 | < 4.21.9 ; 4.22.0 – < 4.21.5 ; 4.23.0 – < 4.23.2 | Samba: command injection in wins server hook script | CRITICAL 10.0 | 40 % | ||
| CVE-2025-9640 | < 4.21.9 ; 4.22.0 – < 4.21.5 ; 4.23.0 – < 4.23.2 | Samba: vfs_streams_xattr uninitialized memory write possible | MEDIUM 4.3 | 0.5 % | ||
| CVE-2025-0620 | 4.21.0 – < 4.21.6 | Samba: smbd doesn't pick up group membership changes when re-authenticating an expired smb session | MEDIUM 4.9 | 0.7 % | ||
| CVE-2020-25720 | < 4.17.8 | Samba: check attribute access rights for ldap adds of computers | HIGH 7.5 | 0.5 % | ||
| CVE-2023-4154 | fixed in 4.19.1, 4.18.8, 4.17.12 | Samba: ad dc password exposure to privileged users and rodcs | HIGH 7.5 | 1.4 % | ||
| CVE-2023-42669 | 4.0.0 – < 4.17.12 ; 4.18.0 – < 4.18.8 ; 4.19.0 | Samba: "rpcecho" development server allows denial of service via sleep() call on ad dc | MEDIUM 6.5 | 1.9 % | ||
| CVE-2023-42670 | 4.16.0 – < 4.17.12 ; 4.18.0 – < 4.18.8 ; 4.19.0 | Samba: ad dc busy rpc multiple listener dos | MEDIUM 6.5 | 1.3 % | ||
| CVE-2023-0922 | samba 4.18.1, samba 4.17.7, samba 4.16.10 | The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed- | MEDIUM 5.9 | 0.5 % | ||
| CVE-2023-0614 | samba 4.18.1, samba 4.17.7, samba 4.16.10 | The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attac | HIGH 7.7 | 0.6 % | ||
| CVE-2023-0225 | samba 4.18.1, samba 4.17.7, samba 4.16.10 | A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this at | MEDIUM 4.3 | 0.7 % | ||
| CVE-2022-45142 | unknown | The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to t | HIGH 7.5 | 0.5 % | ||
| CVE-2022-45141 | Fixed in samba 4.15.13, samba 4.16.8, samba 4.15.13 | Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assu | CRITICAL 9.8 | 0.5 % | ||
| CVE-2021-20251 | Samba 4.1 and newer | A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if spe | MEDIUM 5.9 | 0.8 % | ||
| CVE-2018-14628 | All versions from 4.0.0 onwards | An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivil | MEDIUM 4.3 | 1.2 % | ||
| CVE-2022-3592 | Affects samba since 4.17.0, Fixed samba 4.17.2. | A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured sh | MEDIUM 6.5 | 2.7 % | ||
| CVE-2022-3437 | Fixed in samba 4.15.11, samba 4.16.6, samba 4.17.2. | A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES | MEDIUM 6.5 | 3.9 % | ||
| CVE-2022-32743 | samba 4.1 and newer | Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it. | HIGH 7.5 | 1.6 % | ||
| CVE-2022-1615 | Samba 4.1 and newer | In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values. | MEDIUM 5.5 | 0.5 % | ||
| CVE-2022-0336 | Affects Samba v4.0.0 and later, Fixed in samba v4.13.17, v4.14.12, v4.15.4. | The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those alread | HIGH 8.8 | 1.8 % | ||
| CVE-2022-32746 | Versions prior to samba 4.16.4, samba 4.15.9, samba 4.14.14 | A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding da | MEDIUM 5.4 | 1.3 % | ||
| CVE-2022-32745 | Versions prior to samba 4.16.4, samba 4.15.9, samba 4.14.14 | A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually | HIGH 8.1 | 1.1 % | ||
| CVE-2022-32744 | Versions prior to samba 4.16.4, samba 4.15.9, samba 4.14.14 | A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with i | HIGH 8.8 | 1.2 % | ||
| CVE-2022-32742 | Versions prior to samba 4.16.4, samba 4.15.9, samba 4.14.14 | A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill th | MEDIUM 4.3 | 1.3 % | ||
| CVE-2022-2031 | Versions prior to samba 4.16.4, samba 4.15.9, samba 4.14.14 | A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowi | HIGH 8.8 | 1.3 % | ||
| CVE-2021-3670 | Affects Samba 4.1 and newer. | MaxQueryDuration not honoured in Samba AD DC LDAP | MEDIUM 6.5 | 2.3 % | ||
| CVE-2021-20316 | Affects samba file server before v4.15.0, Fixed in samba v4.15.0 | A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or mo | MEDIUM 6.8 | 1.0 % | ||
| CVE-2020-25721 | Affected - All versions since Samba 4.0.0, Fixed-In - v4.15.2, v4.14.10 and v4.13.14 | Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to | HIGH 8.8 | 2.2 % | ||
| CVE-2021-3738 | Affects all versions since samba 4.0 | Fixedin samba v4.15.2, v4.14.10 and v4.13.14 | In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association | HIGH 8.8 | 2.0 % | ||
| CVE-2021-23192 | Affects samba v4.10.0 to 4.15.1, Fixed in samba v4.15.2, v4.14.10 and v4.13.14. | A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragmen | HIGH 7.5 | 2.0 % | ||
| CVE-2021-44141 | All versions of Samba prior to 4.15.5 | All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists | MEDIUM 4.3 | 1.1 % | ||
| CVE-2020-25722 | samba 4.15.2, samba 4.14.10, samba 4.13.14 | Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw | HIGH 8.8 | 1.6 % | ||
| CVE-2020-25719 | samba 4.15.2, samba 4.14.10, samba 4.13.14 | A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC | HIGH 7.2 | 1.7 % | ||
| CVE-2020-25718 | samba 4.15.2, samba 4.14.10, samba 4.13.14 | A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This | HIGH 8.8 | 1.7 % | ||
| CVE-2020-25717 | samba 4.15.2, samba 4.14.10, samba 4.13.14 | A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privileg | HIGH 8.1 | 1.6 % | ||
| CVE-2016-2124 | samba 4.15.2, samba 4.14.10, samba 4.13.14 | A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent o | MEDIUM 5.9 | 1.8 % | ||
| CVE-2021-3671 | Fixed in samba 4.13.12, samba 4.14.8 | A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). | MEDIUM 6.5 | 2.1 % | ||
| CVE-2020-27840 | samba 4.14.1, samba 4.13.6, samba 4.12.13 | A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings wit | HIGH 7.5 | 3.8 % | ||
| CVE-2021-20277 | samba 4.14.1, samba 4.13.6, samba 4.12.13 | A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, lea | HIGH 7.5 | 4.3 % | ||
| CVE-2021-20254 | samba 4.14.1, samba 4.13.6, samba 4.12.13 | A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that per | MEDIUM 6.8 | 1.6 % | ||
| CVE-2020-14318 | samba 4.11.15, samba 4.12.9, samba 4.13.1 | A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certai | MEDIUM 4.3 | 1.5 % | ||
| CVE-2020-14383 | samba 4.11.15, samba 4.12.9, samba 4.13.1 | A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also se | MEDIUM 6.5 | 2.2 % | ||
| CVE-2020-14323 | All samba versions before 4.11.15, before 4.12.9 and before 4.13.1 | A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local us | MEDIUM 5.5 | 0.6 % | ||
| CVE-2020-10730 | All Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 | A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and | MEDIUM 6.5 | 2.4 % | ||
| CVE-2020-10745 | All Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 | A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. This fl | HIGH 7.5 | 3.9 % | ||
| CVE-2020-10760 | All Samba versions before 4.10.17, 4.11.11, 4.12.4 | A use-after-free flaw was found in all samba LDAP server versions before 4.10.17, before 4.11.11, before 4.12.4 used in a AC DC configuratio | MEDIUM 6.5 | 2.7 % | ||
| CVE-2020-14303 | All Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 | A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an | HIGH 7.5 | 3.5 % |