Samba 4.2.0 release candidate 4

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:samba:samba:4.2.0:rc4:*:*:*:*:*:*

part: a version: 4.2.0 update: rc4

VendorSamba (e90b9146-231c-5d4c-abab-30ee379c95a2)
ProductSamba (19c5014a-3c29-57af-83eb-c04c4b75a29f)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/samba-team/samba purl2cpe 2026-06-01 10:11:05.922086
pkg:gitlab/samba-team/samba purl2cpe 2026-06-01 10:11:05.922088
pkg:samba/samba purl2cpe 2026-06-01 10:11:05.922089

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2016-2115 vulnerable 2026-06-08 05:07:33.201323 Details available
Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream.
Published: 2016-04-25T00:00:00.000Z
Updated: 2024-08-05T23:17:50.575Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2016-2114 vulnerable 2026-06-08 05:07:33.192726 Details available
The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream.
Published: 2016-04-25T00:00:00.000Z
Updated: 2024-08-05T23:17:50.756Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2016-2113 vulnerable 2026-06-08 05:07:33.190034 Details available
Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate.
Published: 2016-04-25T00:00:00.000Z
Updated: 2024-08-05T23:17:50.580Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2016-2112 vulnerable 2026-06-08 05:07:33.186818 Details available
The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream.
Published: 2016-04-25T00:00:00.000Z
Updated: 2024-08-05T23:17:50.593Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2016-2111 vulnerable 2026-06-08 05:07:33.178893 Details available
The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, a related issue to CVE-2015-0005.
Published: 2016-04-25T00:00:00.000Z
Updated: 2024-08-05T23:17:50.693Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2016-2110 vulnerable 2026-06-08 05:07:33.162838 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2016-0771 vulnerable 2026-06-08 05:07:16.153929 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2015-5370 vulnerable 2026-06-08 05:06:49.905833 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2015-0240 vulnerable 2026-06-08 05:06:14.090038 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.