GCVE - cpe:2.3:a:samba:samba:4.2.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:samba:samba:4.2.1:*:*:*:*:*:*:*

part: a version: 4.2.1 update: *

Vendor	Samba (`e90b9146-231c-5d4c-abab-30ee379c95a2`)
Product	Samba (`19c5014a-3c29-57af-83eb-c04c4b75a29f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/samba-team/samba`	purl2cpe	2026-06-01 10:11:05.922090
`pkg:gitlab/samba-team/samba`	purl2cpe	2026-06-01 10:11:05.922092
`pkg:samba/samba`	purl2cpe	2026-06-01 10:11:05.922093

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-2115`	vulnerable	2026-06-08 05:07:33.201340	Details available Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.575Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2114`	vulnerable	2026-06-08 05:07:33.192745	Details available The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.756Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://www.securityfocus.com/bid/86011 http://badlock.org/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2113`	vulnerable	2026-06-08 05:07:33.190050	Details available Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.580Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2112`	vulnerable	2026-06-08 05:07:33.186835	Details available The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.593Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2111`	vulnerable	2026-06-08 05:07:33.178909	Details available The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, a related issue to CVE-2015-0005. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.693Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2110`	vulnerable	2026-06-08 05:07:33.163385	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-0771`	vulnerable	2026-06-08 05:07:16.154430	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5370`	vulnerable	2026-06-08 05:06:49.905875	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5330`	vulnerable	2026-06-08 05:06:49.613852	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3223`	vulnerable	2026-06-08 05:06:37.651875	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.