GCVE - cpe:2.3:a:samba:samba:4.3.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:samba:samba:4.3.2:*:*:*:*:*:*:*

part: a version: 4.3.2 update: *

Vendor	Samba (`e90b9146-231c-5d4c-abab-30ee379c95a2`)
Product	Samba (`19c5014a-3c29-57af-83eb-c04c4b75a29f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/samba-team/samba`	purl2cpe	2026-06-01 10:11:05.922294
`pkg:gitlab/samba-team/samba`	purl2cpe	2026-06-01 10:11:05.922296
`pkg:samba/samba`	purl2cpe	2026-06-01 10:11:05.922297

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-2115`	vulnerable	2026-06-08 05:07:33.201517	Details available Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.575Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2114`	vulnerable	2026-06-08 05:07:33.192922	Details available The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.756Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://www.securityfocus.com/bid/86011 http://badlock.org/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2113`	vulnerable	2026-06-08 05:07:33.190229	Details available Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.580Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2112`	vulnerable	2026-06-08 05:07:33.187306	Details available The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.593Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2111`	vulnerable	2026-06-08 05:07:33.179276	Details available The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, a related issue to CVE-2015-0005. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.693Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2110`	vulnerable	2026-06-08 05:07:33.169053	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-0771`	vulnerable	2026-06-08 05:07:16.159366	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5370`	vulnerable	2026-06-08 05:06:49.908686	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5330`	vulnerable	2026-06-08 05:06:49.617817	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3223`	vulnerable	2026-06-08 05:06:37.655783	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.