GCVE - cpe:2.3:a:samba:samba:3.4.15:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:samba:samba:3.4.15:*:*:*:*:*:*:*

part: a version: 3.4.15 update: *

Vendor	Samba (`e90b9146-231c-5d4c-abab-30ee379c95a2`)
Product	Samba (`19c5014a-3c29-57af-83eb-c04c4b75a29f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/samba-team/samba`	purl2cpe	2026-06-01 10:11:05.883503
`pkg:gitlab/samba-team/samba`	purl2cpe	2026-06-01 10:11:05.883504
`pkg:samba/samba`	purl2cpe	2026-06-01 10:11:05.883505

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-2115`	vulnerable	2026-06-08 05:07:33.198615	Details available Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.575Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2112`	vulnerable	2026-06-08 05:07:33.184901	Details available The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.593Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2111`	vulnerable	2026-06-08 05:07:33.176810	Details available The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, a related issue to CVE-2015-0005. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.693Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2110`	vulnerable	2026-06-08 05:07:33.106445	Details available The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as demonstrated by clearing the NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN option to disrupt LDAP security. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.577Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://lists.opensuse.org/opensuse-updates/2016-05/msg00124.html http://www.ubuntu.com/usn/USN-2950-1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4408`	vulnerable	2026-06-08 05:04:36.024311	Details available Heap-based buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet. Published: 2013-12-10T02:00:00.000Z Updated: 2024-08-06T16:45:13.383Z Open on db.gcve.eu Reference links http://marc.info/?l=bugtraq&m=141660010015249&w=2 http://www.ubuntu.com/usn/USN-2054-1 http://rhn.redhat.com/errata/RHSA-2013-1805.html http://www.samba.org/samba/security/CVE-2013-4408 http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4124`	vulnerable	2026-06-08 05:04:33.963614	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-0214`	vulnerable	2026-06-08 05:03:45.977685	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-0213`	vulnerable	2026-06-08 05:03:45.949357	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2111`	vulnerable	2026-06-08 05:00:52.870675	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.