GCVE - cpe:2.3:a:samba:samba:3.5.19:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:samba:samba:3.5.19:*:*:*:*:*:*:*

part: a version: 3.5.19 update: *

Vendor	Samba (`e90b9146-231c-5d4c-abab-30ee379c95a2`)
Product	Samba (`19c5014a-3c29-57af-83eb-c04c4b75a29f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/samba-team/samba`	purl2cpe	2026-06-01 10:11:05.920851
`pkg:gitlab/samba-team/samba`	purl2cpe	2026-06-01 10:11:05.920853
`pkg:samba/samba`	purl2cpe	2026-06-01 10:11:05.920854

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-2115`	vulnerable	2026-06-08 05:07:33.198959	Details available Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.575Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2112`	vulnerable	2026-06-08 05:07:33.185255	Details available The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.593Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2111`	vulnerable	2026-06-08 05:07:33.177186	Details available The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, a related issue to CVE-2015-0005. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.693Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://www.ubuntu.com/usn/USN-2950-1 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-2110`	vulnerable	2026-06-08 05:07:33.119412	Details available The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as demonstrated by clearing the NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN option to disrupt LDAP security. Published: 2016-04-25T00:00:00.000Z Updated: 2024-08-05T23:17:50.577Z Open on db.gcve.eu Reference links http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2016-0612.html http://lists.opensuse.org/opensuse-updates/2016-05/msg00124.html http://www.ubuntu.com/usn/USN-2950-1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-0240`	vulnerable	2026-06-08 05:06:14.072180	Details available The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c. Published: 2015-02-24T01:00:00.000Z Updated: 2025-05-09T20:03:27.070Z Open on db.gcve.eu Reference links http://marc.info/?l=bugtraq&m=143039217203031&w=2 http://rhn.redhat.com/errata/RHSA-2015-0257.html http://rhn.redhat.com/errata/RHSA-2015-0254.html https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-0240/ http://advisories.mageia.org/MGASA-2015-0084.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4408`	vulnerable	2026-06-08 05:04:36.041319	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4124`	vulnerable	2026-06-08 05:04:33.971393	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-0214`	vulnerable	2026-06-08 05:03:45.978271	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-0213`	vulnerable	2026-06-08 05:03:45.962606	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.