CVE-2019-14847

A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.9 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 85%
Affected Products (NVD)
VendorProductVersion
sambasamba
4.0.0 ≤
𝑥
< 4.9.15
sambasamba
4.10.0 ≤
𝑥
< 4.10.10
opensuseleap
15.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
samba
bookworm
2:4.17.12+dfsg-0+deb12u1
fixed
bookworm (security)
2:4.17.12+dfsg-0+deb12u1
fixed
bullseye
2:4.13.13+dfsg-1~deb11u6
fixed
bullseye (security)
2:4.13.13+dfsg-1~deb11u6
fixed
jessie
no-dsa
sid
2:4.21.1+dfsg-2
fixed
trixie
2:4.21.1+dfsg-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
samba
bionic
Fixed 2:4.7.6+dfsg~ubuntu-0ubuntu2.13
released
disco
Fixed 2:4.10.0+dfsg-0ubuntu2.6
released
eoan
Fixed 2:4.10.7+dfsg-0ubuntu2.2
released
trusty
Fixed 2:4.3.11+dfsg-0ubuntu0.14.04.20+esm3
released
xenial
Fixed 2:4.3.11+dfsg-0ubuntu0.16.04.23
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
ldb-tools
suse enterprise sap 12 SP5
1.5.8-3.5.1
fixed
suse enterprise server 12 SP5
1.5.8-3.5.1
fixed
libldb1
suse enterprise sap 12 SP5
1.5.8-3.5.1
fixed
suse enterprise server 12 SP5
1.5.8-3.5.1
fixed
libldb1-32bit
suse enterprise sap 12 SP5
1.5.8-3.5.1
fixed
suse enterprise server 12 SP5
1.5.8-3.5.1
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14847
https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKPYHDFI7HRELVXBE5J4MTGSI35AKFBI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3IUACPZJXSC4OM6P2V4IC4QMZQZWPD/
https://www.samba.org/samba/security/CVE-2019-14847.html
https://www.synology.com/security/advisory/Synology_SA_19_35
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14847
https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKPYHDFI7HRELVXBE5J4MTGSI35AKFBI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3IUACPZJXSC4OM6P2V4IC4QMZQZWPD/
https://www.samba.org/samba/security/CVE-2019-14847.html
https://www.synology.com/security/advisory/Synology_SA_19_35