history/security.html

   1 <!--#include virtual="/samba/header.html" -->
   2   <title>Samba - Security Updates and Information</title>
   3 <!--#include virtual="header_history.html" -->
   4
   5 <h2>Samba Security Releases</h2>
   6
   7     <p>Security releases for Samba are listed below by their release
   8 date. The previously affected versions of Samba are listed alongside
   9 the appropriate security concern. For complete information, follow the
  10 link to full release notes for each release.</p>
  11
  12
  13     <table class="security_table">
  14       <th colspan="6">Samba Security Releases</th>
  15       <tr >
  16         <td><em>Date Issued</em></td>
  17         <td><em>Download</em></td>
  18         <td><em>Known Issue(s)</em></td>
  19         <td><em>Affected Releases</em></td>
  20         <td><em>CVE ID #</em></td>
  21         <td><em>Details</em></td>
  22       </tr>
  23
  24     <tr>
  25         <td>20 Sep 2017</td>
  26         <td><a href="/samba/ftp/patches/security/samba-4.6.7-security-2017-09-20.patch">
  27         patch for Samba 4.6.7</a><br />
  28         <a href="/samba/ftp/patches/security/samba-4.5.13-security-2017-09-20.patch">
  29         patch for Samba 4.5.13</a><br />
  30         <a href="/samba/ftp/patches/security/samba-4.4.15-security-2017-09-20.patch">
  31         patch for Samba 4.4.15</a><br />
  32         <td>Numerous CVEs. Please see the announcements for details.
  33         </td>
  34         <td>please refer to the advisories</td>
  35         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12150">CVE-2017-12150</a>,
  36             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12151">CVE-2017-12151</a>,
  37             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12163">CVE-2017-12163</a>
  38         </td>
  39         <td><a href="/samba/security/CVE-2017-12150.html">Announcement</a>,
  40             <a href="/samba/security/CVE-2017-12151.html">Announcement</a>,
  41             <a href="/samba/security/CVE-2017-12163.html">Announcement</a>
  42         </td>
  43     </tr>
  44
  45     <tr>
  46         <td>12 July 2017</td>
  47         <td><a href="/samba/ftp/patches/security/samba-4.x.y-CVE-2017-11103.patch">
  48         patch for Samba 4.x.y</a><br />
  49         <td>Orpheus&apos; Lyre mutual authentication validation bypass.
  50         </td>
  51         <td>All versions between Samba 4.0.0 and 4.6.6/4.5.12/4.4.15</td>
  52         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11103">CVE-2017-11103</a>
  53         </td>
  54         <td><a href="/samba/security/CVE-2017-11103.html">Announcement</a>
  55         </td>
  56     </tr>
  57
  58     <tr>
  59         <td>24 May 2017</td>
  60         <td><a href="/samba/ftp/patches/security/samba-4.6.3-4.5.9-4.4.13-CVE-2017-7494.patch">
  61         patch for Samba 4.6.3, 4.5.9, 4.4.13</a><br />
  62         <td>Remote code execution from a writable share.
  63         </td>
  64         <td>All versions between Samba 3.5.0 and 4.6.4/4.5.10/4.4.14</td>
  65         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7494">CVE-2017-7494</a>
  66         </td>
  67         <td><a href="/samba/security/CVE-2017-7494.html">Announcement</a>
  68         </td>
  69     </tr>
  70
  71     <tr>
  72         <td>23 Mar 2017</td>
  73         <td><a href="/samba/ftp/patches/security/samba-4.6.0-CVE-2017-2619.patch">
  74         patch for Samba 4.6.0</a><br />
  75         <a href="/samba/ftp/patches/security/samba-4.5.6-CVE-2017-2619.patch">
  76         patch for Samba 4.5.6</a><br />
  77         <a href="/samba/ftp/patches/security/samba-4.4.11-CVE-2017-2619.patch">
  78         patch for Samba 4.4.11</a><br />
  79         <td>Symlink race allows access outside share definition.
  80         </td>
  81         <td>All versions of Samba prior to 4.6.1, 4.5.7, 4.4.12</td>
  82         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2619">CVE-2017-2619</a>
  83         </td>
  84         <td><a href="/samba/security/CVE-2017-2619.html">Announcement</a>
  85         </td>
  86     </tr>
  87
  88     <tr>
  89         <td>19 Dec 2016</td>
  90         <td><a href="/samba/ftp/patches/security/samba-4.5.2-security-20016-12-19.patch">
  91         patch for Samba 4.5.2</a><br />
  92         <a href="/samba/ftp/patches/security/samba-4.4.7-security-20016-12-19.patch">
  93         patch for Samba 4.4.7</a><br />
  94         <a href="/samba/ftp/patches/security/samba-4.3.12-security-20016-12-19.patch">
  95         patch for Samba 4.3.12</a><br />
  96         <td>Numerous CVEs. Please see the announcements for details.
  97         </td>
  98         <td>please refer to the advisories</td>
  99         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2123">CVE-2016-2123</a>,
 100             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2125">CVE-2016-2125</a>,
 101             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2126">CVE-2016-2126</a>
 102         </td>
 103         <td><a href="/samba/security/CVE-2016-2123.html">Announcement</a>,
 104             <a href="/samba/security/CVE-2016-2125.html">Announcement</a>,
 105             <a href="/samba/security/CVE-2016-2126.html">Announcement</a>
 106         </td>
 107     </tr>
 108
 109     <tr>
 110         <td>07 Jul 2016</td>
 111         <td><a href="/samba/ftp/patches/security/samba-4.4.4-CVE-2016-2119.patch">
 112         patch for Samba 4.4.4</a><br />
 113         <a href="/samba/ftp/patches/security/samba-4.3.10-CVE-2016-2119.patch">
 114         patch for Samba 4.3.10</a><br />
 115         <a href="/samba/ftp/patches/security/samba-4.2.13-CVE-2016-2119.patch">
 116         patch for Samba 4.2.13</a><br />
 117         <td>Client side SMB2/3 required signing can be downgraded.
 118         </td>
 119         <td>4.0.0 - 4.4.4</td>
 120         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2119">CVE-2016-2119</a>
 121         </td>
 122         <td><a href="/samba/security/CVE-2016-2119.html">Announcement</a>
 123         </td>
 124     </tr>
 125
 126     <tr>
 127         <td>12 Apr 2016</td>
 128         <td><a href="/samba/ftp/patches/security/samba-4.4.0-security-2016-04-12-final.patch">
 129         patch for Samba 4.4.0</a><br />
 130         <a href="/samba/ftp/patches/security/samba-4.3.6-security-2016-04-12-final.patch">
 131         patch for Samba 4.3.6</a><br />
 132         <a href="/samba/ftp/patches/security/samba-4.2.9-security-2016-04-12-final.patch">
 133         patch for Samba 4.2.9</a><br />
 134         <a href="/samba/ftp/patches/security/samba-v4-0-security-2016-04-12-fileserver-only.patch.xz">
 135         patch for Samba 4.0.26 (fileserver only! no client! no domain controller!)</a><br />
 136         <a href="/samba/ftp/patches/security/samba-v3-6-security-2016-04-12.tar.xz">
 137         patch for Samba 3.6.25 (only related CVEs)</a><br />
 138         <td>Numerous CVEs. Please see the announcements for details.
 139         </td>
 140         <td>please refer to the advisories</td>
 141         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370">CVE-2015-5370</a>,
 142             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110">CVE-2016-2110</a>,
 143             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111">CVE-2016-2111</a>,
 144             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112">CVE-2016-2112</a>,
 145             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113">CVE-2016-2113</a>,
 146             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114">CVE-2016-2114</a>,
 147             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115">CVE-2016-2115</a>,
 148             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118">CVE-2016-2118</a>
 149         </td>
 150         <td><a href="/samba/security/CVE-2015-5370.html">Announcement</a>
 151             <a href="/samba/security/CVE-2016-2110.html">Announcement</a>
 152             <a href="/samba/security/CVE-2016-2111.html">Announcement</a>
 153             <a href="/samba/security/CVE-2016-2112.html">Announcement</a>
 154             <a href="/samba/security/CVE-2016-2113.html">Announcement</a>
 155             <a href="/samba/security/CVE-2016-2114.html">Announcement</a>
 156             <a href="/samba/security/CVE-2016-2115.html">Announcement</a>
 157             <a href="/samba/security/CVE-2016-2118.html">Announcement</a>
 158         </td>
 159     </tr>
 160
 161     <tr>
 162         <td>08 Mar 2016</td>
 163         <td><a href="/samba/ftp/patches/security/samba-4.3.5-security-2016-03-08.patch">
 164         patch for Samba 4.3.5</a><br />
 165         <a href="/samba/ftp/patches/security/samba-4.2.8-security-2016-03-08.patch">
 166         patch for Samba 4.2.8</a><br />
 167         <a href="/samba/ftp/patches/security/samba-4.1.22-security-2016-03-08.patch">
 168         patch for Samba 4.1.22</a><br />
 169         <td>Incorrect ACL get/set allowed on symlink path, Out-of-bounds read in internal DNS server.
 170         </td>
 171         <td>please refer to the advisories</td>
 172         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7560">CVE-2015-7560</a>,
 173             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0771">CVE-2016-0771</a>,
 174         </td>
 175         <td><a href="/samba/security/CVE-2015-7560.html">Announcement</a>
 176             <a href="/samba/security/CVE-2016-0771.html">Announcement</a>
 177         </td>
 178     </tr>
 179
 180     <tr>
 181         <td>16 Dec 2015</td>
 182         <td><a href="/samba/ftp/patches/security/samba-4.3.2-security-2015-12-16.patch">
 183         patch for Samba 4.3.2</a><br />
 184         <a href="/samba/ftp/patches/security/samba-4.2.6-security-2015-12-16.patch">
 185         patch for Samba 4.2.6</a><br />
 186         <a href="/samba/ftp/patches/security/samba-4.1.21-security-2015-12-16.patch">
 187         patch for Samba 4.1.21</a><br />
 188         <a href="/samba/ftp/patches/security/samba-3.6.25-security-2015-12-16.patch">
 189         patch for Samba 3.6.25</a><br />
 190         <td>Numerous CVEs. Please see the announcements for details.
 191         </td>
 192         <td>3.0.0 to 4.3.2</td>
 193         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3223">CVE-2015-3223</a>,
 194             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252">CVE-2015-5252</a>,
 195             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5296">CVE-2015-5296</a>,
 196             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299">CVE-2015-5299</a>,
 197             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330">CVE-2015-5330</a>,
 198             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7540">CVE-2015-7540</a>,
 199             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467">CVE-2015-8467</a>
 200         </td>
 201         <td><a href="/samba/security/CVE-2015-3223.html">Announcement</a>
 202             <a href="/samba/security/CVE-2015-5252.html">Announcement</a>
 203             <a href="/samba/security/CVE-2015-5296.html">Announcement</a>
 204             <a href="/samba/security/CVE-2015-5299.html">Announcement</a>
 205             <a href="/samba/security/CVE-2015-5330.html">Announcement</a>
 206             <a href="/samba/security/CVE-2015-7540.html">Announcement</a>
 207             <a href="/samba/security/CVE-2015-8467.html">Announcement</a>
 208         </td>
 209     </tr>
 210
 211     <tr>
 212         <td>23 Feb 2015</td>
 213         <td><a href="/samba/ftp/patches/security/samba-4.1.16-CVE-2015-0240.patch">
 214         patch for Samba 4.1.16</a><br />
 215         <a href="/samba/ftp/patches/security/samba-4.0.24-CVE-2015-0240.patch">
 216         patch for Samba 4.0.24</a><br />
 217         <a href="/samba/ftp/patches/security/samba-3.6.24-CVE-2015-0240.patch">
 218         patch for Samba 3.6.24</a><br />
 219         <a href="/samba/ftp/patches/security/samba-3.5.22-CVE-2015-0240.patch">
 220         patch for Samba 3.5.22</a><br />
 221         <td>Unexpected code execution in smbd.
 222         </td>
 223         <td>3.5.0 - 4.2.0rc4</td>
 224         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0240">CVE-2015-0240</a>
 225         </td>
 226         <td><a href="/samba/security/CVE-2015-0240.html">Announcement</a>
 227         </td>
 228     </tr>
 229
 230     <tr>
 231         <td>15 Jan 2015</td>
 232         <td><a href="/samba/ftp/patches/security/samba-4.1.15-CVE-2014-8143.patch">
 233         patch for Samba 4.1.15</a><br />
 234         <a href="/samba/ftp/patches/security/samba-4.0.23-CVE-2014-8143.patch">
 235         patch for Samba 4.0.23</a><br />
 236         <td>Elevation of privilege to Active Directory Domain Controller.
 237         </td>
 238         <td>4.0.0 - 4.1.15</td>
 239         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8143">CVE-2014-8143</a>
 240         </td>
 241         <td><a href="/samba/security/CVE-2014-8143.html">Announcement</a>
 242         </td>
 243     </tr>
 244
 245     <tr>
 246         <td>01 Aug 2014</td>
 247         <td><a href="/samba/ftp/patches/security/samba-4.1.10-CVE-2014-3560.patch">
 248         patch for Samba 4.1.10</a><br />
 249         <a href="/samba/ftp/patches/security/samba-4.0.20-CVE-2014-3560.patch">
 250         patch for Samba 4.0.20</a><br />
 251         <td>Remote code execution in nmbd.
 252         </td>
 253         <td>4.0.0 - 4.1.10</td>
 254         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3560">CVE-2014-3560</a>
 255         </td>
 256         <td><a href="/samba/security/CVE-2014-3560.html">Announcement</a>
 257         </td>
 258     </tr>
 259
 260     <tr>
 261         <td>23 Jun 2014</td>
 262         <td><a href="/samba/ftp/patches/security/samba-4.1.8-CVE-2014-0244-CVE-2014-3493.patch">
 263         patch for Samba 4.1.8</a><br />
 264         <a href="/samba/ftp/patches/security/samba-4.0.18-CVE-2014-0244-CVE-2014-3493.patch">
 265         patch for Samba 4.0.18</a><br />
 266         <a href="/samba/ftp/patches/security/samba-3.6.23-CVE-2014-0244-CVE-2014-3493.patch">
 267         patch for Samba 3.6.23</a><br />
 268         <td>Denial of service - CPU loop, Denial of service - Server crash/memory corruption.
 269         </td>
 270         <td>please refer to the advisories</td>
 271         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0244">CVE-2014-0244</a>,
 272             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3493">CVE-2014-3493</a>
 273         </td>
 274         <td><a href="/samba/security/CVE-2014-0244.html">Announcement</a>
 275             <a href="/samba/security/CVE-2014-3493.html">Announcement</a>
 276         </td>
 277     </tr>
 278
 279     <tr>
 280         <td>03 June 2014</td>
 281         <td><a href="/samba/ftp/patches/security/samba-4.0.17-CVE-2014-0178-CVE-2014-0239.patch">
 282         patch for Samba 4.0.17</a><br />
 283         <a href="/samba/ftp/patches/security/samba-4.1.7-CVE-2014-0178-CVE-2014-0239.patch">
 284         patch for Samba 4.1.7</a><br />
 285         <a href="/samba/ftp/patches/security/samba-3.6.23-CVE-2014-0178.patch">
 286         patch for Samba 3.6.23 (CVE-2014-0178 only)</a><br />
 287         <td>Uninitialized memory exposure, Potential DOS in Samba internal DNS server.
 288         </td>
 289         <td>please refer to the advisories</td>
 290         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0178">CVE-2014-0178</a>,
 291             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0239">CVE-2014-0239</a>
 292         </td>
 293         <td><a href="/samba/security/CVE-2014-0178.html">Announcement</a>
 294             <a href="/samba/security/CVE-2014-0239.html">Announcement</a>
 295         </td>
 296     </tr>
 297
 298     <tr>
 299         <td>11 Mar 2014</td>
 300         <td><a href="/samba/ftp/patches/security/samba-4.1.5-CVE-2013-4496-CVE-2013-6442.patch">
 301         patch for Samba 4.1.5</a><br />
 302         <a href="/samba/ftp/patches/security/samba-4.0.15-CVE-2013-4496-CVE-2013-6442.patch">
 303         patch for Samba 4.0.15</a><br />
 304         <a href="/samba/ftp/patches/security/samba-3.6.22-CVE-2013-4496.patch">
 305         patch for Samba 3.6.22</a><br />
 306         <td>Password lockout not enforced for SAMR password changes, smbcacls can remove a file
 307         or directory ACL by mistake.
 308         </td>
 309         <td>please refer to the advisories</td>
 310         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4496">CVE-2013-4496</a>,
 311             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6442">CVE-2013-6442</a>
 312         </td>
 313         <td><a href="/samba/security/CVE-2013-4496.html">Announcement</a>
 314             <a href="/samba/security/CVE-2013-6442.html">Announcement</a>
 315         </td>
 316     </tr>
 317
 318     <tr>
 319         <td>09 Dec 2013</td>
 320         <td><a href="/samba/ftp/patches/security/samba-4.1.2-CVE-2013-4408-CVE-2012-6150.patch">
 321         patch for Samba 4.1.2</a><br />
 322         <a href="/samba/ftp/patches/security/samba-4.0.12-CVE-2013-4408-CVE-2012-6150.patch">
 323         patch for Samba 4.0.12</a><br />
 324         <a href="/samba/ftp/patches/security/samba-3.6.21-CVE-2013-4408-CVE-2012-6150.patch">
 325         patch for Samba 3.6.21</a><br />
 326         <a href="/samba/ftp/patches/security/samba-3.5.22-CVE-2013-4408.patch">
 327         patch for Samba 3.5.22</a><br />
 328         <a href="/samba/ftp/patches/security/samba-3.4.17-CVE-2013-4408.patch">
 329         patch for Samba 3.4.17</a>
 330         <td>DCE-RPC fragment length field is incorrectly checked, pam_winbind
 331         login without require_membership_of restrictions.</td>
 332         <td>please refer to the advisories</td>
 333         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4408">CVE-2013-4408</a>,
 334             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6150">CVE-2012-6150</a>
 335         </td>
 336         <td><a href="/samba/security/CVE-2013-4408.html">Announcement</a>
 337             <a href="/samba/security/CVE-2012-6150.html">Announcement</a>
 338         </td>
 339     </tr>
 340
 341     <tr>
 342         <td>11 Nov 2013</td>
 343         <td><a href="/samba/ftp/patches/security/samba-4.1.0-CVE-2013-4475-CVE-2013-4476.patch">
 344         patch for Samba 4.1.0</a><br />
 345         <a href="/samba/ftp/patches/security/samba-4.0.10-CVE-2013-4475-CVE-2013-4476.patch">
 346         patch for Samba 4.0.10</a><br />
 347         <a href="/samba/ftp/patches/security/samba-3.6.19-CVE-2013-4475.patch">
 348         patch for Samba 3.6.19</a><br />
 349         <td>ACLs are not checked on opening an alternate data stream on a file
 350             or directory, Private key in key.pem world readable.</td>
 351         <td>3.2.0 - 4.1.0, 4.0.0 - 4.0.10, 4.1.0</td>
 352         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4475">CVE-2013-4475</a>,
 353             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4476">CVE-2013-4476</a>
 354         </td>
 355         <td><a href="/samba/security/CVE-2013-4475.html">Announcement</a>
 356             <a href="/samba/security/CVE-2013-4476.html">Announcement</a>
 357         </td>
 358     </tr>
 359
 360     <tr>
 361         <td>05 Aug 2013</td>
 362         <td><a href="/samba/ftp/patches/security/samba-4.0.7-CVE-2013-4124.patch">
 363         patch for Samba 4.0.7</a><br />
 364         <a href="/samba/ftp/patches/security/samba-3.6.16-CVE-2013-4124.patch">
 365         patch for Samba 3.6.16</a><br />
 366         <a href="/samba/ftp/patches/security/samba-3.5.21-CVE-2013-4124.patch">
 367         patch for Samba 3.5.21</a><br />
 368         <td>Denial of service - CPU loop and memory allocation.</td>
 369         <td>3.0.x-4.0.7</td>
 370         <td><a
 371         href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4124">CVE-2013-4124</a>
 372         </td>
 373         <td><a href="/samba/security/CVE-2013-4124.html">Announcement</a>
 374         </td>
 375     </tr>
 376
 377     <tr>
 378         <td>02 Apr 2013</td>
 379         <td><a href="/samba/ftp/patches/security/samba-3.6-CVE-2013-0454.patch">
 380         patch for Samba 3.6.5</a>
 381         <td>A writable configured share might get read only</td>
 382         <td>3.6.0 - 3.6.5 (inclusive)</td>
 383         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0454">CVE-2013-0454</a>
 384         </td>
 385         <td><a href="/samba/security/CVE-2013-0454.html">Announcement</a>
 386         </td>
 387     </tr>
 388
 389     <tr>
 390         <td>19 Mar 2013</td>
 391         <td><a href="/samba/ftp/patches/security/samba-4.0.3-CVE-2013-1863.patch">
 392         patch for Samba 4.0.3</a>
 393         <td>World-writeable files may be created in additional shares on a Samba
 394         4.0 AD DC.</td>
 395         <td>4.0.0rc6-4.0.3</td>
 396         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1863">CVE-2013-1863</a>
 397         </td>
 398         <td><a href="/samba/security/CVE-2013-1863.html">Announcement</a>
 399         </td>
 400     </tr>
 401
 402     <tr>
 403         <td>30 Jan 2013</td>
 404         <td><a href="/samba/ftp/patches/security/samba-4.0.1-CVE-2013-0213-CVE-2013-0214.patch">
 405         patch for Samba 4.0.1</a><br />
 406         <a href="/samba/ftp/patches/security/samba-3.6.11-CVE-2013-0213-CVE-2013-0214.patch">
 407         patch for Samba 3.6.11</a><br />
 408         <a href="/samba/ftp/patches/security/samba-3.5.20-CVE-2013-0213-CVE-2013-0214.patch">
 409         patch for Samba 3.5.20</a><br />
 410         <td>Clickjacking issue and potential XSRF in SWAT.</td>
 411         <td>3.0.x-4.0.1</td>
 412         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0213">CVE-2013-0213</a>,
 413             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0214">CVE-2013-0214</a>
 414         </td>
 415         <td><a href="/samba/security/CVE-2013-0213.html">Announcement</a>
 416             <a href="/samba/security/CVE-2013-0214.html">Announcement</a>
 417         </td>
 418     </tr>
 419
 420     <tr>
 421         <td>15 Jan 2013</td>
 422         <td><a href="/samba/ftp/patches/security/samba-4.0.0-CVE-2013-0172.patch">
 423         patch for Samba 4.0.0</a>
 424         <td>Samba 4.0 as an AD DC may provide authenticated users with write
 425         access to LDAP directory objects.</td>
 426         <td>4.0.0</td>
 427         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0172">CVE-2013-0172</a></td>
 428         <td><a href="/samba/security/CVE-2013-0172.html">Announcement</a></td>
 429     </tr>
 430
 431     <tr>
 432         <td>30 Apr 2012</td>
 433         <td><a href="/samba/ftp/patches/security/samba-3.4.16-CVE-2012-2111.patch">
 434         patch for Samba 3.4.16</a><br />
 435         <a href="/samba/ftp/patches/security/samba-3.5.14-CVE-2012-2111.patch">
 436         patch for Samba 3.5.14</a><br />
 437         <a href="/samba/ftp/patches/security/samba-3.6.4-CVE-2012-2111.patch">
 438         patch for Samba 3.6.4</a><br />
 439         <td>Incorrect permission checks when granting/removing privileges can
 440         compromise file server security.</td>
 441         <td>3.4.x-3.6.4</td>
 442         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2111">CVE-2012-2111</a></td>
 443         <td><a href="/samba/security/CVE-2012-2111.html">Announcement</a></td>
 444     </tr>
 445
 446     <tr>
 447         <td>10 Apr 2012</td>
 448         <td><a href="/samba/ftp/patches/security/samba-3.0.37-CVE-2012-1182.patch">
 449         patch for Samba 3.0.37</a><br />
 450         <a href="/samba/ftp/patches/security/samba-3.2.15-CVE-2012-1182.patch">
 451         patch for Samba 3.2.15</a><br />
 452         <a href="/samba/ftp/patches/security/samba-3.3.16-CVE-2012-1182.patch">
 453         patch for Samba 3.3.16</a><br />
 454         <a href="/samba/ftp/patches/security/samba-3.4.15-CVE-2012-1182.patch">
 455         patch for Samba 3.4.15</a><br />
 456         <a href="/samba/ftp/patches/security/samba-3.5.13-CVE-2012-1182.patch">
 457         patch for Samba 3.5.13</a><br />
 458         <a href="/samba/ftp/patches/security/samba-3.6.3-CVE-2012-1182.patch">
 459         patch for Samba 3.6.3</a><br />
 460         <td>"root" credential remote code execution</td>
 461         <td>all current releases</td>
 462         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1182">CVE-2012-1182</a></td>
 463         <td><a href="/samba/security/CVE-2012-1182.html">Announcement</a></td>
 464     </tr>
 465
 466     <tr>
 467         <td>23 Feb 2012</td>
 468         <td><a href="/samba/ftp/patches/security/samba-3.0-CVE-2012-0870.patch">
 469         patch for Samba 3.0</a><br />
 470         <a href="/samba/ftp/patches/security/samba-3.2-CVE-2012-0870.patch">
 471         patch for Samba 3.2</a><br />
 472         <a href="/samba/ftp/patches/security/samba-3.3-CVE-2012-0870.patch">
 473         patch for Samba 3.3</a><br />
 474         <td>Remote code execution vulnerability in smbd</td>
 475         <td>pre-3.4</td>
 476         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0870">CVE-2012-0870</a></td>
 477         <td><a href="/samba/security/CVE-2012-0870.html">Announcement</a></td>
 478     </tr>
 479
 480     <tr>
 481         <td>29 Jan 2012</td>
 482         <td><a href="/samba/ftp/patches/security/samba-3.6.2-CVE-2012-0817.patch">
 483         patch for Samba 3.6.2</a>
 484         <td>Memory leak/Denial of service</td>
 485         <td>3.6.0-3.6.2</td>
 486         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0817">CVE-2012-0817</a></td>
 487         <td><a href="/samba/security/CVE-2012-0817.html">Announcement</a></td>
 488     </tr>
 489
 490     <tr>
 491         <td>26 Jul 2011</td>
 492         <td><a href="/samba/ftp/patches/security/samba-3.3.15-CVE-2011-2522.patch">
 493         patch for Samba 3.3.15</a><br />
 494         <a href="/samba/ftp/patches/security/samba-3.4.13-CVE-2011-2522.patch">
 495         patch for Samba 3.4.13</a><br />
 496         <a href="/samba/ftp/patches/security/samba-3.5.9-CVE-2011-2522.patch">
 497         patch for Samba 3.5.9</a><br />
 498         <td>Cross-Site Request Forgery in SWAT</td>
 499         <td>all current releases</td>
 500         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2522">CVE-2011-2522</a></td>
 501         <td><a href="/samba/security/CVE-2011-2522.html">Announcement</a></td>
 502     </tr>
 503
 504     <tr>
 505         <td>26 Jul 2011</td>
 506         <td><a href="/samba/ftp/patches/security/samba-3.3.15-CVE-2011-2694.patch">
 507         patch for Samba 3.3.15</a><br />
 508         <a href="/samba/ftp/patches/security/samba-3.4.13-CVE-2011-2694.patch">
 509         patch for Samba 3.4.13</a><br />
 510         <a href="/samba/ftp/patches/security/samba-3.5.9-CVE-2011-2694.patch">
 511         patch for Samba 3.5.9</a><br />
 512         <td>Cross-Site Scripting vulnerability in SWAT</td>
 513         <td>all current releases</td>
 514         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2694">CVE-2011-2694</a></td>
 515         <td><a href="/samba/security/CVE-2011-2694.html">Announcement</a></td>
 516     </tr>
 517
 518     <tr>
 519         <td>18 Feb 2011</td>
 520         <td><a href="/samba/ftp/patches/security/samba-3.3.14-CVE-2011-0719.patch">
 521         patch for Samba 3.3.14</a><br />
 522         <a href="/samba/ftp/patches/security/samba-3.4.11-CVE-2011-0719.patch">
 523         patch for Samba 3.4.11</a><br />
 524         <a href="/samba/ftp/patches/security/samba-3.5.6-CVE-2011-0719.patch">
 525         patch for Samba 3.5.6</a><br />
 526         <td>Denial of service - memory corruption</td>
 527         <td>all current releases</td>
 528         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0719">CVE-2011-0719</a></td>
 529         <td><a href="/samba/security/CVE-2011-0719.html">Announcement</a></td>
 530     </tr>
 531
 532     <tr>
 533         <td>14 Sep 2010</td>
 534         <td><a href="/samba/ftp/patches/security/samba-3.3.13-CVE-2010-3069.patch">
 535         patch for Samba 3.3.13</a><br />
 536         <a href="/samba/ftp/patches/security/samba-3.4.8-CVE-2010-3069.patch">
 537         patch for Samba 3.4.8</a><br />
 538         <a href="/samba/ftp/patches/security/samba-3.5.4-CVE-2010-3069.patch">
 539         patch for Samba 3.5.4</a><br />
 540         <td>Buffer Overrun Vulnerability</td>
 541         <td>all current releases</td>
 542         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3069">CVE-2010-3069</a></td>
 543         <td><a href="/samba/security/CVE-2010-3069.html">Announcement</a></td>
 544     </tr>
 545
 546     <tr>
 547         <td>16 Jun 2010</td>
 548         <td><a href="/samba/ftp/patches/security/samba-3.3.12-CVE-2010-2063.patch">
 549         patch for Samba 3.3.12 and 3.2.15</a><br />
 550         <a href="/samba/ftp/patches/security/samba-3.0.37-CVE-2010-2063.patch">
 551         patch for Samba 3.0.37</a><br />
 552         <td>Memory Corruption Vulnerability</td>
 553         <td>3.0.x, 3.2.x, 3.3.0-3.3.12</td>
 554         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-CVE-2010-2063">CVE-2010-2063</a></td>
 555         <td><a href="/samba/security/CVE-2010-2063.html">Announcement</a></td>
 556     </tr>
 557
 558     <tr>
 559         <td>08 Mar 2010</td>
 560         <td><a href="/samba/ftp/patches/security/samba-3.5.0-CVE-2010-0728.patch">
 561         patch for Samba 3.5.0</a><br />
 562         <a href="/samba/ftp/patches/security/samba-3.4.6-CVE-2010-0728.patch">
 563         patch for Samba 3.4.6</a><br />
 564         <a href="/samba/ftp/patches/security/samba-3.3.11-CVE-2010-0728.patch">
 565         patch for Samba 3.3.11</a><br />
 566         <td>Permission ignored</td>
 567         <td>3.3.11, 3.4.6, 3.5.0</td>
 568         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0728">CVE-2010-0728</a></td>
 569         <td><a href="/samba/security/CVE-2010-0728.html">Announcement</a></td>
 570     </tr>
 571
 572     <tr>
 573         <td>02 Feb 2010</td>
 574                   <td>not available</td>
 575         <td>Change parameter "wide links" to default to "no"</td>
 576         <td>pre-3.4.6</td>
 577         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0926">CVE-2010-0926</a></td>
 578         <td><a href="/samba/security/CVE-2010-0926.html">Announcement</a></td>
 579     </tr>
 580
 581     <tr>
 582         <td>01 Oct 2009</td>
 583         <td><a href="/samba/ftp/patches/security/samba-3.4.1-CVE-2009-2948-1.patch">
 584         patch 1 for Samba 3.4.1</a>
 585         <a href="/samba/ftp/patches/security/samba-3.4.1-CVE-2009-2948-2.patch">
 586         patch 2 for Samba 3.4.1</a>
 587         <a href="/samba/ftp/patches/security/samba-3.3.7-CVE-2009-2948-1.patch">
 588         patch 1 for Samba 3.3.7</a>
 589         <a href="/samba/ftp/patches/security/samba-3.3.7-CVE-2009-2948-2.patch">
 590         patch 2 for Samba 3.3.7</a>
 591         <a href="/samba/ftp/patches/security/samba-3.2.14-CVE-2009-2948-1.patch">
 592         patch 1 for Samba 3.2.14</a>
 593         <a href="/samba/ftp/patches/security/samba-3.2.14-CVE-2009-2948-2.patch">
 594         patch 2 for Samba 3.2.14</a>
 595         <a href="/samba/ftp/patches/security/samba-3.0.36-CVE-2009-2948-1.patch">
 596         patch 1 for Samba 3.0.36</a>
 597         <a href="/samba/ftp/patches/security/samba-3.0.36-CVE-2009-2948-2.patch">
 598         patch 2 for Samba 3.0.36</a>
 599         <td>Information disclosure by setuid mount.cifs</td>
 600         <td>all releases</td>
 601         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2906">CVE-2009-2948</a></td>
 602         <td><a href="/samba/security/CVE-2009-2948.html">Announcement</a></td>
 603     </tr>
 604
 605     <tr>
 606         <td>01 Oct 2009</td>
 607         <td><a href="/samba/ftp/patches/security/samba-3.4.1-CVE-2009-2906.patch">
 608         patch for Samba 3.4.1</a><br />
 609         <a href="/samba/ftp/patches/security/samba-3.3.7-CVE-2009-2906.patch">
 610         patch for Samba 3.3.7</a><br />
 611         <a href="/samba/ftp/patches/security/samba-3.2.14-CVE-2009-2906.patch">
 612         patch for Samba 3.2.14</a><br />
 613         <a href="/samba/ftp/patches/security/samba-3.0.36-CVE-2009-2906.patch">
 614         patch for Samba 3.0.36</a><br />
 615         <td>Remote DoS against smbd on authenticated connections</td>
 616         <td>all releases</td>
 617         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2906">CVE-2009-2906</a></td>
 618         <td><a href="/samba/security/CVE-2009-2906.html">Announcement</a></td>
 619     </tr>
 620     <tr>
 621
 622     <tr>
 623         <td>01 Oct 2009</td>
 624         <td><a href="/samba/ftp/patches/security/samba-3.4.1-CVE-2009-2813.patch">
 625         patch for Samba 3.4.1</a><br />
 626         <a href="/samba/ftp/patches/security/samba-3.3.7-CVE-2009-2813.patch">
 627         patch for Samba 3.3.7</a><br />
 628         <a href="/samba/ftp/patches/security/samba-3.2.14-CVE-2009-2813.patch">
 629         patch for Samba 3.2.14</a><br />
 630         <a href="/samba/ftp/patches/security/samba-3.0.36-CVE-2009-2813.patch">
 631         patch for Samba 3.0.36</a><br />
 632         <td>Misconfigured /etc/passwd file may share folders unexpectedly</td>
 633         <td>&gt; 3.0.11</td>
 634         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2813">CVE-2009-2813</a></td>
 635         <td><a href="/samba/security/CVE-2009-2813.html">Announcement</a></td>
 636     </tr>
 637     <tr>
 638
 639     <tr>
 640         <td>23 Jun 2009</td>
 641         <td><a href="/samba/ftp/patches/security/samba-3.3.5-CVE-2009-1888.patch">
 642         patch for Samba 3.3.5</a><br />
 643         <a href="/samba/ftp/patches/security/samba-3.2.12-CVE-2009-1888.patch">
 644         patch for Samba 3.2.12</a><br />
 645         <a href="/samba/ftp/patches/security/samba-3.0.34-CVE-2009-1888.patch">
 646         patch for Samba 3.0.34</a><br />
 647         <td>Uninitialized read of a data value</td>
 648         <td>Samba 3.0.31 - 3.3.5</td>
 649         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1888">CVE-2009-1888</a></td>
 650         <td><a href="/samba/security/CVE-2009-1888.html">Announcement</a></td>
 651     </tr>
 652     <tr>
 653
 654     <tr>
 655         <td>23 Jun 2009</td>
 656         <td><a href="/samba/ftp/patches/security/samba-3.2.12-CVE-2009-1886.patch">
 657         patch for Samba 3.2.12</a>
 658         <td>Formatstring vulnerability in smbclient</td>
 659         <td>Samba 3.2.0 - 3.2.12</td>
 660         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1886">CVE-2009-1886</a></td>
 661         <td><a href="/samba/security/CVE-2009-1886.html">Announcement</a></td>
 662     </tr>
 663     <tr>
 664
 665     <tr>
 666         <td>05 Jan 2009</td>
 667         <td><a href="/samba/ftp/patches/security/samba-3.2.6-CVE-2009-0022.patch">
 668         patch for Samba 3.2.6</a>
 669         <td>Potential access to "/" in setups with registry shares enabled</td>
 670         <td>Samba 3.2.0 - 3.2.6</td>
 671         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0022">CVE-2009-0022</a></td>
 672         <td><a href="/samba/security/CVE-2009-0022.html">Announcement</a></td>
 673     </tr>
 674     <tr>
 675         <td>27 Nov 2008</td>
 676         <td><a href="/samba/ftp/patches/security/samba-3.0.32-CVE-2008-4314.patch">
 677         patch for Samba 3.0.32</a>
 678         <a href="/samba/ftp/patches/security/samba-3.2.4-CVE-2008-4314.patch">
 679         patch for Samba 3.2.4</a></td>
 680         <td>Potential leak of arbitrary memory contents</td>
 681         <td>Samba 3.0.29 - 3.2.4</td>
 682         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4314">CVE-2008-4314</a></td>
 683         <td><a href="/samba/security/CVE-2008-4314.html">Announcement</a></td>
 684     </tr>
 685
 686     <tr>
 687         <td>27 Aug 2008</td>
 688         <td><a href="/samba/ftp/patches/security/samba-3.2.2-CVE-2008-3789-1.patch">
 689         patch 1 for Samba 3.2.2</a>
 690         <a href="/samba/ftp/patches/security/samba-3.2.2-CVE-2008-3789-2.patch">
 691         patch 2 for Samba 3.2.2</a></td>
 692         <td>Wrong permissions of group_mapping.ldb</td>
 693         <td>Samba 3.2.0 - 3.2.2</td>
 694         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3789">CVE-2008-3789</a></td>
 695         <td><a href="/samba/security/CVE-2008-3789.html">Announcement</a></td>
 696     </tr>
 697
 698     <tr>
 699         <td>29 May 2008</td>
 700         <td><a href="/samba/ftp/patches/security/samba-3.0.29-CVE-2008-1105.patch">patch for Samba 3.0.29</a></td>
 701         <td>Boundary failure when parsing SMB responses</td>
 702         <td>Samba 3.0.0 - 3.0.29</td>
 703         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1105">CVE-2008-1105</a></td>
 704         <td><a href="/samba/security/CVE-2008-1105.html">Announcement</a></td>
 705     </tr>
 706
 707     <tr>
 708         <td>10 Dec 2007</td>
 709         <td><a href="/samba/ftp/patches/security/samba-3.0.27a-CVE-2007-6015.patch">patch for Samba 3.0.27a</a></td>
 710         <td>Remote Code Execution in Samba's nmbd (send_mailslot())</td>
 711         <td>Samba 3.0.0 - 3.0.27a</td>
 712         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6015">CVE-2007-6015</a></td>
 713         <td><a href="/samba/security/CVE-2007-6015.html">Announcement</a></td>
 714     </tr>
 715
 716     <tr>
 717         <td>15 Nov 2007</td>
 718         <td><a href="/samba/ftp/patches/security/samba-3.0.26a-CVE-2007-5398.patch">patch for Samba 3.0.26a</a></td>
 719         <td>Remote Code Execution in Samba's nmbd</td>
 720         <td>Samba 3.0.0 - 3.0.26a</td>
 721         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5398">CVE-2007-5398</a></td>
 722         <td><a href="/samba/security/CVE-2007-5398.html">Announcement</a></td>
 723     </tr>
 724
 725     <tr>
 726         <td>15 Nov 2007</td>
 727         <td><a href="/samba/ftp/patches/security/samba-3.0.26a-CVE-2007-4572.patch">patch for Samba 3.0.26a</a></td>
 728         <td>GETDC mailslot processing buffer overrun in nmbd</td>
 729         <td>Samba 3.0.0 - 3.0.26a</td>
 730         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4572">CVE-2007-4572</a></td>
 731         <td><a href="/samba/security/CVE-2007-4572.html">Announcement</a></td>
 732     </tr>
 733
 734     <tr>
 735         <td>11 Sep 2007</td>
 736         <td><a href="/samba/ftp/patches/security/samba-3.0.25-CVE-2007-4138.patch">patch for Samba 3.0.25</a></td>
 737         <td>Incorrect primary group assignment for users using the rfc2307 or sfu nss info plugin.</td>
 738         <td>Samba 3.0.25 - 3.0.25c</td>
 739         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4138">CVE-2007-4138</a></td>
 740         <td><a href="/samba/security/CVE-2007-4138.html">Announcement</a></td>
 741     </tr>
 742
 743     <tr>
 744         <td>14 May 2007</td>
 745         <td><a href="/samba/ftp/patches/security/samba-3.0.24-CVE-2007-2447_v2.patch">patch for Samba 3.0.24</a></td>
 746         <td>Remote Command Injection Vulnerability (Updated June 5 to include missing &quot;c&quot; character from INCLUDE list).</td>
 747         <td>Samba 3.0.0 - 3.0.25rc3</td>
 748         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2447">CVE-2007-2447</a></td>
 749         <td><a href="/samba/security/CVE-2007-2447.html">Announcement</a></td>
 750     </tr>
 751
 752     <tr>
 753         <td>14 May 2007</td>
 754         <td><a href="/samba/ftp/patches/security/samba-3.0.24-CVE-2007-2446_v2.patch">patch for Samba 3.0.24</a></td>
 755         <td>Multiple Heap Overflows Allow Remote Code Execution (Updated May 25 to fix regression in Samba domain controller logon code).</td>
 756         <td>Samba 3.0.0 - 3.0.25rc3</td>
 757         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2446">CVE-2007-2446</a></td>
 758         <td><a href="/samba/security/CVE-2007-2446.html">Announcement</a></td>
 759     </tr>
 760
 761     <tr>
 762         <td>14 May 2007</td>
 763         <td><a href="/samba/ftp/patches/security/samba-3.0.24-CVE-2007-2444_v2.patch">patch for Samba 3.0.24</a></td>
 764         <td>Local SID/Name translation bug can result in user privilege elevation (Updated May 25 to fix regression in the &quot;force group&quot; parameter).</td>
 765         <td>Samba 3.0.23d - 3.0.25pre2</td>
 766         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2444">CVE-2007-2444</a></td>
 767         <td><a href="/samba/security/CVE-2007-2444.html">Announcement</a></td>
 768     </tr>
 769
 770     <tr>
 771         <td>5 Feb 2007</td>
 772         <td><a href="/samba/ftp/patches/security/samba-3.0.23d-CVE-2007-0452.patch">patch for Samba 3.0.23d</a></td>
 773         <td>Potential Denial of Service bug in smbd</td>
 774         <td>Samba 3.0.6 - 3.0.23d</td>
 775         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0452">CVE-2007-0452</a></td>
 776         <td><a href="/samba/security/CVE-2007-0452.html">Announcement</a></td>
 777     </tr>
 778
 779     <tr>
 780         <td>5 Feb 2007</td>
 781         <td><a href="/samba/ftp/patches/security/samba-3.0.23d-CVE-2007-0453.patch">patch for Samba 3.0.23d</a></td>
 782         <td>Buffer overrun in NSS host lookup Winbind library on Solaris</td>
 783         <td>Samba 3.0.21 - 3.0.23d</td>
 784         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0453">CVE-2007-0453</a></td>
 785         <td><a href="/samba/security/CVE-2007-0453.html">Announcement</a></td>
 786     </tr>
 787
 788     <tr>
 789         <td>5 Feb 2007</td>
 790         <td><a href="/samba/ftp/patches/security/samba-3.0.23d-CVE-2007-0454.patch">patch for Samba 3.0.23d</a></td>
 791         <td>Format string bug in afsacl.so VFS plugin</td>
 792         <td>Samba 3.0.6 - 3.0.23d</td>
 793         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0454">CVE-2007-0454</a></td>
 794         <td><a href="/samba/security/CVE-2007-0454.html">Announcement</a></td>
 795     </tr>
 796
 797     <tr>
 798         <td>10 July 2006</td>
 799         <td><a href="/samba/ftp/patches/security/samba-3.0-CVE-2006-3403.patch">patch for Samba 3.0.1 - 3.0.22</a></td>
 800         <td>Memory exhaustion DoS against smbd</td>
 801         <td>Samba 3.0.1 - 3.0.22</td>
 802         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3403">CVE-2006-3403</a></td>
 803         <td><a href="/samba/security/CVE-2006-3403.html">Announcement</a></td>
 804     </tr>
 805
 806     <tr>
 807     <tr>
 808         <td>30 March 2006</td>
 809         <td><a href="/samba/ftp/patches/security/samba-3.0.21-CVE-2006-1059.patch">patch for Samba 3.0.21[a-c]</a></td>
 810         <td>Exposure of machine account credentials in winbind log files</td>
 811         <td>Samba 3.0.21 - 3.0.21c</td>
 812         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1059">CVE-2006-1059</a></td>
 813         <td><a href="/samba/security/CVE-2006-1059.html">Announcement</a></td>
 814     </tr>
 815
 816     <tr>
 817         <td>16 December 2004</td>
 818         <td><a href="/samba/ftp/patches/security/samba-3.0.9-CVE-2004-1154.patch">patch for Samba 3.0.9</a></td>
 819         <td>Integer Overflow in security descriptor parsing</td>
 820         <td>Samba 2.x, 3.0.x &lt;&#61; 3.0.9</td>
 821         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1154">CVE-2004-1154</a></td>
 822         <td><a href="/samba/security/CVE-2004-1154.html">Announcement</a></td>
 823     </tr>
 824
 825     <tr>
 826     <tr>
 827         <td>15 November 2004</td>
 828         <td><a href="/samba/ftp/patches/security/samba-3.0.7-CVE-2004-0882.patch">patch for &lt;&#61;Samba 3.0.7</a></td>
 829         <td>Buffer Overrun in smbd</td>
 830         <td>Samba 3.0.x &lt;&#61; 3.0.7</td>
 831         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0882">CVE-2004-0882</a></td>
 832         <td><a href="/samba/security/CVE-2004-0882.html">Announcement</a></td>
 833     </tr>
 834
 835     <tr>
 836         <td>8 November 2004</td>
 837         <td><a href="/samba/ftp/patches/security/samba-3.0.7-CVE-2004-0930.patch">patch for &lt;&#61;Samba 3.0.7</a></td>
 838         <td>Remote DoS</td>
 839         <td>Samba 3.0.x &lt;&#61; 3.0.7</td>
 840         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0930">CVE-2004-0930</a></td>
 841         <td><a href="/samba/security/CVE-2004-0930.html">Announcement</a></td>
 842     </tr>
 843
 844     <tr>
 845         <td>30 September 2004</td>
 846         <td><a href="/samba/ftp/stable/samba-2.2.12.tar.gz">Samba 2.2.12</a> and/or  <a href="/samba/ftp/patches/security/samba-3.0.2a-reduce_name.patch">patch for &lt;&#61;Samba 3.0.2a</a></td>
 847         <td>Potential arbitrary file access</td>
 848         <td>Samba 2.2.x &lt;&#61;2.2.11 and Samba 3.0.x &lt;&#61;3.0.2a</td>
 849         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0815">CVE-2004-0815</a></td>
 850         <td><a href="/samba/security/CVE-2004-0815.html">Announcement</a></td>
 851     </tr>
 852
 853
 854       <tr>
 855         <td>13 Sept 2004</td>
 856         <td><a href="/samba/ftp/patches/security/samba-3.0.5-DoS.patch">3.0.5 patch</a></td>
 857         <td>Two DoS bugs; one affecting smbd, the other nmbd.</td>
 858         <td>3.0.x &lt;= 3.0.6</td>
 859         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2004-0807">CVE-2004-0807</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2004-0808">CVE-2004-0808</a></td>
 860         <td><a href="/samba/security/CVE-2004-0807_CVE-2004-0808.html">Announcement</a></td>
 861       </tr>
 862
 863       <tr>
 864         <td>22 Jul 2004</td>
 865         <td><a href="/samba/ftp/stable/samba-3.0.5.tar.gz">3.0.5</a></td>
 866         <td>Two potential buffer overruns</td>
 867         <td>>=3.0.2</td>
 868         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0600">CVE-2004-0600</a>,
 869             <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0686">CVE-2004-0686</a>
 870         </td>
 871         <td><a href="/samba/security/CVE-2004-0600.html">CVE-2004-0600 Announcement</a>
 872             <a href="/samba/security/CVE-2004-0686.html">CVE-2004-0686 Announcement</a></td>
 873       </tr>
 874
 875       <tr>
 876         <td>22 Jul 2004</td>
 877         <td><a href="/samba/ftp/stable/samba-2.2.10.tar.gz">2.2.10</a></td>
 878         <td>Buffer overrun in hash mangling method</td>
 879         <td>all 2.2 releases</td>
 880         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0686">CVE-2004-0686</a>
 881         </td>
 882         <td><a href="/samba/history/samba-2.2.10.html">release notes</a></td>
 883       </tr>
 884
 885       <tr>
 886         <td>9 Feb 2004</td>
 887         <td><a href="/samba/ftp/old-versions/samba-3.0.2a.tar.gz">3.0.2a</a></td>
 888         <td align="left">Password initialization bug that could grant
 889         an attacker unauthorized
 890         access to a user account created by the mksmbpasswd.sh shell script.</td>
 891         <td>>=3.0.0</td>
 892         <td><a
 893         href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0082">CVE-2004-0082</a></td>
 894         <td><a href="/samba/security/CVE-2004-0082.html">Announcement</a></td>
 895       </tr>
 896
 897       <tr>
 898         <td>7 Apr 2003</td>
 899         <td><a href="/samba/ftp/old-versions/samba-2.2.8a.tar.gz">2.2.8a</a></td>
 900         <td>Buffer overrun condition in the SMB/CIFS packet fragment
 901         re-assembly code.</td>
 902         <td>all 2.0 releases and <= 2.2.8</td>
 903         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0196">CVE-2003-0196</a>,
 904         <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0201">CVE-2003-0201</a></td>
 905         <td><a href="/samba/history/samba-2.2.8a.html">release notes</a></td>
 906       </tr>
 907
 908       <tr>
 909         <td>10 Dec 2002</td>
 910         <td><a href="/samba/ftp/old-versions/samba-2.2.7a.tar.gz">2.2.7a</a></td>
 911         <td>Bug in the length checking for encrypted password change
 912         requests from clients.</td>
 913         <td>2.2.2 - 2.2.6</td>
 914         <td><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0085">CVE-2003-0085</a></td>
 915         <td><a href="/samba/history/samba-2.2.7a.html">release notes</a></td>
 916       </tr>
 917
 918       <tr>
 919         <td>23 Jun 2001</td>
 920         <td><a href="/samba/ftp/old-versions/samba-2.2.0a.tar.gz">2.2.0a</a></td>
 921         <td>Bug in expansion of certain smb.conf variables such as
 922         %m that could grant an attacker the capability to overwrite arbitrary
 923         files on the server.  Bug that causes smbd not to honor the hosts allow
 924         and deny smb.conf directives.</td>
 925         <td>2.2.0</td>
 926         <td>&nbsp</td>
 927         <td><a href="/samba/history/samba-2.2.0a.html">release notes</a></td>
 928       </tr>
 929
 930       <tr>
 931         <td>23 Jun 2001</td>
 932         <td><a href="/samba/ftp/old-versions/samba-2.0.10.tar.gz">2.0.10</a></td>
 933         <td>Bug in the handling of temporary files that allows local
 934         users to destroy data on local devices.</td>
 935         <td>>= 2.0.0</td>
 936         <td>&nbsp</td>
 937         <td><a href="/samba/history/samba-2.0.10.html">release notes</a></td>
 938       </tr>
 939
 940     </table>
 941
 942     <p><em>If you suspect you have discovered a serious security hole in a
 943 Samba release, please send an email to <a
 944 href="mailto:security@samba.org">security@samba.org</a>.</em></p>
 945
 946 <!--#include virtual="footer_history.html" -->