Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/193495?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/193495?format=api", "purl": "pkg:ebuild/net-fs/samba@4.2.11", "type": "ebuild", "namespace": "net-fs", "name": "samba", "version": "4.2.11", "qualifiers": {}, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": "4.5.16", "latest_non_vulnerable_version": "4.18.9", "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/100665?format=api", "vulnerability_id": "VCID-4pjr-6tfv-hqgu", "summary": "The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation, which allows remote attackers to cause a denial of service (memory consumption and daemon crash) via crafted packets.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-7540.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-7540.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-7540", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.39597", "scoring_system": "epss", "scoring_elements": "0.97384", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.39597", "scoring_system": "epss", "scoring_elements": "0.9739", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-7540" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3223", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3223" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5296", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5296" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7540", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7540" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1288451", "reference_id": "1288451", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1288451" }, { "reference_url": "https://security.gentoo.org/glsa/201612-47", "reference_id": "GLSA-201612-47", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201612-47" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0010", "reference_id": "RHSA-2016:0010", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0010" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0015", "reference_id": "RHSA-2016:0015", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0015" }, { "reference_url": "https://usn.ubuntu.com/2855-1/", "reference_id": "USN-2855-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2855-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/193495?format=api", "purl": "pkg:ebuild/net-fs/samba@4.2.11", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/net-fs/samba@4.2.11" } ], "aliases": [ "CVE-2015-7540" ], "risk_score": 0.2, "exploitability": "0.5", "weighted_severity": "0.4", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4pjr-6tfv-hqgu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/75219?format=api", "vulnerability_id": "VCID-68mw-cr8k-qfgs", "summary": "ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles string lengths, which allows remote attackers to obtain sensitive information from daemon heap memory by sending crafted packets and then reading (1) an error message or (2) a database value.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5330.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5330.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5330", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01625", "scoring_system": "epss", "scoring_elements": "0.82196", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.01625", "scoring_system": "epss", "scoring_elements": "0.82225", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5330" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3223", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3223" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5296", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5296" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7540", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7540" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:L/Au:S/C:P/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281326", "reference_id": "1281326", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281326" }, { "reference_url": "https://security.gentoo.org/glsa/201612-47", "reference_id": "GLSA-201612-47", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201612-47" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0006", "reference_id": "RHSA-2016:0006", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0006" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0009", "reference_id": "RHSA-2016:0009", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0009" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0010", "reference_id": "RHSA-2016:0010", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0010" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0014", "reference_id": "RHSA-2016:0014", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0014" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0015", "reference_id": "RHSA-2016:0015", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0015" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0016", "reference_id": "RHSA-2016:0016", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0016" }, { "reference_url": "https://usn.ubuntu.com/2855-1/", "reference_id": "USN-2855-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2855-1/" }, { "reference_url": "https://usn.ubuntu.com/2856-1/", "reference_id": "USN-2856-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2856-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/193495?format=api", "purl": "pkg:ebuild/net-fs/samba@4.2.11", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/net-fs/samba@4.2.11" } ], "aliases": [ "CVE-2015-5330" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-68mw-cr8k-qfgs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/100675?format=api", "vulnerability_id": "VCID-8tyg-f73c-zuh3", "summary": "Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2115.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2115.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2115", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.22744", "scoring_system": "epss", "scoring_elements": "0.95973", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.22744", "scoring_system": "epss", "scoring_elements": "0.95977", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2115" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:M/Au:N/C:P/I:P/A:P" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1312084", "reference_id": "1312084", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1312084" }, { "reference_url": "https://security.gentoo.org/glsa/201612-47", "reference_id": "GLSA-201612-47", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201612-47" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0611", "reference_id": "RHSA-2016:0611", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0611" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0612", "reference_id": "RHSA-2016:0612", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0612" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0613", "reference_id": "RHSA-2016:0613", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0613" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0614", "reference_id": "RHSA-2016:0614", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0614" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0618", "reference_id": "RHSA-2016:0618", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0618" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0619", "reference_id": "RHSA-2016:0619", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0619" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0620", "reference_id": "RHSA-2016:0620", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0620" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0624", "reference_id": "RHSA-2016:0624", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0624" }, { "reference_url": "https://usn.ubuntu.com/2950-1/", "reference_id": "USN-2950-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2950-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/193495?format=api", "purl": "pkg:ebuild/net-fs/samba@4.2.11", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/net-fs/samba@4.2.11" } ], "aliases": [ "CVE-2016-2115" ], "risk_score": 0.1, "exploitability": "0.5", "weighted_severity": "0.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8tyg-f73c-zuh3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/100663?format=api", "vulnerability_id": "VCID-c99r-m2v5-zqa3", "summary": "The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not verify that the DIRECTORY_LIST access right has been granted, which allows remote attackers to access snapshots by visiting a shadow copy directory.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5299.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5299.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5299", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.09138", "scoring_system": "epss", "scoring_elements": "0.92829", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.09138", "scoring_system": "epss", "scoring_elements": "0.92841", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5299" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3223", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3223" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5296", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5296" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7540", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7540" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.5", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:M/Au:S/C:P/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1276126", "reference_id": "1276126", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1276126" }, { "reference_url": "https://security.gentoo.org/glsa/201612-47", "reference_id": "GLSA-201612-47", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201612-47" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0006", "reference_id": "RHSA-2016:0006", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0006" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0010", "reference_id": "RHSA-2016:0010", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0010" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0011", "reference_id": "RHSA-2016:0011", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0011" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0015", "reference_id": "RHSA-2016:0015", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0015" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0016", "reference_id": "RHSA-2016:0016", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0016" }, { "reference_url": "https://usn.ubuntu.com/2855-1/", "reference_id": "USN-2855-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2855-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/193495?format=api", "purl": "pkg:ebuild/net-fs/samba@4.2.11", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/net-fs/samba@4.2.11" } ], "aliases": [ "CVE-2015-5299" ], "risk_score": 0.1, "exploitability": "0.5", "weighted_severity": "0.1", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-c99r-m2v5-zqa3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/100670?format=api", "vulnerability_id": "VCID-eaxm-5jgj-eqcg", "summary": "The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, a related issue to CVE-2015-0005.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2111.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2111.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2111", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02808", "scoring_system": "epss", "scoring_elements": "0.864", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.02808", "scoring_system": "epss", "scoring_elements": "0.86423", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2111" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:M/Au:N/C:P/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311902", "reference_id": "1311902", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311902" }, { "reference_url": "https://security.gentoo.org/glsa/201612-47", "reference_id": "GLSA-201612-47", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201612-47" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0611", "reference_id": "RHSA-2016:0611", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0611" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0612", "reference_id": "RHSA-2016:0612", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0612" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0613", "reference_id": "RHSA-2016:0613", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0613" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0614", "reference_id": "RHSA-2016:0614", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0614" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0618", "reference_id": "RHSA-2016:0618", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0618" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0619", "reference_id": "RHSA-2016:0619", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0619" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0620", "reference_id": "RHSA-2016:0620", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0620" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0621", "reference_id": "RHSA-2016:0621", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0621" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0623", "reference_id": "RHSA-2016:0623", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0623" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0624", "reference_id": "RHSA-2016:0624", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0624" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0625", "reference_id": "RHSA-2016:0625", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0625" }, { "reference_url": "https://usn.ubuntu.com/2950-1/", "reference_id": "USN-2950-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2950-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/193495?format=api", "purl": "pkg:ebuild/net-fs/samba@4.2.11", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/net-fs/samba@4.2.11" } ], "aliases": [ "CVE-2016-2111" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-eaxm-5jgj-eqcg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/100676?format=api", "vulnerability_id": "VCID-egeg-4ds7-d3d1", "summary": "The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka \"BADLOCK.\"", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2118.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2118.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2118", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.78522", "scoring_system": "epss", "scoring_elements": "0.99061", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2118" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:M/Au:N/C:P/I:P/A:P" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317990", "reference_id": "1317990", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317990" }, { "reference_url": "https://security.gentoo.org/glsa/201612-47", "reference_id": "GLSA-201612-47", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201612-47" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0611", "reference_id": "RHSA-2016:0611", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0611" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0612", "reference_id": "RHSA-2016:0612", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0612" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0613", "reference_id": "RHSA-2016:0613", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0613" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0614", "reference_id": "RHSA-2016:0614", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0614" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0618", "reference_id": "RHSA-2016:0618", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0618" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0619", "reference_id": "RHSA-2016:0619", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0619" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0620", "reference_id": "RHSA-2016:0620", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0620" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0621", "reference_id": "RHSA-2016:0621", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0621" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0623", "reference_id": "RHSA-2016:0623", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0623" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0624", "reference_id": "RHSA-2016:0624", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0624" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0625", "reference_id": "RHSA-2016:0625", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0625" }, { "reference_url": "https://usn.ubuntu.com/2950-1/", "reference_id": "USN-2950-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2950-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/193495?format=api", "purl": "pkg:ebuild/net-fs/samba@4.2.11", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/net-fs/samba@4.2.11" } ], "aliases": [ "CVE-2016-2118" ], "risk_score": 0.3, "exploitability": "0.5", "weighted_severity": "0.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-egeg-4ds7-d3d1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/100672?format=api", "vulnerability_id": "VCID-enbr-g8ae-ubbc", "summary": "Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2113.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2113.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2113", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.04197", "scoring_system": "epss", "scoring_elements": "0.88919", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.04197", "scoring_system": "epss", "scoring_elements": "0.88936", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2113" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv2", "scoring_elements": "AV:A/AC:M/Au:N/C:P/I:P/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311910", "reference_id": "1311910", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311910" }, { "reference_url": "https://security.gentoo.org/glsa/201612-47", "reference_id": "GLSA-201612-47", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201612-47" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0612", "reference_id": "RHSA-2016:0612", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0612" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0614", "reference_id": "RHSA-2016:0614", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0614" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0618", "reference_id": "RHSA-2016:0618", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0618" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0620", "reference_id": "RHSA-2016:0620", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0620" }, { "reference_url": "https://usn.ubuntu.com/2950-1/", "reference_id": "USN-2950-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2950-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/193495?format=api", "purl": "pkg:ebuild/net-fs/samba@4.2.11", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/net-fs/samba@4.2.11" } ], "aliases": [ "CVE-2016-2113" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-enbr-g8ae-ubbc" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/100673?format=api", "vulnerability_id": "VCID-p4mk-1t9q-sbb3", "summary": "The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the \"server signing = mandatory\" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2114.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2114.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2114", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.05863", "scoring_system": "epss", "scoring_elements": "0.90727", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.05863", "scoring_system": "epss", "scoring_elements": "0.90739", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2114" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.8", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:M/Au:N/C:P/I:P/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1312082", "reference_id": "1312082", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1312082" }, { "reference_url": "https://security.gentoo.org/glsa/201612-47", "reference_id": "GLSA-201612-47", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201612-47" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0612", "reference_id": "RHSA-2016:0612", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0612" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0614", "reference_id": "RHSA-2016:0614", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0614" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0618", "reference_id": "RHSA-2016:0618", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0618" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0620", "reference_id": "RHSA-2016:0620", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0620" }, { "reference_url": "https://usn.ubuntu.com/2950-1/", "reference_id": "USN-2950-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2950-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/193495?format=api", "purl": "pkg:ebuild/net-fs/samba@4.2.11", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/net-fs/samba@4.2.11" } ], "aliases": [ "CVE-2016-2114" ], "risk_score": 0.1, "exploitability": "0.5", "weighted_severity": "0.1", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-p4mk-1t9q-sbb3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/100667?format=api", "vulnerability_id": "VCID-sdjf-rkjd-sudg", "summary": "The samldb_check_user_account_control_acl function in dsdb/samdb/ldb_modules/samldb.c in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not properly check for administrative privileges during creation of machine accounts, which allows remote authenticated users to bypass intended access restrictions by leveraging the existence of a domain with both a Samba DC and a Windows DC, a similar issue to CVE-2015-2535.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8467.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8467.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-8467", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01714", "scoring_system": "epss", "scoring_elements": "0.82702", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.01714", "scoring_system": "epss", "scoring_elements": "0.82728", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-8467" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3223", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3223" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5296", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5296" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7540", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7540" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1290294", "reference_id": "1290294", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1290294" }, { "reference_url": "https://security.gentoo.org/glsa/201612-47", "reference_id": "GLSA-201612-47", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201612-47" }, { "reference_url": "https://usn.ubuntu.com/2855-1/", "reference_id": "USN-2855-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2855-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/193495?format=api", "purl": "pkg:ebuild/net-fs/samba@4.2.11", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/net-fs/samba@4.2.11" } ], "aliases": [ "CVE-2015-8467" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-sdjf-rkjd-sudg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/75218?format=api", "vulnerability_id": "VCID-tyhs-5xjv-c7b5", "summary": "The ldb_wildcard_compare function in ldb_match.c in ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles certain zero values, which allows remote attackers to cause a denial of service (infinite loop) via crafted packets.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-3223.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-3223.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-3223", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.20255", "scoring_system": "epss", "scoring_elements": "0.95629", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.20255", "scoring_system": "epss", "scoring_elements": "0.95635", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-3223" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3223", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3223" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5296", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5296" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7540", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7540" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:L/Au:N/C:N/I:N/A:C" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1290287", "reference_id": "1290287", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1290287" }, { "reference_url": "https://security.gentoo.org/glsa/201612-47", "reference_id": "GLSA-201612-47", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201612-47" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0009", "reference_id": "RHSA-2016:0009", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0009" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0014", "reference_id": "RHSA-2016:0014", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0014" }, { "reference_url": "https://usn.ubuntu.com/2855-1/", "reference_id": "USN-2855-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2855-1/" }, { "reference_url": "https://usn.ubuntu.com/2856-1/", "reference_id": "USN-2856-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2856-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/193495?format=api", "purl": "pkg:ebuild/net-fs/samba@4.2.11", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/net-fs/samba@4.2.11" } ], "aliases": [ "CVE-2015-3223" ], "risk_score": 0.1, "exploitability": "0.5", "weighted_severity": "0.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tyhs-5xjv-c7b5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/100669?format=api", "vulnerability_id": "VCID-vtne-we7s-tuet", "summary": "The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as demonstrated by clearing the NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN option to disrupt LDAP security.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2110.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2110.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2110", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.17748", "scoring_system": "epss", "scoring_elements": "0.95244", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.17748", "scoring_system": "epss", "scoring_elements": "0.95252", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2110" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.8", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:M/Au:N/C:P/I:P/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311893", "reference_id": "1311893", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311893" }, { "reference_url": "https://security.gentoo.org/glsa/201612-47", "reference_id": "GLSA-201612-47", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201612-47" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0611", "reference_id": "RHSA-2016:0611", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0611" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0612", "reference_id": "RHSA-2016:0612", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0612" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0613", "reference_id": "RHSA-2016:0613", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0613" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0614", "reference_id": "RHSA-2016:0614", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0614" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0618", "reference_id": "RHSA-2016:0618", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0618" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0619", "reference_id": "RHSA-2016:0619", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0619" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0620", "reference_id": "RHSA-2016:0620", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0620" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0621", "reference_id": "RHSA-2016:0621", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0621" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0623", "reference_id": "RHSA-2016:0623", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0623" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0624", "reference_id": "RHSA-2016:0624", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0624" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0625", "reference_id": "RHSA-2016:0625", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0625" }, { "reference_url": "https://usn.ubuntu.com/2950-1/", "reference_id": "USN-2950-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2950-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/193495?format=api", "purl": "pkg:ebuild/net-fs/samba@4.2.11", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/net-fs/samba@4.2.11" } ], "aliases": [ "CVE-2016-2110" ], "risk_score": 0.1, "exploitability": "0.5", "weighted_severity": "0.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vtne-we7s-tuet" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/100661?format=api", "vulnerability_id": "VCID-x55t-cux2-q3gw", "summary": "vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5252.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5252.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5252", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.17333", "scoring_system": "epss", "scoring_elements": "0.95169", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.17333", "scoring_system": "epss", "scoring_elements": "0.95177", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5252" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3223", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3223" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5296", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5296" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7540", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7540" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:L/Au:S/C:C/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1290288", "reference_id": "1290288", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1290288" }, { "reference_url": "https://security.gentoo.org/glsa/201612-47", "reference_id": "GLSA-201612-47", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201612-47" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0006", "reference_id": "RHSA-2016:0006", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0006" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0010", "reference_id": "RHSA-2016:0010", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0010" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0011", "reference_id": "RHSA-2016:0011", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0011" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0015", "reference_id": "RHSA-2016:0015", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0015" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0016", "reference_id": "RHSA-2016:0016", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0016" }, { "reference_url": "https://usn.ubuntu.com/2855-1/", "reference_id": "USN-2855-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2855-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/193495?format=api", "purl": "pkg:ebuild/net-fs/samba@4.2.11", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/net-fs/samba@4.2.11" } ], "aliases": [ "CVE-2015-5252" ], "risk_score": 0.1, "exploitability": "0.5", "weighted_severity": "0.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-x55t-cux2-q3gw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/100671?format=api", "vulnerability_id": "VCID-yt92-mfwy-z7er", "summary": "The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the \"client ldap sasl wrapping\" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2112.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2112.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2112", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.16609", "scoring_system": "epss", "scoring_elements": "0.95043", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.16609", "scoring_system": "epss", "scoring_elements": "0.95051", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2112" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv2", "scoring_elements": "AV:A/AC:M/Au:N/C:P/I:P/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311903", "reference_id": "1311903", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311903" }, { "reference_url": "https://security.gentoo.org/glsa/201612-47", "reference_id": "GLSA-201612-47", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201612-47" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0611", "reference_id": "RHSA-2016:0611", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0611" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0612", "reference_id": "RHSA-2016:0612", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0612" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0613", "reference_id": "RHSA-2016:0613", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0613" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0614", "reference_id": "RHSA-2016:0614", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0614" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0618", "reference_id": "RHSA-2016:0618", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0618" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0619", "reference_id": "RHSA-2016:0619", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0619" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0620", "reference_id": "RHSA-2016:0620", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0620" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0624", "reference_id": "RHSA-2016:0624", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0624" }, { "reference_url": "https://usn.ubuntu.com/2950-1/", "reference_id": "USN-2950-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2950-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/193495?format=api", "purl": "pkg:ebuild/net-fs/samba@4.2.11", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/net-fs/samba@4.2.11" } ], "aliases": [ "CVE-2016-2112" ], "risk_score": 0.1, "exploitability": "0.5", "weighted_severity": "0.1", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-yt92-mfwy-z7er" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/100662?format=api", "vulnerability_id": "VCID-zfyb-9wrs-eyfx", "summary": "Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5296.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5296.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5296", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.03652", "scoring_system": "epss", "scoring_elements": "0.88073", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.03652", "scoring_system": "epss", "scoring_elements": "0.88094", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5296" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3223", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3223" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5296", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5296" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5299" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5330" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7540", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7540" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8467" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.2", "scoring_system": "cvssv2", "scoring_elements": "AV:A/AC:H/Au:N/C:P/I:P/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1290292", "reference_id": "1290292", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1290292" }, { "reference_url": "https://security.gentoo.org/glsa/201612-47", "reference_id": "GLSA-201612-47", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201612-47" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0006", "reference_id": "RHSA-2016:0006", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0006" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0010", "reference_id": "RHSA-2016:0010", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0010" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0011", "reference_id": "RHSA-2016:0011", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0011" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0015", "reference_id": "RHSA-2016:0015", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0015" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:0016", "reference_id": "RHSA-2016:0016", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:0016" }, { "reference_url": "https://usn.ubuntu.com/2855-1/", "reference_id": "USN-2855-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2855-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/193495?format=api", "purl": "pkg:ebuild/net-fs/samba@4.2.11", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/net-fs/samba@4.2.11" } ], "aliases": [ "CVE-2015-5296" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-zfyb-9wrs-eyfx" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/net-fs/samba@4.2.11" }