{"url":"http://public2.vulnerablecode.io/api/packages/159442?format=json","purl":"pkg:rpm/redhat/samba@4.2.10-5?arch=ael7b_1","type":"rpm","namespace":"redhat","name":"samba","version":"4.2.10-5","qualifiers":{"arch":"ael7b_1"},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":null,"latest_non_vulnerable_version":null,"affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/100676?format=json","vulnerability_id":"VCID-egeg-4ds7-d3d1","summary":"The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka \"BADLOCK.\"","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2118.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2118.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-2118","reference_id":"","reference_type":"","scores":[{"value":"0.78522","scoring_system":"epss","scoring_elements":"0.99061","published_at":"2026-06-08T12:55:00Z"},{"value":"0.78522","scoring_system":"epss","scoring_elements":"0.99062","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-2118"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:P/I:P/A:P"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1317990","reference_id":"1317990","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1317990"},{"reference_url":"https://security.gentoo.org/glsa/201612-47","reference_id":"GLSA-201612-47","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201612-47"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0611","reference_id":"RHSA-2016:0611","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0611"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0612","reference_id":"RHSA-2016:0612","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0612"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0613","reference_id":"RHSA-2016:0613","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0613"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0614","reference_id":"RHSA-2016:0614","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0614"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0618","reference_id":"RHSA-2016:0618","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0618"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0619","reference_id":"RHSA-2016:0619","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0619"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0620","reference_id":"RHSA-2016:0620","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0620"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0621","reference_id":"RHSA-2016:0621","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0621"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0623","reference_id":"RHSA-2016:0623","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0623"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0624","reference_id":"RHSA-2016:0624","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0624"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0625","reference_id":"RHSA-2016:0625","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0625"},{"reference_url":"https://usn.ubuntu.com/2950-1/","reference_id":"USN-2950-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/2950-1/"}],"fixed_packages":[],"aliases":["CVE-2016-2118"],"risk_score":1.7,"exploitability":"0.5","weighted_severity":"3.4","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-egeg-4ds7-d3d1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/100664?format=json","vulnerability_id":"VCID-m364-w7f6-aug7","summary":"Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of service (application crash or CPU consumption), or possibly execute arbitrary code on a client system via unspecified vectors.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5370.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5370.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-5370","reference_id":"","reference_type":"","scores":[{"value":"0.21108","scoring_system":"epss","scoring_elements":"0.95764","published_at":"2026-06-04T12:55:00Z"},{"value":"0.21108","scoring_system":"epss","scoring_elements":"0.95769","published_at":"2026-06-05T12:55:00Z"},{"value":"0.21108","scoring_system":"epss","scoring_elements":"0.95773","published_at":"2026-06-06T12:55:00Z"},{"value":"0.21108","scoring_system":"epss","scoring_elements":"0.95774","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-5370"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.5","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:S/C:C/I:C/A:C"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1309987","reference_id":"1309987","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1309987"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0611","reference_id":"RHSA-2016:0611","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0611"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0612","reference_id":"RHSA-2016:0612","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0612"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0613","reference_id":"RHSA-2016:0613","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0613"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0614","reference_id":"RHSA-2016:0614","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0614"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0618","reference_id":"RHSA-2016:0618","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0618"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0619","reference_id":"RHSA-2016:0619","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0619"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0620","reference_id":"RHSA-2016:0620","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0620"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0624","reference_id":"RHSA-2016:0624","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0624"},{"reference_url":"https://usn.ubuntu.com/2950-1/","reference_id":"USN-2950-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/2950-1/"}],"fixed_packages":[],"aliases":["CVE-2015-5370"],"risk_score":2.1,"exploitability":"0.5","weighted_severity":"4.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-m364-w7f6-aug7"}],"fixing_vulnerabilities":[],"risk_score":"2.1","resource_url":"http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/samba@4.2.10-5%3Farch=ael7b_1"}