Search for vulnerabilities
Vulnerability details: VCID-qzxy-a8mc-jfgk
Vulnerability ID VCID-qzxy-a8mc-jfgk
Aliases CVE-2019-14861
Summary All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authenticated users. This is used for example to allow machines to self-register in DNS. If a DNS record was created that case-insensitively matched the name of the zone, the ldb_qsort() and dns_name_compare() routines could be confused into reading memory prior to the list of DNS entries when responding to DnssrvEnumRecords() or DnssrvEnumRecords2() and so following invalid memory as a pointer.
Status Published
Exploitability 0.5
Weighted Severity 4.8
Risk 2.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-276 Incorrect Default Permissions
System Score Found at
cvssv3 5.3 http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.html
ssvc Track http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.html
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-14861.json
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.00885 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.02266 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.02266 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.02266 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
epss 0.02266 https://api.first.org/data/v1/epss?cve=CVE-2019-14861
cvssv3 5.3 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14861
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14861
cvssv3 5.3 https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
ssvc Track https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
cvssv3 5.3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PJH3ROOFYMOATD2UEPC47P5RPBDTY77E/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PJH3ROOFYMOATD2UEPC47P5RPBDTY77E/
cvssv3 5.3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNKA4YIPV7AZR7KK3GW6L3HKGHSGJZFE/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNKA4YIPV7AZR7KK3GW6L3HKGHSGJZFE/
cvssv2 3.5 https://nvd.nist.gov/vuln/detail/CVE-2019-14861
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2019-14861
cvssv3 5.3 https://security.gentoo.org/glsa/202003-52
ssvc Track https://security.gentoo.org/glsa/202003-52
cvssv3 5.3 https://security.netapp.com/advisory/ntap-20191210-0002/
ssvc Track https://security.netapp.com/advisory/ntap-20191210-0002/
cvssv3 5.3 https://usn.ubuntu.com/4217-1/
ssvc Track https://usn.ubuntu.com/4217-1/
cvssv3 5.3 https://usn.ubuntu.com/4217-2/
ssvc Track https://usn.ubuntu.com/4217-2/
cvssv3 5.3 https://www.samba.org/samba/security/CVE-2019-14861.html
ssvc Track https://www.samba.org/samba/security/CVE-2019-14861.html
cvssv3 5.3 https://www.synology.com/security/advisory/Synology_SA_19_40
ssvc Track https://www.synology.com/security/advisory/Synology_SA_19_40
cvssv3 5.3 http://www.openwall.com/lists/oss-security/2024/06/24/3
ssvc Track http://www.openwall.com/lists/oss-security/2024/06/24/3
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-14861.json
https://api.first.org/data/v1/epss?cve=CVE-2019-14861
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14861
1778586 https://bugzilla.redhat.com/show_bug.cgi?id=1778586
202003-52 https://security.gentoo.org/glsa/202003-52
3 http://www.openwall.com/lists/oss-security/2024/06/24/3
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
CVE-2019-14861 https://nvd.nist.gov/vuln/detail/CVE-2019-14861
CVE-2019-14861.html https://www.samba.org/samba/security/CVE-2019-14861.html
msg00023.html https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
msg00038.html http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.html
ntap-20191210-0002 https://security.netapp.com/advisory/ntap-20191210-0002/
PJH3ROOFYMOATD2UEPC47P5RPBDTY77E https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PJH3ROOFYMOATD2UEPC47P5RPBDTY77E/
show_bug.cgi?id=CVE-2019-14861 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14861
Synology_SA_19_40 https://www.synology.com/security/advisory/Synology_SA_19_40
USN-4217-1 https://usn.ubuntu.com/4217-1/
USN-4217-2 https://usn.ubuntu.com/4217-2/
WNKA4YIPV7AZR7KK3GW6L3HKGHSGJZFE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNKA4YIPV7AZR7KK3GW6L3HKGHSGJZFE/
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-25T15:36:30Z/ Found at http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.html
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-14861.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14861
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-25T15:36:30Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14861
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-25T15:36:30Z/ Found at https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PJH3ROOFYMOATD2UEPC47P5RPBDTY77E/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-25T15:36:30Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PJH3ROOFYMOATD2UEPC47P5RPBDTY77E/
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNKA4YIPV7AZR7KK3GW6L3HKGHSGJZFE/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-25T15:36:30Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNKA4YIPV7AZR7KK3GW6L3HKGHSGJZFE/
Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2019-14861
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2019-14861
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://security.gentoo.org/glsa/202003-52
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-25T15:36:30Z/ Found at https://security.gentoo.org/glsa/202003-52
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20191210-0002/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-25T15:36:30Z/ Found at https://security.netapp.com/advisory/ntap-20191210-0002/
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://usn.ubuntu.com/4217-1/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-25T15:36:30Z/ Found at https://usn.ubuntu.com/4217-1/
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://usn.ubuntu.com/4217-2/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-25T15:36:30Z/ Found at https://usn.ubuntu.com/4217-2/
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://www.samba.org/samba/security/CVE-2019-14861.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-25T15:36:30Z/ Found at https://www.samba.org/samba/security/CVE-2019-14861.html
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://www.synology.com/security/advisory/Synology_SA_19_40
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-25T15:36:30Z/ Found at https://www.synology.com/security/advisory/Synology_SA_19_40
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Found at http://www.openwall.com/lists/oss-security/2024/06/24/3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-25T15:36:30Z/ Found at http://www.openwall.com/lists/oss-security/2024/06/24/3
Exploit Prediction Scoring System (EPSS)
Percentile 0.74591
EPSS Score 0.00885
Published At Aug. 3, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:29:06.213058+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/v3.18/main.json 37.0.0