CVE-2019-12436

MEDIUM

Samba 4.10.0-4.10.4 - Authenticated Denial of Service via Paged Search Control

Title source: llm

Description

Samba 4.10.x before 4.10.5 has a NULL pointer dereference, leading to an AD DC LDAP server Denial of Service. This is related to an attacker using the paged search control. The attacker must have directory read access in order to attempt an exploit.

References (5)

Core 5

Core References

Vendor Advisory x_refsource_confirm

https://www.samba.org/samba/security/CVE-2019-12436.html

Third Party Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/4018-1/

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/108823

Vendor Advisory x_refsource_confirm

https://www.synology.com/security/advisory/Synology_SA_19_27

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ3LCJNJ3ONHIRKDSKOTT6QGXALLCHVG/

Scores

CVSS v3 6.5

EPSS 0.0235

EPSS Percentile 85.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-476

Status published

Products (2)

canonical/ubuntu_linux 19.04

samba/samba 4.10.0 - 4.10.5

Published Jun 19, 2019

Tracked Since Feb 18, 2026