VDB
CVE-2015-7540
CVE-2015-7540
PUBLISHED
CVSS 7.5 HIGH
The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation, which allows remote attackers to cause a denial of service (memory consumption and daemon crash) via crafted packets.
EPSS 7.12% · 94.0th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
7.12%
94.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:14.04:LTS | samba | 0, 2:4.0.10+dfsg-4ubuntu2, 2:4.0.13+dfsg-1ubuntu1 |
| Ubuntu:16.04:LTS | samba | 2:4.1.17+dfsg-4ubuntu2, 2:4.1.20+dfsg-1ubuntu1, 2:4.1.20+dfsg-1ubuntu2 |
Timeline
- Dec 16, 2015 CVE Published
- Feb 4, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
- Jul 18, 2023 EPSS Score
- Oct 31, 2023 EPSS Score
- Dec 23, 2023 EPSS Score
- Feb 14, 2024 EPSS Score
- May 29, 2024 EPSS Score
References
- https://ubuntu.com/security/CVE-2015-7540 third-party-advisory
- https://www.samba.org/samba/security/CVE-2015-7540.html third-party-advisory
- https://ubuntu.com/security/notices/USN-2855-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2015-7540 third-party-advisory