CVE-2019-12436

EPSS 4.37%
Published 19.06.2019 12:15:10
Last modified 21.11.2024 04:22:50
Source cve@mitre.org
Teams watchlist Login
Open Login

Samba 4.10.x before 4.10.5 has a NULL pointer dereference, leading to an AD DC LDAP server Denial of Service. This is related to an attacker using the paged search control. The attacker must have directory read access in order to attempt an exploit.

Affected products Warnungen 0 Metrics 3 CWE 1 References 8

Data is provided by the National Vulnerability Database (NVD)

Samba ≫ Samba Version >= 4.10.0 < 4.10.5

Canonical ≫ Ubuntu Linux Version19.04

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	4.37%	0.885

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:N/I:N/A:P

CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ3LCJNJ3ONHIRKDSKOTT6QGXALLCHVG/

https://usn.ubuntu.com/4018-1/

Third Party Advisory

https://www.synology.com/security/advisory/Synology_SA_19_27

http://www.securityfocus.com/bid/108823

https://www.samba.org/samba/security/CVE-2019-12436.html

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-12436

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-12436

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-12436

EUVD